Analysis
- max time kernel
2699s - max time network
2702s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
13/02/2024, 22:46
General
- Target Olympia.zip
- Size 693KB
- Sample240213-2p1vbscc73
- SHA256 d0eea99404ebc8bea473f55b685d86d0bab32ffe216b1408b982e4fde6638d23
Malware Config
Signatures
- Downloads MZ/PE file
- Modifies Installed Components in the registry 2 TTPs 7 IoCs
- Sets file execution options in registry 2 TTPs 8 IoCs
- Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Registers COM server for autorun 1 TTPs 64 IoCs
- Adds Run key to start application 2 TTPs 7 IoCs
- Blocklisted process makes network request 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Checks system information in the registry 2 TTPs 28 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies Internet Explorer settings 1 TTPs 24 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Olympia.zip1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd398f9758,0x7ffd398f9768,0x7ffd398f97782⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4632 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5216 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5416 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5772 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4812 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3020 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3136 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5388 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3196 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\python-3.12.2-amd64.exe"C:\Users\Admin\Downloads\python-3.12.2-amd64.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Temp\{9DFB2A0A-3997-45AC-8E57-138E25C872EF}\.cr\python-3.12.2-amd64.exe"C:\Windows\Temp\{9DFB2A0A-3997-45AC-8E57-138E25C872EF}\.cr\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.2-amd64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=6563⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
C:\Windows\Temp\{C0D7772F-44B5-41C0-8074-FD64CCAEEE88}\.be\python-3.12.2-amd64.exe"C:\Windows\Temp\{C0D7772F-44B5-41C0-8074-FD64CCAEEE88}\.be\python-3.12.2-amd64.exe" -q -burn.elevated BurnPipe.{F6B5A952-6F16-441D-AF92-21517C280F13} {F73BCCDC-AD4A-4634-921C-B7AD981931CA} 21244⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe" -c "import winreg; winreg.SetValueEx(winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\FileSystem'), 'LongPathsEnabled', None, winreg.REG_DWORD, 1)"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4092 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6056 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5076 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5536 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=1728 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2956 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
C:\Windows\System32\wevtutil.exe"wevtutil.exe" um "C:\Program Files\IIS\Microsoft Web Deploy V3\Microsoft.Web.Deployment.Tracing.man" /fromwow643⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6340 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=3748 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6340 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=4756 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4676 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4744 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3776 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1304 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5864 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\vs_BuildTools.exe"C:\Users\Admin\Downloads\vs_BuildTools.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\03e7dc3c8acbac3da3b11e0c\vs_bootstrapper_d15\vs_setup_bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\03e7dc3c8acbac3da3b11e0c\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\Downloads\vs_BuildTools.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\Downloads"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\getmac.exe"getmac"4⤵
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" /finalizeInstall install --in "C:\ProgramData\Microsoft\VisualStudio\Packages\_bootstrapper\vs_setup_bootstrapper_202402132259314113.json" --locale en-US --activityId "a8dec857-4069-47b2-932c-4587d7b6146f" --pipe "e292f3b3-811b-41ce-87b5-bce09eedb771"4⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe" /finalizeinstall 6F320B93-EE3C-4826-85E0-ADF79F8D4C61 "Visual Studio Installer" "Microsoft Visual Studio Installer" 3.9.2164.57262 0 "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"5⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" elevate --activityId a8dec857-4069-47b2-932c-4587d7b6146f --handle 66446 --locale en-US --pid 2212 --pipeName ae41df2d609241c3b7d929e10987cfe3 --serializedSession "{\"TelemetryLevel\":null,\"IsOptedIn\":true,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":\"f144292e-e3b2-4011-ac90-20e5c03fbce5\",\"AsimovInstrumentationKey\":\"AIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\",\"CollectorApiKey\":\"f3e86b4023cc43f0be495508d51f588a-f70d0e59-0fb0-4473-9f19-b4024cc340be-7296\",\"AppId\":1000,\"UserId\":\"42cc4847-11ec-49c1-8e09-eda3832fd68c\",\"Id\":\"e8b866ae-731f-4da2-a89d-5cc79c5f0e28\",\"ProcessStartTime\":638434619906962563,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[{\"AdditionalProperties\":[],\"Id\":\"a02930d9-c607-41c3-8698-0fd9196735a5\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.setup.*\",null,null,null,null,null,null,null]},{\"AdditionalProperties\":[],\"Id\":\"64a13603-6d89-42e4-a299-13f77e5ad306\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.willow.*\",null,null,null,null,null,null,null]}],\"BucketFiltersToAddDumpsToFaults\":[]}"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=3840 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=5388 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=936 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=4948 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=1612 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3452 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6232 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=4832 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=5348 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=4056 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=3244 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=5012 --field-trial-handle=1912,i,15165658598002385779,15202412498656188272,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C250D41E5418083A074B344A1910CFE22⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp3aqkg0nn\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp3aqkg0nn', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exepython olympia.py2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exepip install httpx2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install httpx3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exepython olympia.py2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exepip install webview2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install webview3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-hm4j1clt\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.04⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpd_a9ucq64⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-hm4j1clt\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmp7rj4iq3o4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel C:\Users\Admin\AppData\Local\Temp\tmprap0izfh4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exepython olympia.py2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exepip install webview2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install webview3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-4hx69cdk\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.04⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpk3agdfan4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-4hx69cdk\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmp7kg3b26h4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel C:\Users\Admin\AppData\Local\Temp\tmpqww2k_2r4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exepip install webview2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install webview3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-1t5k_sn3\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.04⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmp3krtwj0a4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-1t5k_sn3\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmp2stchs2y4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel C:\Users\Admin\AppData\Local\Temp\tmp9domncsn4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exepip install webview2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install webview3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-mm5tm9tc\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.04⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpwrj_80wq4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-mm5tm9tc\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpwk6z0_vs4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel C:\Users\Admin\AppData\Local\Temp\tmp_mc96scd4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe" -latest -prerelease -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath -products *5⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe" -latest -prerelease -requires Microsoft.VisualStudio.Workload.WDExpress -property installationPath -products *5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exepip install webview2⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install webview3⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-ab3_kazf\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.04⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmp8j2yy2su4⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-ab3_kazf\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel4⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpkvi1_5j44⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel C:\Users\Admin\AppData\Local\Temp\tmpp3s8s17r4⤵
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe" -latest -prerelease -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath -products *5⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /u /c "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvarsall.bat" x86_amd64 && set5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vswhere.exe -property catalog_productSemanticVersion -path "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\Common7\Tools\VsDevCmd.bat"6⤵
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exevswhere.exe -property catalog_productSemanticVersion -path "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\Common7\Tools\VsDevCmd.bat"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir32"6⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir32"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir32"6⤵
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir32"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir32"6⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir32"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir32"6⤵
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir32"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer32"6⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer32"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer32"6⤵
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer32"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer32"6⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer32"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer32"6⤵
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer32"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir64"6⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir64"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir64"6⤵
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir64"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir64"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir64"6⤵
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir64"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer64"6⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer64"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer64"6⤵
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer64"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer64"6⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer64"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer64"6⤵
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkVer64"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\Windows\v10.0" /v "InstallationFolder"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\Windows Kits\10\include\" /b /ad-h /on6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Kits\Installed Roots" /v "KitsRoot10"6⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Kits\Installed Roots" /v "KitsRoot10"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\Windows Kits\10\Lib\" /b /ad-h /on6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\Common7\Tools\vsdevcmd\ext\*.bat" /b /a-d-h /on6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\NETFXSDK\4.8\WinSDK-NetFx40Tools-x86" /v "InstallationFolder"6⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\NETFXSDK\4.8\WinSDK-NetFx40Tools-x86" /v "InstallationFolder"7⤵
-
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\NETFXSDK"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\NETFXSDK\4.8\WinSDK-NetFx40Tools-x64" /v "InstallationFolder"6⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\NETFXSDK\4.8\WinSDK-NetFx40Tools-x64" /v "InstallationFolder"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\NETFXSDK\4.8" /v "KitsInstallationFolder"6⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\NETFXSDK\4.8" /v "KitsInstallationFolder"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c type "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\Microsoft.VCToolsVersion.v143.default.txt"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c type "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\Microsoft.VCRedistVersion.default.txt"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "& {if($PSVersionTable.PSVersion.Major -ge 3){Import-Module 'C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\Common7\Tools\\Microsoft.VisualStudio.DevShell.dll'; Send-VsDevShellTelemetry -NewInstanceType Cmd; }}"6⤵
-
-
-
C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Tools\MSVC\14.39.33519\bin\HostX86\x64\cl.exe"C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Tools\MSVC\14.39.33519\bin\HostX86\x64\cl.exe" /c /nologo /O2 /W3 /GL /DNDEBUG /MD -DWEBVIEW_WINAPI=1 -IC:\Users\Admin\AppData\Local\Programs\Python\Python312\include -IC:\Users\Admin\AppData\Local\Programs\Python\Python312\Include "-IC:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Tools\MSVC\14.39.33519\include" "-IC:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\VS\include" "-IC:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt" "-IC:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um" "-IC:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared" "-IC:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt" "-IC:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt" "-IC:\Program Files (x86)\Windows Kits\NETFXSDK\4.8\include\um" /Tcwebview/webview.c /Fobuild\temp.win-amd64-cpython-312\Release\webview/webview.obj5⤵
-
C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Tools\MSVC\14.39.33519\bin\HostX86\x64\VCTIP.EXE"C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Tools\MSVC\14.39.33519\bin\HostX86\x64\VCTIP.EXE"6⤵
- Checks processor information in registry
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exepip install pywebview2⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install pywebview3⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-caohoow4\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.04⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpyonp2vlk4⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-caohoow4\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel4⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpn8ni7sdw4⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel C:\Users\Admin\AppData\Local\Temp\tmpm3eszk3k4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exepython olympia.py2⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exepip install pyperclip2⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install pyperclip3⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-1vx042bm\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.04⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmprbpwf08p4⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-1vx042bm\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel4⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmp02vmpn134⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel C:\Users\Admin\AppData\Local\Temp\tmphepeapli4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exepython olympia.py2⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exepip install plyer2⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install plyer3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exepython olympia.py2⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exepip install pymem2⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install pymem3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exepython olympia.py2⤵
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=python.exe --webview-exe-version=3.12.2 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=ElasticOverscroll --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2856.5680.68368712618226469053⤵
- Checks computer location settings
- Checks system information in the registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=119.0.6045.123 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=119.0.2151.58 --initial-client-data=0x160,0x164,0x168,0x13c,0x198,0x7ffd1c2f2030,0x7ffd1c2f2040,0x7ffd1c2f20504⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView" --webview-exe-name=python.exe --webview-exe-version=3.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1808 --field-trial-handle=1672,i,581726134616788028,2986812924413704573,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView" --webview-exe-name=python.exe --webview-exe-version=3.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=3164 --field-trial-handle=1672,i,581726134616788028,2986812924413704573,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView" --webview-exe-name=python.exe --webview-exe-version=3.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=1840 --field-trial-handle=1672,i,581726134616788028,2986812924413704573,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView" --webview-exe-name=python.exe --webview-exe-version=3.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --first-renderer-process --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3564 --field-trial-handle=1672,i,581726134616788028,2986812924413704573,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView" --webview-exe-name=python.exe --webview-exe-version=3.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4328 --field-trial-handle=1672,i,581726134616788028,2986812924413704573,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView" --webview-exe-name=python.exe --webview-exe-version=3.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4440 --field-trial-handle=1672,i,581726134616788028,2986812924413704573,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView" --webview-exe-name=python.exe --webview-exe-version=3.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4464 --field-trial-handle=1672,i,581726134616788028,2986812924413704573,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView" --webview-exe-name=python.exe --webview-exe-version=3.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4436 --field-trial-handle=1672,i,581726134616788028,2986812924413704573,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView" --webview-exe-name=python.exe --webview-exe-version=3.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4612 --field-trial-handle=1672,i,581726134616788028,2986812924413704573,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView" --webview-exe-name=python.exe --webview-exe-version=3.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=752 --field-trial-handle=1672,i,581726134616788028,2986812924413704573,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView" --webview-exe-name=python.exe --webview-exe-version=3.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4608 --field-trial-handle=1672,i,581726134616788028,2986812924413704573,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView" --webview-exe-name=python.exe --webview-exe-version=3.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4752 --field-trial-handle=1672,i,581726134616788028,2986812924413704573,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpb4estl2_\EBWebView" --webview-exe-name=python.exe --webview-exe-version=3.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4668 --field-trial-handle=1672,i,581726134616788028,2986812924413704573,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll /prefetch:84⤵
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9056B3D5348F89B590EF233EE68E29EF2⤵
-
-
C:\ProgramData\Microsoft\VisualStudio\SetupWMI\MofCompiler.exe"C:\ProgramData\Microsoft\VisualStudio\SetupWMI\MofCompiler.exe" -autorecover "C:\ProgramData\Microsoft\VisualStudio\SetupWMI\Microsoft.VisualStudio.Setup.Management.mof"2⤵
- Executes dropped EXE
-
C:\Windows\system32\wbem\mofcomp.exe"C:\Windows\system32\wbem\mofcomp" -autorecover C:\ProgramData\Microsoft\VisualStudio\SetupWMI\Microsoft.VisualStudio.Setup.Management.mof3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FE4F7F9F626CE9D31ACFC2BFB1EA8EF52⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9F295DB44348E382853B1F7785A6B9C2 E Global\MSI00002⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\aspnet_merge.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\aspnet_intern.exe" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\AxImp.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\AxImp.exe" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\lc.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\lc.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\ResGen.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\SecAnnotate.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\SecAnnotate.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\sgen.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\sgen.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\SqlMetal.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\TlbExp.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\TlbExp.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\TlbImp.exe" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\TlbImp.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\WinMDExp.exe" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\WinMDExp.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\wsdl.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\wsdl.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\xsd.exe" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\xsd.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\xsltc.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\SvcUtil.exe" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7BB5AFF6019817CBD7C3A7ABEFD68A722⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 283D79C444F84334AACA9A32EA9629092⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B89A7095DA109E69E63B7CBADA2B8A2F2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F149CB80D67A2BD60F2602423C6140002⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 063075DF6DDEE14E46CA316B9F06DC782⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3E19D8AD794498B820156EA8E18083232⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CB8AE8C9392CFB3471232387DE5BB57B2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F266B48C9B085879390D9DD346A196C32⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 51B7CF23D82166C2D332F2BBEF6F745C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B8FD2E27065DB060F66DF188DB29473A2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BA164A14263FE61FAC71A909076163472⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 734C9F97BCC400D12A359C2A122C8DAF2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4CD2535CEB429F98B088CD192D88B5892⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A11855146D8BDDFB29A5AFF9615ADB832⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E8FE6BF0DC59BF5E9BFB8A043DA302F32⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1B970818F827874AD9DE7DAF891F09352⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9925FB1D5003755F406D8D97449C27722⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C6B81CB74B31162FD35C7359419CD5C92⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0AA932531AC5DDC90225823B113FEB0E2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 51361B8A533EE7A1F35DF3077C58E8F0 E Global\MSI00002⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\\dotnet.exe" exec "C:\Program Files\dotnet\\sdk\8.0.200\dotnet.dll" internal-reportinstallsuccess ""3⤵
- Executes dropped EXE
-
C:\Windows\system32\getmac.exe"C:\Windows\system32\getmac.exe"4⤵
-
-
C:\Windows\system32\getmac.exe"C:\Windows\system32\getmac.exe"4⤵
-
-
C:\Windows\system32\getmac.exe"C:\Windows\system32\getmac.exe"4⤵
-
-
C:\Windows\system32\getmac.exe"C:\Windows\system32\getmac.exe"4⤵
-
-
C:\Windows\system32\getmac.exe"C:\Windows\system32\getmac.exe"4⤵
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B3BE35B0BDC04D402ADF625619CFE1442⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 14657D19C30278E5A96026646F44CFEF2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0A37E77177D62B59B541A2DBA1E771AA2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5090A2ADD976B301D5AD9457705921E52⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0154DB6C750BC17BD13916EE3639E8E42⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 26F655C70CAD9E10FAE04B175E0DBD2A2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 25168D46EBEFBABC449886EDEF45B63A2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9CC52417B17C9A4EF97EBA5CCB2DCBEE2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D6C53544126C13761ED563B5FAE4C0B82⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D46A95D7A6016EAE972C20A66B74D7562⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 219E1243BFD8159B6EFC10E1247C64342⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 58D3DDC76B7690D3EC19C81A16BEE48F2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7A0257A3C25AB9CBC84D18778A63A2B72⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C9FECC9C736FBB98B10A1124AD33A1882⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 4F7138AA7A1B1BB7DEE9F9E0C60EFD2C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 844B338ED6D7A2CE7D205F8F63BF2816 E Global\MSI00002⤵
-
C:\Windows\SysWOW64\wevtutil.exe"wevtutil.exe" um "C:\Program Files\IIS\Microsoft Web Deploy V3\Microsoft.Web.Deployment.Tracing.man"3⤵
-
-
C:\Windows\SysWOW64\wevtutil.exe"wevtutil.exe" im "C:\Program Files\IIS\Microsoft Web Deploy V3\Microsoft.Web.Deployment.Tracing.man"3⤵
-
C:\Windows\System32\wevtutil.exe"wevtutil.exe" im "C:\Program Files\IIS\Microsoft Web Deploy V3\Microsoft.Web.Deployment.Tracing.man" /fromwow644⤵
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4d0 0x2ec1⤵
-
C:\Users\Admin\Downloads\vs_BuildTools.exe"C:\Users\Admin\Downloads\vs_BuildTools.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f0c596fa18f9d69b7f\vs_bootstrapper_d15\vs_setup_bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\f0c596fa18f9d69b7f\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\Downloads\vs_BuildTools.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\Downloads"2⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" /finalizeInstall install --in "C:\ProgramData\Microsoft\VisualStudio\Packages\_bootstrapper\vs_setup_bootstrapper_202402132301087717.json" --locale en-US --activityId "2575acea-4c66-4007-b84f-dab9b60f321a" --pipe "f639ad9b-b388-48ef-83b5-aface42979ea"3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe" /finalizeinstall 6F320B93-EE3C-4826-85E0-ADF79F8D4C61 "Visual Studio Installer" "Microsoft Visual Studio Installer" 3.9.2164.57262 0 "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" elevate --activityId 2575acea-4c66-4007-b84f-dab9b60f321a --handle 132022 --locale en-US --pid 456 --pipeName 2abeaa14097848aaae8b19aec62135f6 --serializedSession "{\"TelemetryLevel\":null,\"IsOptedIn\":true,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":\"f144292e-e3b2-4011-ac90-20e5c03fbce5\",\"AsimovInstrumentationKey\":\"AIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\",\"CollectorApiKey\":\"f3e86b4023cc43f0be495508d51f588a-f70d0e59-0fb0-4473-9f19-b4024cc340be-7296\",\"AppId\":1000,\"UserId\":\"42cc4847-11ec-49c1-8e09-eda3832fd68c\",\"Id\":\"be1725ff-929e-46f8-9a48-40ad9bb830e6\",\"ProcessStartTime\":638434621290533022,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[{\"AdditionalProperties\":[],\"Id\":\"a02930d9-c607-41c3-8698-0fd9196735a5\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.setup.*\",null,null,null,null,null,null,null]},{\"AdditionalProperties\":[],\"Id\":\"64a13603-6d89-42e4-a299-13f77e5ad306\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.willow.*\",null,null,null,null,null,null,null]}],\"BucketFiltersToAddDumpsToFaults\":[]}"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" queue pause5⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" queue pause5⤵
-
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.Build.UnGAC,version=17.9.5.2407608,chip=neutral,language=neutral\Microsoft.Build.UnGAC.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.Build.UnGAC,version=17.9.5.2407608,chip=neutral,language=neutral\Microsoft.Build.UnGAC.exe"5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\dism.exe"C:\Windows\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\Users\Admin\AppData\Local\Temp\d9fd1afa-dff6-4c15-8e50-1ef13f908a91\Windows10.0-KB5003304-x64-NDP48.cab" /logPath:"C:\Users\Admin\AppData\Local\Temp\dd_setup_20240213230314_034_Microsoft.Net.4.8.KB5003304.log" /LogLevel:45⤵
-
C:\Users\Admin\AppData\Local\Temp\0685C015-BEE5-44C0-BC30-54F15B731E12\dismhost.exeC:\Users\Admin\AppData\Local\Temp\0685C015-BEE5-44C0-BC30-54F15B731E12\dismhost.exe {4181F8D8-C737-452A-9360-C40C079A81E1}6⤵
- Executes dropped EXE
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" update /queue5⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" update /queue5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" queue continue5⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" queue continue5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" eqi 05⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" eqi 05⤵
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe Update /Queue /Delay1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exe Update /Queue /Delay1⤵
-
C:\Users\Admin\Downloads\vs_BuildTools.exe"C:\Users\Admin\Downloads\vs_BuildTools.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1bb5ab638f5d52e107986b7b\vs_bootstrapper_d15\vs_setup_bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\1bb5ab638f5d52e107986b7b\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\Downloads\vs_BuildTools.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\Downloads"2⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" /finalizeInstall install --in "C:\ProgramData\Microsoft\VisualStudio\Packages\_bootstrapper\vs_setup_bootstrapper_202402132308017482.json" --locale en-US --activityId "87c425c1-640a-49fe-afe8-afd17cb7902c" --pipe "1f4e7533-0440-4be5-842a-b04155ecc6d1"3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe" /finalizeinstall 6F320B93-EE3C-4826-85E0-ADF79F8D4C61 "Visual Studio Installer" "Microsoft Visual Studio Installer" 3.9.2164.57262 0 "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" elevate --activityId 87c425c1-640a-49fe-afe8-afd17cb7902c --handle 197556 --locale en-US --pid 4532 --pipeName 65383535c94049af9f55628f11d2e949 --serializedSession "{\"TelemetryLevel\":null,\"IsOptedIn\":true,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":\"f144292e-e3b2-4011-ac90-20e5c03fbce5\",\"AsimovInstrumentationKey\":\"AIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\",\"CollectorApiKey\":\"f3e86b4023cc43f0be495508d51f588a-f70d0e59-0fb0-4473-9f19-b4024cc340be-7296\",\"AppId\":1000,\"UserId\":\"42cc4847-11ec-49c1-8e09-eda3832fd68c\",\"Id\":\"8c52d4c5-bdf1-4b51-8779-8db10e471524\",\"ProcessStartTime\":638434624874314940,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[{\"AdditionalProperties\":[],\"Id\":\"a02930d9-c607-41c3-8698-0fd9196735a5\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.setup.*\",null,null,null,null,null,null,null]},{\"AdditionalProperties\":[],\"Id\":\"64a13603-6d89-42e4-a299-13f77e5ad306\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.willow.*\",null,null,null,null,null,null,null]}],\"BucketFiltersToAddDumpsToFaults\":[]}"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" queue pause5⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" queue pause5⤵
-
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\\windowspowershell\v1.0\powershell.exe" -NoLogo -NoProfile -Noninteractive -ExecutionPolicy Unrestricted -InputFormat None -Command "& """C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.38.33135,chip=x86\VCRedistInstall.ps1""" -PayloadDirectory """C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.38.33135,chip=x86""" -Architecture x86 -Logfile """C:\Users\Admin\AppData\Local\Temp\dd_setup_20240213230911_018_Microsoft.VisualCpp.Redist.14.log"""; exit $LastExitCode"5⤵
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.38.33135,chip=x86\VC_redist.x86.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.38.33135,chip=x86\VC_redist.x86.exe" /q /norestart /log C:\Users\Admin\AppData\Local\Temp\dd_setup_20240213230911_018_Microsoft.VisualCpp.Redist.14.log6⤵
- Executes dropped EXE
-
C:\Windows\Temp\{1EB93A14-FB2F-4E4A-A18E-609F62061EDC}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{1EB93A14-FB2F-4E4A-A18E-609F62061EDC}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.38.33135,chip=x86\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=648 /q /norestart /log C:\Users\Admin\AppData\Local\Temp\dd_setup_20240213230911_018_Microsoft.VisualCpp.Redist.14.log7⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\Temp\{17E47523-4C08-4C26-809D-C14D3845DB20}\.be\VC_redist.x86.exe"C:\Windows\Temp\{17E47523-4C08-4C26-809D-C14D3845DB20}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{68063521-0F84-479C-9203-E9D0C4D6E2B1} {47B85139-4A41-4A02-B8A7-2998117BB2F3} 53048⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={46c3b171-c15c-4137-8e1d-67eeb2985b44} -burn.filehandle.self=1120 -burn.embedded BurnPipe.{DEAA0216-91E3-4E00-BE55-90C7C2CC3B65} {F175E108-6809-4180-B8A2-42F4C0E3DBC6} 58209⤵
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={46c3b171-c15c-4137-8e1d-67eeb2985b44} -burn.filehandle.self=1120 -burn.embedded BurnPipe.{DEAA0216-91E3-4E00-BE55-90C7C2CC3B65} {F175E108-6809-4180-B8A2-42F4C0E3DBC6} 582010⤵
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{5BE44F85-E146-4447-A653-43579D344A1B} {2DC25A73-A71E-4B46-86FE-C0F1D965A7DA} 605211⤵
-
-
-
-
-
-
-
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\\windowspowershell\v1.0\powershell.exe" -NoLogo -NoProfile -Noninteractive -ExecutionPolicy Unrestricted -InputFormat None -Command "& """C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.38.33135,chip=x64\VCRedistInstall.ps1""" -PayloadDirectory """C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.38.33135,chip=x64""" -Architecture x64 -Logfile """C:\Users\Admin\AppData\Local\Temp\dd_setup_20240213230911_019_Microsoft.VisualCpp.Redist.14.log"""; exit $LastExitCode"5⤵
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.38.33135,chip=x64\VC_redist.x64.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.38.33135,chip=x64\VC_redist.x64.exe" /q /norestart /log C:\Users\Admin\AppData\Local\Temp\dd_setup_20240213230911_019_Microsoft.VisualCpp.Redist.14.log6⤵
- Executes dropped EXE
-
C:\Windows\Temp\{E548BC4F-8E7A-418F-B8CA-31DCB92C4112}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{E548BC4F-8E7A-418F-B8CA-31DCB92C4112}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.38.33135,chip=x64\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /q /norestart /log C:\Users\Admin\AppData\Local\Temp\dd_setup_20240213230911_019_Microsoft.VisualCpp.Redist.14.log7⤵
- Checks computer location settings
-
C:\Windows\Temp\{89162C2F-8995-4219-B09A-D6E494108E44}\.be\VC_redist.x64.exe"C:\Windows\Temp\{89162C2F-8995-4219-B09A-D6E494108E44}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{294B01C6-1AB4-45BF-8903-C4C2E84334EC} {D2C5C6D1-4AD8-4B91-AFC5-AA86608B9981} 55888⤵
- Adds Run key to start application
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={c649ede4-f16a-4486-a117-dcc2f2a35165} -burn.filehandle.self=1112 -burn.embedded BurnPipe.{AEFBF8A9-CE4E-4F8B-9CA4-226EFB23538B} {37FF1CA1-7735-4F58-8299-E09787249B11} 57729⤵
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={c649ede4-f16a-4486-a117-dcc2f2a35165} -burn.filehandle.self=1112 -burn.embedded BurnPipe.{AEFBF8A9-CE4E-4F8B-9CA4-226EFB23538B} {37FF1CA1-7735-4F58-8299-E09787249B11} 577210⤵
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{36594B2A-6612-4762-A624-03DB2E9D72D2} {AAF8CAC3-BCD3-4C98-8B19-92F6FEEC3C32} 579611⤵
-
-
-
-
-
-
-
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Win11SDK_10.0.22621,version=10.0.22621.5,productarch=neutral\winsdkinstaller.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Win11SDK_10.0.22621,version=10.0.22621.5,productarch=neutral\winsdkinstaller.exe" SetupExe=winsdksetup.exe LogFile="C:\Users\Admin\AppData\Local\Temp\dd_setup_20240213230911_112_Win11SDK_10.0.22621.log" SetupLogFolder=windowssdk CeipSetting="on" ProgramFilesOrSharedDriveSdkPath="C:\Program Files (x86)\Windows Kits\10" SetupParameters="/features OptionId.AvrfExternal OptionId.UWPManaged OptionId.WindowsSoftwareLogoToolkit OptionId.SigningTools OptionId.UWPLocalized OptionId.UWPCPP OptionId.DesktopCPPx64 OptionId.DesktopCPPx86 OptionID.DesktopCPPARM OptionID.DesktopCPPARM64 OptionId.MSIInstallTools /quiet /norestart"5⤵
- Checks computer location settings
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Win11SDK_10.0.22621,version=10.0.22621.5,productarch=neutral\winsdksetup.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Win11SDK_10.0.22621,version=10.0.22621.5,productarch=neutral\winsdksetup.exe" /features OptionId.AvrfExternal OptionId.UWPManaged OptionId.WindowsSoftwareLogoToolkit OptionId.SigningTools OptionId.UWPLocalized OptionId.UWPCPP OptionId.DesktopCPPx64 OptionId.DesktopCPPx86 OptionID.DesktopCPPARM OptionID.DesktopCPPARM64 OptionId.MSIInstallTools /quiet /norestart /Ceip on /Log "C:\Users\Admin\AppData\Local\Temp\windowssdk\dd_setup_20240213230911_112_Win11SDK_10.0.22621.winsdksetup_1.log"6⤵
-
C:\Windows\Temp\{059215C7-7DC1-44FD-BBEC-39F4F19D4F6F}\.cr\winsdksetup.exe"C:\Windows\Temp\{059215C7-7DC1-44FD-BBEC-39F4F19D4F6F}\.cr\winsdksetup.exe" -burn.clean.room="C:\ProgramData\Microsoft\VisualStudio\Packages\Win11SDK_10.0.22621,version=10.0.22621.5,productarch=neutral\winsdksetup.exe" -burn.filehandle.attached=600 -burn.filehandle.self=660 /features OptionId.AvrfExternal OptionId.UWPManaged OptionId.WindowsSoftwareLogoToolkit OptionId.SigningTools OptionId.UWPLocalized OptionId.UWPCPP OptionId.DesktopCPPx64 OptionId.DesktopCPPx86 OptionID.DesktopCPPARM OptionID.DesktopCPPARM64 OptionId.MSIInstallTools /quiet /norestart /Ceip on /Log "C:\Users\Admin\AppData\Local\Temp\windowssdk\dd_setup_20240213230911_112_Win11SDK_10.0.22621.winsdksetup_1.log"7⤵
- Checks computer location settings
-
C:\Windows\Temp\{56EE9DF2-4830-4730-B803-202635CFDB0C}\.be\winsdksetup.exe"C:\Windows\Temp\{56EE9DF2-4830-4730-B803-202635CFDB0C}\.be\winsdksetup.exe" -q -burn.elevated BurnPipe.{09813BA6-AE4C-4426-8AC8-2EC6EB1454DB} {4C8FFD2B-B0F2-4756-8FBB-DCB71DBEE094} 5608⤵
- Adds Run key to start application
- Modifies registry class
-
-
-
-
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.Initializer,version=17.9.34511.75\VSInitializer.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.Initializer,version=17.9.34511.75\VSInitializer.exe" -Operation Modify -InstallationID 76f6eb61 -InstallationName VisualStudio/17.9.0+34607.119 -InstallationVersion 17.9.34607.119 -InstallationWorkloads Microsoft.VisualStudio.Workload.MSBuildTools,Microsoft.VisualStudio.Workload.VCTools,Microsoft.VisualStudio.Workload.WebBuildTools -InstallationPackages Microsoft.VisualStudio.Component.Roslyn.Compiler,Microsoft.Component.MSBuild,Microsoft.VisualStudio.Component.CoreBuildTools,Microsoft.VisualStudio.Component.Windows10SDK,Microsoft.VisualStudio.Component.VC.CoreBuildTools,Microsoft.VisualStudio.Component.VC.Tools.x86.x64,Microsoft.VisualStudio.Component.VC.Redist.14.Latest,Microsoft.VisualStudio.Component.Windows11SDK.22621,Microsoft.VisualStudio.Component.VC.CMake.Project,Microsoft.VisualStudio.Component.TestTools.BuildTools,Microsoft.Net.Component.4.8.SDK,Microsoft.Net.Component.4.7.2.TargetingPack,Microsoft.VisualStudio.Component.VC.ASAN,Microsoft.VisualStudio.Component.TextTemplating,Microsoft.VisualStudio.Component.VC.CoreIde,Microsoft.VisualStudio.ComponentGroup.NativeDesktop.Core,Microsoft.VisualStudio.Component.NuGet.BuildTools,Microsoft.VisualStudio.Web.BuildTools.ComponentGroup,Microsoft.Net.ComponentGroup.DevelopmentPrerequisites,Microsoft.VisualStudio.Component.TypeScript.TSServer,Microsoft.Net.Component.4.8.TargetingPack,Microsoft.Net.ComponentGroup.4.8.DeveloperTools,Microsoft.NetCore.Component.Runtime.8.0,Microsoft.NetCore.Component.SDK,Microsoft.VisualStudio.Component.DockerTools.BuildTools,Microsoft.Component.ClickOnce.MSBuild,Microsoft.VisualStudio.Wcf.BuildTools.ComponentGroup,Microsoft.VisualStudio.Component.WebDeploy -InstallationPath """C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools""" -ComponentId Microsoft.VisualStudio.Product.BuildTools -ChannelsPath """""" -SetupEngineFilePath """C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe""" -Log """C:\Users\Admin\AppData\Local\Temp\dd_setup_20240213230911_145_Microsoft.VisualStudio.Initializer.log"""5⤵
-
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.WebView2,version=119.0.2151.58,productarch=neutral,machinearch=x64\microsoftedgewebview2runtimeinstallerx64.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.WebView2,version=119.0.2151.58,productarch=neutral,machinearch=x64\microsoftedgewebview2runtimeinstallerx64.exe" /silent /install5⤵
-
C:\Program Files (x86)\Microsoft\Temp\EUB4C1.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUB4C1.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers"6⤵
- Sets file execution options in registry
- Checks computer location settings
- Checks system information in the registry
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc7⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver7⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"8⤵
- Registers COM server for autorun
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"8⤵
- Registers COM server for autorun
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"8⤵
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezM4RjI4MTFCLUQwMDYtNDExMC1CNDUwLUE1QjAxRjQ4QkVEOH0iIHVzZXJpZD0iezM5MjZCMDIwLTdENzctNDA4OS05REVFLTk5ODgwMzYzQzMxRn0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7RUMzNTgxOUQtNkQzNC00OUU1LThDNEUtOTM4Q0QwMjNGQjM1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cVdKU3pXd1BmZGNMUitYR0l2NnhyWmZpWU94aFBVMnMxTldtaldjYUZQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4MS41IiBuZXh0dmVyc2lvbj0iMS4zLjE4MS41IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyMzMwMjY4NzA0OCIgaW5zdGFsbF90aW1lX21zPSI2NDEiLz48L2FwcD48L3JlcXVlc3Q-7⤵
- Checks system information in the registry
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers" /installsource offline /sessionid "{38F2811B-D006-4110-B450-A5B01F48BED8}" /silent /offlinedir "{9BC29117-B2D9-4950-8832-A0333441DE6F}"7⤵
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" update /queue5⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" update /queue5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" queue continue5⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" queue continue5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" eqi 05⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" eqi 05⤵
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Sets file execution options in registry
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9D551F5FE3FB6D6BAD4827F88D1CBD5F E Global\MSI00002⤵
-
C:\Windows\SysWOW64\appverif.exe"appverif.exe" /setupstandardproviders3⤵
-
-
C:\Windows\syswow64\appverif.exe"appverif.exe" /setupstandardproviders3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 405D729B131877124BFCD2FAD5B28B37 M Global\MSI00002⤵
- Modifies registry class
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ED5B97931A3BA880BDA92ECDB8733B8C M Global\MSI00002⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezM4RjI4MTFCLUQwMDYtNDExMC1CNDUwLUE1QjAxRjQ4QkVEOH0iIHVzZXJpZD0iezM5MjZCMDIwLTdENzctNDA4OS05REVFLTk5ODgwMzYzQzMxRn0iIGluc3RhbGxzb3VyY2U9Im9mZmxpbmUiIHJlcXVlc3RpZD0iezVFQUJFNUM0LTNFQjItNDY3RC04RjlCLUQwMzk3NDAzMTJDMX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBvc19yZWdpb25fbmFtZT0iVVMiIG9zX3JlZ2lvbl9uYXRpb249IjI0NCIgb3NfcmVnaW9uX2RtYT0iMCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyMzMwOTY4MjQzNyIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Checks system information in the registry
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1B1BCC5E-E263-4B10-9149-E635D6C6A71F}\MicrosoftEdgeWebview_X64_119.0.2151.58.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1B1BCC5E-E263-4B10-9149-E635D6C6A71F}\MicrosoftEdgeWebview_X64_119.0.2151.58.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1B1BCC5E-E263-4B10-9149-E635D6C6A71F}\EDGEMITMP_8B05C.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1B1BCC5E-E263-4B10-9149-E635D6C6A71F}\EDGEMITMP_8B05C.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1B1BCC5E-E263-4B10-9149-E635D6C6A71F}\MicrosoftEdgeWebview_X64_119.0.2151.58.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezM4RjI4MTFCLUQwMDYtNDExMC1CNDUwLUE1QjAxRjQ4QkVEOH0iIHVzZXJpZD0iezM5MjZCMDIwLTdENzctNDA4OS05REVFLTk5ODgwMzYzQzMxRn0iIGluc3RhbGxzb3VyY2U9Im9mZmxpbmUiIHJlcXVlc3RpZD0ie0I3QUVDNjAxLTU3M0QtNDE5My1CQ0FGLTU2RTU0MUIwRDNBOH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBvc19yZWdpb25fbmFtZT0iVVMiIG9zX3JlZ2lvbl9uYXRpb249IjI0NCIgb3NfcmVnaW9uX2RtYT0iMCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjExOS4wLjIxNTEuNTgiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjIzMzEzOTAyMDQ2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjMzMTQyMTM4NjciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyMzMyMjk2Mzk5NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjIzMzM2NzE0MTY4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyMzYwMDYyMDgxNCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlZD0iMTc0NzU4MzUyIiB0b3RhbD0iMTc0NzU4MzUyIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMSIgaW5zdGFsbF90aW1lX21zPSIyNjM5MSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Checks system information in the registry
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4d0 0x2ec1⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir64"1⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\Windows\v10.0" /v "InstallationFolder"1⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Checks system information in the registry
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0F11B2C5-FC5A-4623-B2D2-7E725CC28CE9}\MicrosoftEdgeUpdateSetup_X86_1.3.183.29.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0F11B2C5-FC5A-4623-B2D2-7E725CC28CE9}\MicrosoftEdgeUpdateSetup_X86_1.3.183.29.exe" /update /sessionid "{F6F6468D-44A5-4DB5-B391-FCDD5529D2AF}"2⤵
-
C:\Program Files (x86)\Microsoft\Temp\EUF646.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUF646.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{F6F6468D-44A5-4DB5-B391-FCDD5529D2AF}"3⤵
- Sets file execution options in registry
- Checks system information in the registry
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Registers COM server for autorun
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Registers COM server for autorun
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODMuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODEuNSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntGNkY2NDY4RC00NEE1LTREQjUtQjM5MS1GQ0RENTUyOUQyQUZ9IiB1c2VyaWQ9InszOTI2QjAyMC03RDc3LTQwODktOURFRS05OTg4MDM2M0MzMUZ9IiBpbnN0YWxsc291cmNlPSJzZWxmdXBkYXRlIiByZXF1ZXN0aWQ9IntDMzIwMkIyNi0yNjc4LTREOUItODQxMi1BRjc5NjA3QjFFQTJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTgxLjUiIG5leHR2ZXJzaW9uPSIxLjMuMTgzLjI5IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGV0aW1lPSIxNzA3ODY2Mjc4Ij48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyNjY0NjAyNjk2NSIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Checks system information in the registry
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0Y2RjY0NjhELTQ0QTUtNERCNS1CMzkxLUZDREQ1NTI5RDJBRn0iIHVzZXJpZD0iezM5MjZCMDIwLTdENzctNDA4OS05REVFLTk5ODgwMzYzQzMxRn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NjVBMjY1QjEtQTA1My00N0U0LThENkQtREQxNjk5RUVBODM1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cVdKU3pXd1BmZGNMUitYR0l2NnhyWmZpWU94aFBVMnMxTldtaldjYUZQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4MS41IiBuZXh0dmVyc2lvbj0iMS4zLjE4My4yOSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjI2MzYwNzY1NzE2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjI2MzYwOTIxOTUwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyNjYzMDg3MDk2NiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzgxNGI4NDhiLWE0ZTQtNDhmNy05ZGMwLWIxOGI1N2Y2YzlmMz9QMT0xNzA4NDcxMzg1JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWRPSiUyYml6MFhyc0NkcnZ6b25xSDNncWl5elJBdVU1Tllnc3RaZGtlN0h2VktWaGYwYUhHdWtWaSUyZmJhbXZjWXlYOFBkWjdCOHNTWXVUTWpyOXhsVSUyYnlRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjY2MzA4NzA5NjYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzgxNGI4NDhiLWE0ZTQtNDhmNy05ZGMwLWIxOGI1N2Y2YzlmMz9QMT0xNzA4NDcxMzg1JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWRPSiUyYml6MFhyc0NkcnZ6b25xSDNncWl5elJBdVU1Tllnc3RaZGtlN0h2VktWaGYwYUhHdWtWaSUyZmJhbXZjWXlYOFBkWjdCOHNTWXVUTWpyOXhsVSUyYnlRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTYxNjQ1NiIgdG90YWw9IjE2MTY0NTYiIGRvd25sb2FkX3RpbWVfbXM9IjIyNjM3Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjI2NjMwODcwOTY2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjI2NjM2MzM5NjExIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PHBpbmcgcj0iNjAiIHJkPSI2MTkyIiBwaW5nX2ZyZXNobmVzcz0iezJEMzI5Q0ZGLUU1QjEtNEI2MC05QjdCLUVBRTYxNUUwRDJDNH0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjciIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzQ3MTE0NTgyOTM4NDI0MCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9IjYwIiByPSI2MCIgYWQ9IjYxOTIiIHJkPSI2MTkyIiBwaW5nX2ZyZXNobmVzcz0iezY1REE5MEZFLTQzMjAtNEE4NC05QTQ2LTNERjA5NTQzOUREM30iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTE5LjAuMjE1MS41OCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9InswNTBFODk0Ny01QkQ0LTQ1NzYtQTdDRS1DQ0M1NDc5NkMxNzZ9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Checks system information in the registry
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODMuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODEuNSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins1RkE3OTM5Mi1BRjA4LTQ0MzMtOTlCRC04NjU3OEIyMUQzNzF9IiB1c2VyaWQ9InszOTI2QjAyMC03RDc3LTQwODktOURFRS05OTg4MDM2M0MzMUZ9IiBpbnN0YWxsc291cmNlPSJ1bmtub3duIiByZXF1ZXN0aWQ9Ins0ODg2NDUxNS02QTlGLTQ5QzMtODc5NS0wQjg5M0RFNkQ1RER9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNjAiIGluc3RhbGxkYXRldGltZT0iMTcwMjYzOTYzOCIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzQ3MTQxMDYwNDcxNzc2OSI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUyOSIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjk4MzgxMTYyMzEiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Checks system information in the registry
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4D57FA12-92DC-4FFC-94E6-6DE6082CA3C9}\MicrosoftEdge_X64_121.0.2277.112.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4D57FA12-92DC-4FFC-94E6-6DE6082CA3C9}\MicrosoftEdge_X64_121.0.2277.112.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable2⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4D57FA12-92DC-4FFC-94E6-6DE6082CA3C9}\EDGEMITMP_A9C48.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4D57FA12-92DC-4FFC-94E6-6DE6082CA3C9}\EDGEMITMP_A9C48.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4D57FA12-92DC-4FFC-94E6-6DE6082CA3C9}\MicrosoftEdge_X64_121.0.2277.112.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable3⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4D57FA12-92DC-4FFC-94E6-6DE6082CA3C9}\EDGEMITMP_A9C48.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4D57FA12-92DC-4FFC-94E6-6DE6082CA3C9}\EDGEMITMP_A9C48.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4D57FA12-92DC-4FFC-94E6-6DE6082CA3C9}\EDGEMITMP_A9C48.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=121.0.2277.112 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6c3801d88,0x7ff6c3801d94,0x7ff6c3801da04⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4D57FA12-92DC-4FFC-94E6-6DE6082CA3C9}\EDGEMITMP_A9C48.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4D57FA12-92DC-4FFC-94E6-6DE6082CA3C9}\EDGEMITMP_A9C48.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4D57FA12-92DC-4FFC-94E6-6DE6082CA3C9}\EDGEMITMP_A9C48.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4D57FA12-92DC-4FFC-94E6-6DE6082CA3C9}\EDGEMITMP_A9C48.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4D57FA12-92DC-4FFC-94E6-6DE6082CA3C9}\EDGEMITMP_A9C48.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=121.0.2277.112 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6c3801d88,0x7ff6c3801d94,0x7ff6c3801da05⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\121.0.2277.112\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\121.0.2277.112\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\121.0.2277.112\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\121.0.2277.112\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\121.0.2277.112\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=121.0.2277.112 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff7fe2a1d88,0x7ff7fe2a1d94,0x7ff7fe2a1da05⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0FAE68BD-D4DE-46EE-A0C1-8CDCEB596065}\MicrosoftEdge_X64_121.0.2277.112.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0FAE68BD-D4DE-46EE-A0C1-8CDCEB596065}\MicrosoftEdge_X64_121.0.2277.112.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0FAE68BD-D4DE-46EE-A0C1-8CDCEB596065}\EDGEMITMP_16E45.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0FAE68BD-D4DE-46EE-A0C1-8CDCEB596065}\EDGEMITMP_16E45.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0FAE68BD-D4DE-46EE-A0C1-8CDCEB596065}\MicrosoftEdge_X64_121.0.2277.112.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0FAE68BD-D4DE-46EE-A0C1-8CDCEB596065}\EDGEMITMP_16E45.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0FAE68BD-D4DE-46EE-A0C1-8CDCEB596065}\EDGEMITMP_16E45.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0FAE68BD-D4DE-46EE-A0C1-8CDCEB596065}\EDGEMITMP_16E45.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=121.0.2277.112 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6e1f21d88,0x7ff6e1f21d94,0x7ff6e1f21da04⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.112\Installer\setup.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.112\Installer\setup.exe" --msedgewebview --delete-old-versions --system-level --verbose-logging4⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.112\Installer\setup.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.112\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.112\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=121.0.2277.112 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff7fe2a1d88,0x7ff7fe2a1d94,0x7ff7fe2a1da05⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODMuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODEuNSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins1RkE3OTM5Mi1BRjA4LTQ0MzMtOTlCRC04NjU3OEIyMUQzNzF9IiB1c2VyaWQ9InszOTI2QjAyMC03RDc3LTQwODktOURFRS05OTg4MDM2M0MzMUZ9IiBpbnN0YWxsc291cmNlPSJzY2hlZHVsZXIiIHJlcXVlc3RpZD0iezU4M0Q3MTlELUJGOUEtNEI5OS05RDhDLUZBMjFGQjUyRTY1RX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBvc19yZWdpb25fbmFtZT0iVVMiIG9zX3JlZ2lvbl9uYXRpb249IjI0NCIgb3NfcmVnaW9uX2RtYT0iMCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xODMuMjkiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBjb2hvcnQ9InJyZkAwLjc0Ij48dXBkYXRlY2hlY2svPjxwaW5nIHJkPSI2MjUyIiBwaW5nX2ZyZXNobmVzcz0iezk0OUFFMDYxLTJGOTQtNDREMC1CQUIwLUE2NzA0REUwRDE2Qn0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjciIG5leHR2ZXJzaW9uPSIxMjEuMC4yMjc3LjExMiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpc19waW5uZWRfc3lzdGVtPSJ0cnVlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNDcxMTQ1ODI5Mzg0MjQwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyOTg1NDM0NjMwMSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyOTg1NDQ0NjIxMSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMzA1ODEyMTYyNDgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8zM2U1M2Q0OS0xOGI2LTQ0MDctOGY1Ny1mZjU4OTMzMDdjM2Q_UDE9MTcwODQ3MTczNCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1sMU1ySmRUSWNXSHpBZ2JvdGJuNE4zMFFCY2Q1Mlk2aVRNNndaZFdNUTA4elpyNjNGaUFDRDZGWUYyTUZZN1M5UDNUcFdCMyUyYmprQWdSb2dxd1M4VlB3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjE1Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjMwNTgxMjI2MDk5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8zM2U1M2Q0OS0xOGI2LTQ0MDctOGY1Ny1mZjU4OTMzMDdjM2Q_UDE9MTcwODQ3MTczNCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1sMU1ySmRUSWNXSHpBZ2JvdGJuNE4zMFFCY2Q1Mlk2aVRNNndaZFdNUTA4elpyNjNGaUFDRDZGWUYyTUZZN1M5UDNUcFdCMyUyYmprQWdSb2dxd1M4VlB3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc0ODc4Nzg0IiB0b3RhbD0iMTc0ODc4Nzg0IiBkb3dubG9hZF90aW1lX21zPSI2NjQ0NiIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIzMDU4MTM1NjI1OCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIzMDU5NTI1NjM2NCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMzEwNjEyMDQ5MzkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIxMTE2IiBkb3dubG9hZF90aW1lX21zPSI3MjY2NyIgZG93bmxvYWRlZD0iMTc0ODc4Nzg0IiB0b3RhbD0iMTc0ODc4Nzg0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0NjU3NiIvPjxwaW5nIGFjdGl2ZT0iMCIgcmQ9IjYyNTIiIHBpbmdfZnJlc2huZXNzPSJ7NTFCMzNDNEUtNEFEMS00NjAxLTlGQUMtQzYxMzI2NUM1MEJCfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMTkuMC4yMTUxLjU4IiBuZXh0dmVyc2lvbj0iMTIxLjAuMjI3Ny4xMTIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjYyNTEiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM1MjM0MDI2MTY2Nzc4MzAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjI5ODU0MzY2MTQ1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjMxMDYxMzYxMTIyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjMxMDg4NTU3Mjk2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjMxMTAxODMxNjEyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIzMTQ1MDkzOTA4NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjExMjQiIGRvd25sb2FkZWQ9IjE3NDg3ODc4NCIgdG90YWw9IjE3NDg3ODc4NCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjIiIGluc3RhbGxfdGltZV9tcz0iMzQ5MTEiLz48cGluZyBhY3RpdmU9IjEiIGE9Ii0xIiBhZD0iLTEiIHJkPSI2MjUyIiBwaW5nX2ZyZXNobmVzcz0ie0RDREFENzQxLTgwOEEtNEUxMy1BRkJELTBDMDNGNTZEQ0I3Mn0iLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Checks system information in the registry
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Defense Evasion
Modify Registry
7Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
e582bf0.rbs
e582bf5.rbs
e582bfa.rbs
e582bff.rbs
e582c04.rbs
e582c09.rbs
e582c0e.rbs
e582c13.rbs
e582c18.rbs
e582c1d.rbs
e640b7d.rbs
e640b81.rbs
e640b85.rbs
e640b8a.rbs
e640b8f.rbs
e640b94.rbs
e640b99.rbs
e640b9e.rbs
e640ba3.rbs
e640ba8.rbs
e640bad.rbs
e640bb2.rbs
e640bb7.rbs
e640bbc.rbs
e640bc1.rbs
e640bc6.rbs
e640bcb.rbs
e640bd0.rbs
e640bd5.rbs
e640bda.rbs
e640bdf.rbs
e640be4.rbs
e640be9.rbs
e640bee.rbs
e640bf3.rbs
e640bf8.rbs
e640bfd.rbs
e640c02.rbs
e640c07.rbs
e640c0c.rbs
e640c11.rbs
e640c16.rbs
e640c1b.rbs
e640c20.rbs
e640c21.rbf
e640c22.rbf
e640c26.rbs
e640c2b.rbs
e640c30.rbs
e640c35.rbs
e640c3a.rbs
e640c3f.rbs
e640c44.rbs
e640c49.rbs
e640c4e.rbs
e640c53.rbs
e640c58.rbs
e640c5d.rbs
e640c62.rbs
e640c67.rbs
e640c6c.rbs
e640c71.rbs
e640c76.rbs
e640c7b.rbs
e640c80.rbs
e640c85.rbs
e640c8a.rbs
e640c8f.rbs
e640c93.rbs
e640c9a.rbs
e640c9f.rbs
e640cac.rbs
e640cbb.rbs
e640cc2.rbs
e640cce.rbs
e640cd5.rbs
e640ce4.rbs
e640ce9.rbs
e640cee.rbs
e71cf6a.rbs
e71cf6f.rbs
e71cf74.rbs
e71cf79.rbs
e71cf7e.rbs
e71cf83.rbs
e71cf88.rbs
e71cf8d.rbs
e71cf92.rbs
e71cf97.rbs
e71cf9c.rbs
e71cfa1.rbs
e71cfa6.rbs
e71cfab.rbs
e71cfb0.rbs
e71cfb5.rbs
e71cfba.rbs
e71cfbf.rbs
e71cfc4.rbs
e71cfc9.rbs
e71cfce.rbs
e71cfd3.rbs
e71cfd8.rbs
e71cfdd.rbs
e71cfe2.rbs
e71cfe7.rbs
e71cfec.rbs
e71cff1.rbs
e71cff6.rbs
e71cffb.rbs
e71d000.rbs
e71d005.rbs
e71d00d.rbs
e71d012.rbs
e71d017.rbs
e71d01c.rbs
e71d021.rbs
e71d026.rbs
e71d02b.rbs
e71d030.rbs
e71d035.rbs
e71d03a.rbs
e71d03f.rbs
e71d044.rbs
e71d049.rbs
e71d04e.rbs
e71d053.rbs
e71d058.rbs
e71d05d.rbs
e71d062.rbs
e71d067.rbs
e71d06c.rbs
e71d071.rbs
e71d076.rbs
e71d07b.rbs
e71d080.rbs
e71d085.rbs
e71d08a.rbs
e71d08f.rbs
e71d094.rbs
e71d099.rbs
e71d09e.rbs
e71d0a3.rbs
e71d0a8.rbs
e71d0ad.rbs
e71d0b2.rbs
e71d0b7.rbs
e71d0bc.rbs
e71d0c1.rbs
e71d0c6.rbs
e71d0cb.rbs
e71d0d0.rbs
e71d0d5.rbs
e71d0da.rbs
e71d0df.rbs
e71d0e4.rbs
e71d0e5.rbf
e71d0ed.rbs
e71d0f2.rbs
redist.txt
Eula.rtf
Windows.xml
PEVerify.exe.config
abi-x86-Clang.cmake
BlueGeneP-dynamic-Initialize.cmake
Windows-Determine-CXX.cmake
WindowsPhone-MSVC-C.cmake
WindowsPhone-MSVC-CXX.cmake
WindowsPhone.cmake
Xenix.cmake
visionOS-Determine-CXX.cmake
visionOS.cmake
v12_CSharp.json
v12_LIB.json
v12_Link.json
v12_MASM.json
v12_RC.json
v143_Link.json
Resources.resx
diagnosticsHub.js
msalruntime_x86.dll
msalruntime_arm64.dll
msalruntime.dll
System.Text.Encodings.Web.dll
NuGet.Frameworks.dll
System.Collections.Immutable.dll
System.Reflection.Metadata.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
datacollector.exe.config
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
msdia140.dll
msdia140.dll.manifest
msdia140.dll
msdia140.dll.manifest
Microsoft.CodeCoverage.IO.resources.dll
Microsoft.CodeCoverage.IO.resources.dll
Microsoft.CodeCoverage.IO.resources.dll
Microsoft.CodeCoverage.IO.resources.dll
Microsoft.CodeCoverage.IO.resources.dll
Microsoft.CodeCoverage.IO.resources.dll
Microsoft.CodeCoverage.IO.resources.dll
Microsoft.CodeCoverage.IO.resources.dll
Microsoft.CodeCoverage.IO.resources.dll
Microsoft.CodeCoverage.IO.resources.dll
Microsoft.CodeCoverage.IO.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.CodeCoverage.IO.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.CodeCoverage.IO.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
CertificateInformation.dat
Microsoft.Win32.Registry.dll
System.Security.Principal.Windows.dll
System.Text.Encoding.CodePages.dll
System.Threading.Tasks.Dataflow.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.Scripting.dll
Microsoft.CodeAnalysis.CSharp.dll
Microsoft.CodeAnalysis.Scripting.dll
Microsoft.CodeAnalysis.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
msobj140.dll
mspdbst.dll
tbbmalloc.dll
msobj140.dll
mspdbst.dll
congrats_tutorial.png
Welcome.Python.Run.StopDebugging.png
Welcome.Python.Run.png
Brighten.dgsl
rabbitmq.json
testhost.net47.arm64.exe.config
Prospective.WebCSharp.tt
Microsoft.VisualStudio.ExtensionEngineContract.dll
Microsoft.Deployment.DotNet.Releases.dll
Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll
Microsoft.IdentityModel.Clients.ActiveDirectory.dll
Microsoft.VisualStudio.Debugger.Metadata.dll
Microsoft.VisualStudio.ExtensionEngine.dll
Microsoft.VisualStudio.ExtensionManager.dll
Microsoft.VisualStudio.Telemetry.dll
Microsoft.VisualStudio.vil.dll
Microsoft.VisualStudio.vil.host.dll
Microsoft.VisualStudio.Debugger.Runtime.Desktop.dll
Microsoft.VisualStudio.Debugger.Runtime.NetCoreApp.dll
hostfxr.dll
hostfxr.dll
Web.vssettings
System.Net.Http.Formatting.dll
System.Threading.Channels.dll
Microsoft.DiaSymReader.PortablePdb.dll
Microsoft.Diagnostics.FastSerialization.dll
Microsoft.Diagnostics.MemoryGraph.dll
Microsoft.Diagnostics.Utilities.dll
Microsoft.VisualStudio.Debugger.Interop.10.0.dll
Microsoft.VisualStudio.Debugger.Interop.11.0.dll
Microsoft.VisualStudio.Debugger.Interop.12.0.dll
Microsoft.VisualStudio.Debugger.Interop.14.0.dll
Microsoft.VisualStudio.Debugger.Interop.15.0.dll
Microsoft.VisualStudio.Debugger.Interop.Internal.dll
Microsoft.VisualStudio.Debugger.InteropA.dll
System.Numerics.Vectors.dll
System.Runtime.CompilerServices.Unsafe.dll
iisresolver.dll
msvcdis140.dll
msvcp140.dll
msvcp140_atomic_wait.dll
symsrv.yes
vcruntime140.dll
vcruntime140_1.dll
vsdebugeng.manimpl.45.dll
Microsoft.DiaSymReader.dll
msvcp140.dll
msvsmon.html
System.Threading.Tasks.Dataflow.dll
MessagePack.Annotations.dll
MessagePack.dll
Microsoft.Bcl.AsyncInterfaces.dll
Microsoft.VisualStudio.Validation.dll
System.IO.Pipelines.dll
mspdb140.dll
mspdbcore.dll
mspdbsrv.exe
msvcdis140.dll
tbbmalloc.dll
vcruntime140.dll
MCppEE.dll
msdia140.dll
msdia140.dll
msvcp140_atomic_wait.dll
ServiceHub.IntellicodeModelService.exe.config
ServiceHub.IdentityHost.exe.config
Microsoft.IdentityModel.Clients.ActiveDirectory.dll
Microsoft.Rest.ClientRuntime.Azure.dll
Microsoft.VisualStudio.Validation.dll
System.Collections.Immutable.dll
System.Diagnostics.DiagnosticSource.dll
System.Reflection.Metadata.dll
System.Text.Json.dll
Newtonsoft.Json.dll
SQLServerLocalDB_Sql2016.rtf
Microsoft.IO.Redist.dll
System.Collections.Immutable.dll
System.Reflection.Metadata.dll
System.Threading.Tasks.Extensions.dll
Microsoft.Deployment.DotNet.Releases.resources.dll
Microsoft.Deployment.DotNet.Releases.resources.dll
Microsoft.Deployment.DotNet.Releases.resources.dll
Microsoft.Deployment.DotNet.Releases.resources.dll
Microsoft.Deployment.DotNet.Releases.resources.dll
Microsoft.Deployment.DotNet.Releases.resources.dll
Microsoft.Deployment.DotNet.Releases.resources.dll
Microsoft.Deployment.DotNet.Releases.resources.dll
Microsoft.Deployment.DotNet.Releases.resources.dll
Microsoft.Deployment.DotNet.Releases.resources.dll
Microsoft.Deployment.DotNet.Releases.resources.dll
Microsoft.Deployment.DotNet.Releases.resources.dll
Microsoft.Deployment.DotNet.Releases.resources.dll
System.Numerics.Vectors.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTrackerA4UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
System.Buffers.dll
FileTracker32.dll
FileTracker64.dll
FileTrackerA4.dll
System.Runtime.InteropServices.RuntimeInformation.dll
System.ValueTuple.dll
System.Runtime.InteropServices.RuntimeInformation.dll
Microsoft.NET.Build.Extensions.Tasks.dll.config
liblinux.resources.dll
Microsoft.Cpp.UnitTest.props
debugger_general.xml
liblinux.IO.resources.dll
liblinux.Local.resources.dll
NetCoreCheck.exe
NetCoreCheck.exe
NetCoreCheck.exe
text.js
text.js
license
LICENSE.md
LICENSE
LICENSE
types.js
license
LICENSE
LICENSE-MIT.txt
LICENSE
LICENSE
package.json
package.json
LICENSE
index.js
package.json
LICENSE.md
LICENSE
LICENSE
LICENSE
LICENSE
LICENSE
LICENSE
Microsoft.VisualStudio.Containers.HotReloadProxy.runtimeconfig.json
Microsoft.VisualStudio.Containers.HotReloadProxy.runtimeconfig.json
Microsoft.VisualStudio.Containers.HotReloadProxy.runtimeconfig.json
Microsoft.Diagnostics.Tracing.EventSource.dll
Microsoft.VisualStudio.Telemetry.dll
Microsoft.VisualStudio.Utilities.Internal.dll
System.Memory.dll
asan_ignorelist.txt
vctip.exe.config
clang_rt.asan_dynamic-i386.dll
clang_rt.asan_dynamic-i386.pdb
System.Runtime.CompilerServices.Unsafe.dll
xdcmake.exe.config
libcmt.amd64.onecore.pdb
libconcrtd.amd64.onecore.pdb
libcpmtd0.amd64.onecore.pdb
libvcruntime.amd64.onecore.pdb
libvcruntimed.amd64.onecore.pdb
libconcrtd.i386.onecore.pdb
libconcrtd0.i386.onecore.pdb
libvcruntimed.i386.onecore.pdb
exe_initialize_mta.lib
iso_stdio_wide_specifiers.lib
legacy_stdio_definitions.lib
legacy_stdio_wide_specifiers.lib
oldnames.lib
legacy_stdio_float_rounding.obj
libcmtd.i386.pdb
libcpmtd1.i386.pdb
clang_rt.asan_dynamic-i386.lib
clang_rt.asan_dynamic_runtime_thunk-i386.lib
clang_rt.asan_static_runtime_thunk-i386.lib
clang_rt.builtins-i386.lib
clang_rt.fuzzer_MD-i386.lib
clang_rt.fuzzer_MDd-i386.lib
clang_rt.fuzzer_MT-i386.lib
clang_rt.fuzzer_MTd-i386.lib
clang_rt.fuzzer_no_main_MD-i386.lib
clang_rt.fuzzer_no_main_MDd-i386.lib
clang_rt.fuzzer_no_main_MT-i386.lib
clang_rt.fuzzer_no_main_MTd-i386.lib
clang_rt.profile-i386.lib
clang_rt.stats-i386.lib
clang_rt.stats_client-i386.lib
clang_rt.ubsan_standalone-i386.lib
clang_rt.ubsan_standalone_cxx-i386.lib
libsancov.lib
stl_asan.lib
exe_initialize_mta.lib
iso_stdio_wide_specifiers.lib
legacy_stdio_definitions.lib
legacy_stdio_wide_specifiers.lib
legacy_x86_flt_exceptions.lib
oldnames.lib
legacy_stdio_float_rounding.obj
vcasan.lib
Microsoft.Build.Commontypes.xsd
Microsoft.Build.Core.xsd
DotNetConfig471.xsd
msalruntime_x86.dll
setup.exe
setup.exe
MicrosoftEdge_X64_121.0.2277.112.exe
MicrosoftEdgeUpdateSetup_X86_1.3.183.29.exe
SETUP.EX_
MicrosoftEdgeUpdate.exe
Microsoft.Activities.Build.xml
System.IO.Compression.FileSystem.xml
System.IO.Compression.xml
System.IdentityModel.Services.xml
System.Net.Http.WebRequest.xml
System.Net.Http.xml
System.Reflection.Context.xml
System.Windows.Controls.Ribbon.xml
Accessibility.xml
CustomMarshalers.xml
ISymWrapper.xml
Microsoft.Build.Conversion.v4.0.xml
Microsoft.Build.Engine.xml
Microsoft.Build.Framework.xml
Microsoft.Build.Tasks.v4.0.xml
Microsoft.Build.Utilities.v4.0.xml
Microsoft.Build.xml
Microsoft.CSharp.xml
Microsoft.JScript.xml
Microsoft.VisualBasic.Compatibility.Data.xml
Microsoft.VisualBasic.Compatibility.xml
Microsoft.VisualBasic.xml
Microsoft.VisualC.STLCLR.xml
Microsoft.VisualC.xml
PresentationBuildTasks.xml
PresentationCore.xml
PresentationFramework.Aero.xml
PresentationFramework.Classic.xml
PresentationFramework.Luna.xml
PresentationFramework.Royale.xml
PresentationFramework.xml
ReachFramework.xml
System.Activities.DurableInstancing.xml
System.Activities.xml
System.AddIn.Contract.xml
System.AddIn.xml
System.ComponentModel.Composition.xml
System.ComponentModel.DataAnnotations.xml
System.Configuration.Install.xml
System.Core.xml
System.Data.DataSetExtensions.xml
System.Data.Entity.Design.xml
System.Data.Entity.xml
System.Data.Linq.xml
System.Data.OracleClient.xml
System.Data.Services.Client.xml
System.Data.Services.Design.xml
System.Data.Services.xml
System.Data.SqlXml.xml
System.Data.xml
System.Deployment.xml
System.Design.xml
System.Device.xml
System.DirectoryServices.AccountManagement.xml
System.DirectoryServices.Protocols.xml
System.DirectoryServices.xml
System.Drawing.Design.xml
System.Drawing.xml
System.EnterpriseServices.xml
System.IO.Log.xml
System.IdentityModel.Selectors.xml
System.IdentityModel.xml
System.Management.Instrumentation.xml
System.Management.xml
System.Messaging.xml
System.Net.xml
System.Numerics.xml
System.Printing.xml
System.Runtime.Caching.xml
System.Runtime.DurableInstancing.xml
System.Runtime.Remoting.xml
System.Runtime.Serialization.Formatters.Soap.xml
System.Runtime.Serialization.xml
System.Security.xml
System.ServiceModel.Activation.xml
System.ServiceModel.Activities.xml
System.ServiceModel.Channels.xml
System.ServiceModel.Discovery.xml
System.ServiceModel.Routing.xml
System.ServiceModel.Web.xml
System.ServiceModel.xml
System.ServiceProcess.xml
System.Speech.xml
System.Transactions.xml
System.Web.ApplicationServices.xml
System.Web.DataVisualization.xml
System.Web.DynamicData.Design.xml
System.Web.DynamicData.xml
System.Web.Entity.Design.xml
System.Web.Entity.xml
System.Web.Extensions.Design.xml
System.Web.Extensions.xml
System.Web.Mobile.xml
System.Web.RegularExpressions.xml
System.Web.Services.xml
System.Web.xml
System.Windows.Forms.DataVisualization.xml
System.Windows.Forms.xml
System.Windows.Input.Manipulations.xml
System.Windows.Presentation.xml
System.Workflow.Activities.xml
System.Workflow.ComponentModel.xml
System.Workflow.Runtime.xml
System.WorkflowServices.xml
System.XML.xml
System.Xaml.xml
System.Xml.Linq.xml
System.configuration.xml
System.xml
UIAutomationClient.xml
UIAutomationClientsideProviders.xml
UIAutomationProvider.xml
UIAutomationTypes.xml
WindowsBase.xml
WindowsFormsIntegration.xml
XamlBuildTask.xml
mscorlib.xml
sysglobl.xml
system.activities.core.presentation.xml
system.activities.presentation.xml
cat05047a45609f311645eebcac2739fc4c.cat
cat0b2a4987421d95d0cb37640889aa9e9b.cat
cat13d68b8a7b6678a368e2d13ff4027521.cat
cat26ea25236f12b23db661acf268a70cfa.cat
cat2a30b5d1115d515c6ddd8cd6b5173835.cat
cat353be8f91891a6a5761b9ac157fa2ff1.cat
cat43cc1b2daf931a3f0ea4ad696c2327fb.cat
cat463ad1b0783ebda908fd6c16a4abfe93.cat
cat4ec14c5368b7642563c070cd168960a8.cat
catdcfb1aa345e349091a44e86ce1766566.cat
cate59830bab4961666e8d8c2af1e5fa771.cat
appnotify.h
WindowsApp.lib
WindowsApp.lib
WindowsApp.lib
WindowsApp.lib
Windows.AI.MachineLearning.MachineLearningContract.winmd
Windows.AI.MachineLearning.Preview.MachineLearningPreviewContract.winmd
Windows.ApplicationModel.Activation.ActivatedEventsContract.winmd
Windows.ApplicationModel.Activation.ActivationCameraSettingsContract.winmd
Windows.ApplicationModel.Activation.ContactActivatedEventsContract.winmd
Windows.ApplicationModel.Activation.WebUISearchActivatedEventsContract.winmd
Windows.ApplicationModel.Activation.WebUISearchActivatedEventsContract.xml
Windows.ApplicationModel.Background.BackgroundAlarmApplicationContract.winmd
Windows.ApplicationModel.Calls.Background.CallsBackgroundContract.winmd
Windows.ApplicationModel.Calls.CallsPhoneContract.winmd
Windows.ApplicationModel.Calls.CallsVoipContract.winmd
Windows.ApplicationModel.Calls.LockScreenCallContract.winmd
Windows.ApplicationModel.CommunicationBlocking.CommunicationBlockingContract.winmd
Windows.ApplicationModel.FullTrustAppContract.winmd
Windows.ApplicationModel.Preview.InkWorkspace.PreviewInkWorkspaceContract.winmd
Windows.ApplicationModel.Preview.Notes.PreviewNotesContract.winmd
Windows.ApplicationModel.Resources.Management.ResourceIndexerContract.winmd
Windows.ApplicationModel.Search.Core.SearchCoreContract.winmd
Windows.ApplicationModel.Search.SearchContract.winmd
Windows.ApplicationModel.SocialInfo.SocialInfoContract.winmd
Windows.ApplicationModel.StartupTaskContract.winmd
Windows.ApplicationModel.Wallet.WalletContract.winmd
Windows.Devices.Custom.CustomDeviceContract.winmd
Windows.Devices.DevicesLowLevelContract.winmd
Windows.Devices.Portable.PortableDeviceContract.winmd
Windows.Devices.Printers.Extensions.ExtensionsContract.winmd
Windows.Devices.Printers.PrintersContract.winmd
Windows.Devices.Scanners.ScannerDeviceContract.winmd
Windows.Devices.SmartCards.SmartCardBackgroundTriggerContract.winmd
Windows.Devices.SmartCards.SmartCardEmulatorContract.winmd
Windows.Devices.Sms.LegacySmsApiContract.winmd
Windows.Embedded.DeviceLockdown.DeviceLockdownContract.winmd
Windows.Foundation.FoundationContract.winmd
Windows.Foundation.UniversalApiContract.winmd
Windows.Gaming.Input.GamingInputPreviewContract.winmd
Windows.Gaming.Preview.GamesEnumerationContract.winmd
Windows.Gaming.UI.GameChatOverlayContract.winmd
Windows.Gaming.UI.GamingUIProviderContract.winmd
Windows.Gaming.XboxLive.StorageApiContract.winmd
Windows.Globalization.GlobalizationJapanesePhoneticAnalyzerContract.winmd
Windows.Graphics.Printing3D.Printing3DContract.winmd
Windows.Management.Deployment.Preview.DeploymentPreviewContract.winmd
Windows.Management.Deployment.SharedPackageContainerContract.winmd
Windows.Management.Update.WindowsUpdateContract.winmd
Windows.Management.Workplace.WorkplaceSettingsContract.winmd
Windows.Media.AppBroadcasting.AppBroadcastingContract.winmd
Windows.Media.AppRecording.AppRecordingContract.winmd
Windows.Media.Capture.AppBroadcastContract.winmd
Windows.Media.Capture.AppCaptureContract.winmd
Windows.Media.Capture.AppCaptureMetadataContract.winmd
Windows.Media.Capture.CameraCaptureUIContract.winmd
Windows.Media.Capture.GameBarContract.winmd
Windows.Media.Devices.CallControlContract.winmd
Windows.Media.MediaControlContract.winmd
Windows.Media.Playlists.PlaylistsContract.winmd
Windows.Media.Protection.ProtectionRenewalContract.winmd
Windows.Networking.Connectivity.WwanContract.winmd
Windows.Networking.NetworkOperators.LegacyNetworkOperatorsContract.winmd
Windows.Networking.NetworkOperators.NetworkOperatorsFdnContract.WinMD
Windows.Networking.Sockets.ControlChannelTriggerContract.winmd
Windows.Networking.XboxLive.XboxLiveSecureSocketsContract.winmd
Windows.Perception.Automation.Core.PerceptionAutomationCoreContract.winmd
Windows.Phone.PhoneContract.winmd
Windows.Phone.StartScreen.DualSimTileContract.WinMD
Windows.Security.EnterpriseData.EnterpriseDataContract.winmd
Windows.Security.ExchangeActiveSyncProvisioning.EasContract.winmd
Windows.Security.Isolation.Isolatedwindowsenvironmentcontract.winmd
Windows.Services.Maps.GuidanceContract.winmd
Windows.Services.Maps.LocalSearchContract.winmd
Windows.Services.Store.StoreContract.winmd
Windows.Services.TargetedContent.TargetedContentContract.winmd
Windows.Storage.Provider.CloudFilesContract.winmd
Windows.System.Profile.ProfileHardwareTokenContract.winmd
Windows.System.Profile.ProfileRetailInfoContract.winmd
Windows.System.Profile.ProfileSharedModeContract.winmd
Windows.System.Profile.SystemManufacturers.SystemManufacturersContract.winmd
Windows.System.SystemManagementContract.winmd
Windows.System.UserProfile.UserProfileContract.winmd
Windows.System.UserProfile.UserProfileLockScreenContract.winmd
Windows.UI.ApplicationSettings.ApplicationsSettingsContract.winmd
Windows.UI.Core.AnimationMetrics.AnimationMetricsContract.winmd
Windows.UI.Core.CoreWindowDialogsContract.winmd
Windows.UI.Core.Preview.Communications.PreviewCommunicationsContract.winmd
Windows.UI.Shell.SecurityAppManagerContract.winmd
Windows.UI.Shell.SecurityAppManagerContract.xml
Windows.UI.Shell.WindowTabManagerContract.winmd
Windows.UI.UIAutomation.UIAutomationContract.winmd
Windows.UI.UIAutomation.UIAutomationContract.xml
Windows.UI.ViewManagement.ViewManagementViewScalingContract.winmd
Windows.UI.WebUI.Core.WebUICommandBarContract.winmd
Windows.UI.Xaml.Core.Direct.XamlDirectContract.winmd
Windows.UI.Xaml.Hosting.HostingContract.winmd
Windows.Web.Http.Diagnostics.HttpDiagnosticsContract.winmd
ISVTier5AppSignSDK.cc
SupportedAPIs.xml
ServicingCommon.dll
Microsoft.Diagnostics.Tracing.EventSource.dll
Microsoft.Windows.Build.Signing.mssign32.dll.manifest
ServicingCommon.dll
signtool.exe.manifest
ServicingCommon.dll
LICENSE.txt
ThirdPartyNotices.txt
settings.dat
settings.dat
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
keys.json
manifest.json
manifest.json
dotnet.exe
System.CommandLine.resources.dll
System.CommandLine.resources.dll
System.CommandLine.resources.dll
System.Reflection.MetadataLoadContext.dll
System.CommandLine.resources.dll
dotnet-dev-certs.runtimeconfig.json
System.CommandLine.resources.dll
System.CommandLine.resources.dll
System.Text.Encodings.Web.dll
System.Text.Json.dll
System.CommandLine.resources.dll
System.CommandLine.resources.dll
System.CommandLine.resources.dll
System.CommandLine.resources.dll
System.CommandLine.resources.dll
System.CommandLine.resources.dll
DumpMinitool.arm64.exe.config
Microsoft.CSharp.CrossTargeting.targets
Microsoft.CSharp.CurrentVersion.targets
Microsoft.CSharp.targets
Microsoft.Common.CrossTargeting.targets
Microsoft.Common.CurrentVersion.targets
Microsoft.Common.Test.targets
Microsoft.Common.overridetasks
Microsoft.Common.targets
Microsoft.Common.tasks
Microsoft.Managed.After.targets
Microsoft.Managed.Before.targets
Microsoft.Managed.targets
Microsoft.NET.props
Microsoft.NETFramework.CurrentVersion.props
Microsoft.NETFramework.CurrentVersion.targets
Microsoft.NETFramework.props
Microsoft.NETFramework.targets
Microsoft.VisualBasic.CrossTargeting.targets
Microsoft.VisualBasic.CurrentVersion.targets
Microsoft.VisualBasic.targets
Microsoft.Win32.Primitives.dll
System.Collections.Concurrent.dll
System.Collections.NonGeneric.dll
System.Collections.dll
System.ComponentModel.TypeConverter.dll
System.ComponentModel.dll
System.Diagnostics.Contracts.dll
System.Diagnostics.FileVersionInfo.dll
System.Diagnostics.Process.dll
System.Diagnostics.TextWriterTraceListener.dll
System.Diagnostics.Tools.dll
System.Diagnostics.TraceSource.dll
System.Diagnostics.Tracing.dll
System.Drawing.Primitives.dll
System.Globalization.Extensions.dll
System.IO.Compression.ZipFile.dll
System.IO.Compression.dll
System.IO.FileSystem.Watcher.dll
System.IO.IsolatedStorage.dll
System.IO.dll
System.Linq.Parallel.dll
System.Linq.dll
System.Net.NameResolution.dll
System.Net.Sockets.dll
System.Net.WebHeaderCollection.dll
System.Net.WebSockets.Client.dll
System.Net.WebSockets.dll
System.ObjectModel.dll
System.Reflection.Primitives.dll
System.Reflection.dll
System.Resources.Writer.dll
System.Runtime.Extensions.dll
System.Runtime.InteropServices.dll
System.Runtime.Serialization.Formatters.dll
System.Runtime.Serialization.Json.dll
System.Runtime.Serialization.Xml.dll
System.Security.Claims.dll
System.Security.Cryptography.Csp.dll
System.Security.Cryptography.Encoding.dll
System.Security.Cryptography.Primitives.dll
System.Security.Cryptography.X509Certificates.dll
System.Security.Principal.dll
System.Text.Encoding.dll
System.Threading.Thread.dll
System.Threading.ThreadPool.dll
System.Threading.Timer.dll
System.Xml.ReaderWriter.dll
System.Xml.XDocument.dll
System.Xml.XPath.XDocument.dll
System.Xml.XPath.dll
System.Xml.XmlDocument.dll
System.Xml.XmlSerializer.dll
Microsoft.Bcl.AsyncInterfaces.dll
System.ValueTuple.dll
Microsoft.SourceLink.Bitbucket.Git.targets
Microsoft.SourceLink.Common.props
System.AppContext.dll
System.Collections.Specialized.dll
System.ComponentModel.EventBasedAsync.dll
System.ComponentModel.Primitives.dll
System.Console.dll
System.Data.Common.dll
System.Diagnostics.Debug.dll
System.Diagnostics.StackTrace.dll
System.Dynamic.Runtime.dll
System.Globalization.Calendars.dll
System.Globalization.dll
System.IO.FileSystem.DriveInfo.dll
System.IO.FileSystem.Primitives.dll
System.IO.FileSystem.dll
System.IO.MemoryMappedFiles.dll
System.IO.Pipes.dll
System.IO.UnmanagedMemoryStream.dll
System.Linq.Expressions.dll
System.Linq.Queryable.dll
System.Net.Http.dll
System.Net.NetworkInformation.dll
System.Net.Ping.dll
System.Net.Primitives.dll
System.Net.Requests.dll
System.Net.Security.dll
System.Reflection.Extensions.dll
System.Resources.Reader.dll
System.Resources.ResourceManager.dll
System.Runtime.CompilerServices.VisualC.dll
System.Runtime.Handles.dll
System.Runtime.Numerics.dll
System.Runtime.Serialization.Primitives.dll
System.Runtime.dll
System.Security.Cryptography.Algorithms.dll
System.Security.SecureString.dll
System.Text.Encoding.Extensions.dll
System.Text.RegularExpressions.dll
System.Threading.Overlapped.dll
System.Threading.Tasks.Parallel.dll
System.Threading.Tasks.dll
System.Threading.dll
netstandard.dll
datacollector.dll.config
System.CommandLine.resources.dll
vstest.console.dll.config
prpbg.dat.bak
MicrosoftEdgeUpdate.log
payload.vsix
payload.vsix
payload.vsix
payload.vsix
4035a83dc8e73244d15d1196d55059c3.cab
45821d1fcb842bff411f5f2f8c1d4106.cab
6b12414fdb1b4978419abcd383206c09.cab
product.svg
state.json
state.packages.json.temp
vs_setup_bootstrapper_202402132259314113.json
20240213230617_31028882d3124e128c72dbdef9a10445.trn
f_00000b
f_000012
f_00001b
f_00001c
f_00001e
f_00001f
f_000020
f_000022
f_000029
f_000054
f_000055
f_000057
f_000071
03158d9548ecbd27_0
1bcbb3f436ffce83_0
1e0365393a644acc_0
27c6c37348d5e89e_0
3287da8f299ce4d7_0
3a3c8393d90e5773_0
42bc56ecf5f0a96b_0
5de8135e44b0d2ef_0
7116d760c26aedf6_0
84ef792e97c5476a_0
ade44207b4253689_0
bce7a0cec4e30e6d_0
cb80a2927481877a_0
ce34883c4170e7bf_0
eb6f70d651835ae6_0
ec8bbacbf50c5f3c_0
ff3249ea979788e3_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Local State
Local State
Local State
Local State
Local State
Module Info Cache
Module Info Cache
Module Info Cache~RFe5c1814.TMP
persisted_first_party_sets.json
20240213230002_d45ac59019a6446c966f12f7ffb77763.trn
20240213230005_9a76c9536b0e4a24a7dff54e03e401e6.trn
20240213230024_7fcb7a940b5a428bb6498ddbf4794c27.trn
20240213230054_bf7d1fa3542945e8aac558108c8a8a6b.trn
20240213230058_f6eafb388ab143da8bb419dc1cd11e69.trn
20240213230140_dbedf31d87b748748b2cb4274c99e19b.trn
20240213230210_7d0938c26ad348babfbd8fc9458c0ac2.trn
20240213230225_efb6d620f92a4fc1997a1f96363d5fc5.trn
20240213230243_8ce843a262eb4caea8fdd601b5482552.trn
20240213230313_96b8c464193c475a960adf9b0748c0b9.trn
20240213230343_fd75d48eb8f94b3ca0ae97e30f41a1fe.trn
20240213230644_506efcd1ba2d43b18b4c9037f7f95055.trn
20240213230655_9de9a837dd4a4c4da77a49856f6c9faa.trn
20240213230814_2153a85d5f9040c7843480bd75cef89f.trn
20240213230840_e45531318bf2481cabc32270a0fc41ea.trn
20240213230910_9395655e436747bfa111575cb150addd.trn
20240213231910_132ea069e8df4729aa4978b248013ab3.trn
.updateUri
channels.json
channelManifest.json
state.json
state.json
channelManifest.json
doc_JustForMe
lib_JustForMe
tcltk_JustForMe
exe.msi
core.msi
test.msi
doc.msi
lib.msi
dev.msi
__init__.py
__init__.py
aliases.py
cp1252.py
utf_8.py
__init__.py
enum.py
__init__.py
_abc.py
keyword.py
locale.py
operator.py
__init__.py
reprlib.py
WHEEL
__init__.py
_asyncio.py
_trio.py
_eventloop.py
_exceptions.py
_fileio.py
_resources.py
_signals.py
_sockets.py
_streams.py
_subprocesses.py
_synchronization.py
_tasks.py
_testing.py
_typedattr.py
__init__.py
_eventloop.py
_resources.py
_sockets.py
_streams.py
_subprocesses.py
_tasks.py
_testing.py
from_thread.py
lowlevel.py
pytest_plugin.py
buffered.py
file.py
memory.py
stapled.py
text.py
tls.py
to_process.py
to_thread.py
METADATA
bottle.py
__init__.py
__main__.py
cacert.pem
core.py
__init__.py
_imp_emulation.py
_shimmed_dist_utils.py
api.py
backend_ctypes.py
cffi_opcode.py
commontypes.py
cparser.py
error.py
ffiplatform.py
lock.py
model.py
pkgconfig.py
recompiler.py
setuptools_ext.py
vengine_cpy.py
vengine_gen.py
verifier.py
clr.py
__init__.py
__init__.py
hostfxr.py
mono.py
netfx.py
hostfxr.py
mono.py
netfx.py
types.py
__init__.py
clr_error.py
coreclr_errors.py
find.py
hostfxr_errors.py
runtime_spec.py
METADATA
__init__.py
_abnf.py
_connection.py
_events.py
_headers.py
_readers.py
_receivebuffer.py
_state.py
_util.py
_version.py
_writers.py
helpers.py
test_against_stdlib_http.py
test_connection.py
test_events.py
test_headers.py
test_helpers.py
test_io.py
test_receivebuffer.py
test_state.py
test_util.py
__init__.py
_api.py
__init__.py
connection.py
connection_pool.py
http11.py
http2.py
http_proxy.py
interfaces.py
socks_proxy.py
anyio.py
auto.py
base.py
mock.py
sync.py
trio.py
_exceptions.py
_models.py
_ssl.py
__init__.py
connection.py
connection_pool.py
http11.py
http2.py
http_proxy.py
interfaces.py
socks_proxy.py
_synchronization.py
_trace.py
_utils.py
__init__.py
__version__.py
_api.py
_auth.py
_client.py
_compat.py
_config.py
_content.py
_decoders.py
_exceptions.py
_main.py
_models.py
_multipart.py
_status_codes.py
asgi.py
base.py
default.py
mock.py
wsgi.py
_types.py
_urlparse.py
_urls.py
_utils.py
codec.py
idnadata.py
package_data.py
uts46data.py
INSTALLER
__init__.py
__main__.py
__pip-runner__.py
__init__.py
build_env.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
metadata_legacy.py
wheel.py
wheel_editable.py
wheel_legacy.py
check.py
freeze.py
__init__.py
editable_legacy.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
encoding.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
models.py
packaging.py
setuptools_build.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
core.py
__init__.py
big5freq.py
big5prober.py
chardistribution.py
charsetgroupprober.py
charsetprober.py
chardetect.py
codingstatemachine.py
codingstatemachinedict.py
cp949prober.py
enums.py
escprober.py
escsm.py
eucjpprober.py
euckrfreq.py
euckrprober.py
euctwfreq.py
euctwprober.py
gb2312freq.py
gb2312prober.py
hebrewprober.py
jisfreq.py
johabfreq.py
johabprober.py
jpcntx.py
langbulgarianmodel.py
langgreekmodel.py
langhebrewmodel.py
langhungarianmodel.py
langrussianmodel.py
langthaimodel.py
langturkishmodel.py
latin1prober.py
macromanprober.py
mbcharsetprober.py
mbcsgroupprober.py
mbcssm.py
languages.py
resultdict.py
sbcharsetprober.py
sbcsgroupprober.py
sjisprober.py
universaldetector.py
utf1632prober.py
utf8prober.py
version.py
__init__.py
ansi.py
ansitowin32.py
initialise.py
__init__.py
ansi_test.py
ansitowin32_test.py
initialise_test.py
isatty_test.py
utils.py
winterm_test.py
win32.py
winterm.py
__init__.py
compat.py
database.py
index.py
locators.py
manifest.py
markers.py
metadata.py
resources.py
scripts.py
util.py
version.py
wheel.py
__init__.py
__main__.py
distro.py
__init__.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
__about__.py
__init__.py
_manylinux.py
_musllinux.py
_structures.py
markers.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
cmdline.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
bbcode.py
groff.py
html.py
img.py
irc.py
latex.py
other.py
pangomarkup.py
rtf.py
svg.py
terminal.py
terminal256.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
token.py
unistring.py
util.py
__init__.py
actions.py
common.py
core.py
__init__.py
exceptions.py
helpers.py
results.py
testing.py
unicode.py
util.py
__init__.py
_compat.py
_impl.py
__init__.py
_in_process.py
__init__.py
__version__.py
_internal_utils.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
collections_abc.py
providers.py
reporters.py
resolvers.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
six.py
__init__.py
_asyncio.py
_utils.py
after.py
before.py
before_sleep.py
nap.py
retry.py
stop.py
tornadoweb.py
wait.py
__init__.py
_parser.py
_re.py
_types.py
__init__.py
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
typing_extensions.py
__init__.py
_collections.py
_version.py
connection.py
connectionpool.py
_appengine_environ.py
bindings.py
low_level.py
appengine.py
ntlmpool.py
pyopenssl.py
securetransport.py
socks.py
exceptions.py
fields.py
filepost.py
makefile.py
weakref_finalize.py
six.py
poolmanager.py
request.py
response.py
__init__.py
connection.py
proxy.py
queue.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
wait.py
__init__.py
labels.py
mklabels.py
tests.py
x_user_defined.py
METADATA
__init__.py
__init__.py
accelerometer.py
audio.py
barometer.py
battery.py
bluetooth.py
brightness.py
call.py
camera.py
compass.py
cpu.py
devicename.py
email.py
filechooser.py
flash.py
gps.py
gravity.py
gyroscope.py
humidity.py
irblaster.py
keystore.py
light.py
notification.py
orientation.py
processors.py
proximity.py
screenshot.py
sms.py
spatialorientation.py
storagepath.py
stt.py
temperature.py
tts.py
uniqueid.py
vibrator.py
wifi.py
__init__.py
accelerometer.py
audio.py
barometer.py
battery.py
bluetooth.py
brightness.py
call.py
camera.py
compass.py
devicename.py
email.py
filechooser.py
flash.py
gps.py
gravity.py
gyroscope.py
humidity.py
irblaster.py
keystore.py
light.py
notification.py
orientation.py
proximity.py
sms.py
spatialorientation.py
storagepath.py
stt.py
temperature.py
tts.py
uniqueid.py
vibrator.py
accelerometer.py
barometer.py
battery.py
brightness.py
call.py
camera.py
compass.py
email.py
filechooser.py
flash.py
gps.py
gravity.py
gyroscope.py
keystore.py
sms.py
spatialorientation.py
storagepath.py
tts.py
uniqueid.py
vibrator.py
accelerometer.py
battery.py
brightness.py
cpu.py
devicename.py
email.py
filechooser.py
keystore.py
notification.py
orientation.py
processors.py
screenshot.py
storagepath.py
tts.py
uniqueid.py
wifi.py
accelerometer.py
audio.py
battery.py
bluetooth.py
cpu.py
devicename.py
email.py
filechooser.py
keystore.py
osx_motion_sensor.py
osx_paths.py
notification.py
screenshot.py
storagepath.py
tts.py
uniqueid.py
wifi.py
audio.py
battery.py
cpu.py
devicename.py
email.py
filechooser.py
keystore.py
balloontip.py
batterystatus.py
wifi_defs.py
win_api_defs.py
notification.py
screenshot.py
storagepath.py
tts.py
uniqueid.py
wifi.py
utils.py
METADATA
METADATA
__init__.py
_ast_gen.py
_build_tables.py
ast_transforms.py
c_ast.py
c_generator.py
c_lexer.py
c_parser.py
lextab.py
__init__.py
cpp.py
ctokens.py
lex.py
yacc.py
ygen.py
plyparser.py
yacctab.py
__init__.py
exception.py
memory.py
pattern.py
process.py
ptypes.py
__init__.py
advapi32.py
kernel32.py
ntdll.py
psapi.py
structure.py
thread.py
__init__.py
METADATA
__init__.py
_impl.py
test_sniffio.py
_version.py
typing_extensions.py
__init__.py
_version.py
event.py
guilib.py
http.py
__init__.py
alert.py
api.py
css.py
dom.py
event.py
mouse.py
npo.py
localization.py
menu.py
cef.py
cocoa.py
edgechromium.py
gtk.py
mshtml.py
qt.py
winforms.py
screen.py
util.py
window.py
subprocess.py
__init__.py
__main__.py
types.py
warnings.py
bottle.py
pip3.12.exe
python.exe
python312.dll
vcruntime140.dll
Microsoft.IdentityModel.Abstractions.dll
msalruntime_arm64.dll
msalruntime.dll
vs_setup_bootstrapper.exe
Microsoft.C2RSignatureReader.Interop.dll
Microsoft.C2RSignatureReader.Native.dll
detection.json
vs_setup_bootstrapper.config
vs_setup_bootstrapper.exe.config
DEL3E49.tmp
Python 3.12.2 (64-bit)_20240213224723_000_core_JustForMe.log
Python 3.12.2 (64-bit)_20240213224723_001_exe_JustForMe.log
Python 3.12.2 (64-bit)_20240213224723_002_dev_JustForMe.log
Python 3.12.2 (64-bit)_20240213224723_003_lib_JustForMe.log
Python 3.12.2 (64-bit)_20240213224723_004_test_JustForMe.log
Python 3.12.2 (64-bit)_20240213224723_005_doc_JustForMe.log
Python 3.12.2 (64-bit)_20240213224723_006_tcltk_JustForMe.log
Python 3.12.2 (64-bit)_20240213224723_007_launcher_AllUsers.log
Python 3.12.2 (64-bit)_20240213224723_008_pip_JustForMe.log
__PSScriptPolicyTest_pv4yg44m.exc.ps1
0nydcixr.json
dd_setup_20240213230314_034_Microsoft.Net.4.8.KB5003304.log
dd_setup_20240213230911_072_Microsoft.VisualCpp.Premium.Tools.HostX64.TargetX64.log
help.html
help.html
help.html
help.html
help.html
help.html
help.html
help.html
help.html
help.html
help.html
help.html
help.html
help.html
Microsoft.Identity.Client.Broker.dll
Microsoft.Identity.Client.Extensions.Msal.dll
Microsoft.Identity.Client.NativeInterop.dll
Microsoft.Identity.Client.dll
Microsoft.VisualStudio.RemoteControl.dll
Microsoft.VisualStudio.Setup.Common.dll
Microsoft.VisualStudio.Setup.Download.dll
Microsoft.VisualStudio.Setup.dll
Microsoft.VisualStudio.Telemetry.dll
Microsoft.VisualStudio.Utilities.Internal.dll
System.Memory.dll
System.Runtime.CompilerServices.Unsafe.dll
VSInstallerElevationService.Contracts.dll
vs_setup_bootstrapper.resources.dll
vs_setup_bootstrapper.resources.dll
vs_setup_bootstrapper.resources.dll
vs_setup_bootstrapper.resources.dll
vs_setup_bootstrapper.resources.dll
vs_setup_bootstrapper.resources.dll
vs_setup_bootstrapper.resources.dll
vs_setup_bootstrapper.resources.dll
vs_setup_bootstrapper.resources.dll
vs_setup_bootstrapper.resources.dll
vs_setup_bootstrapper.resources.dll
vs_setup_bootstrapper.resources.dll
vs_setup_bootstrapper.resources.dll
cab1.cab
ExpressionEvaluatorPackage.vsix
Roslyn.VisualStudio.Setup.vsix
Microsoft.Developer.IdentityServiceGS.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.ServiceHub.Managed.vsix
Microsoft.ServiceHub.Node.vsix
Microsoft.VC.14.38.17.8.CRT.Redist.X64.base.vsix
Microsoft.VC.14.38.17.8.CRT.Redist.X86.base.vsix
Microsoft.VC.14.38.17.8.CRT.Redist.x64.OneCore.Desktop.base.vsix
Microsoft.VC.14.38.17.8.CRT.Redist.x86.OneCore.Desktop.base.vsix
Microsoft.VC.14.39.17.9.ASAN.Headers.base.vsix
Microsoft.VC.14.39.17.9.ASAN.X64.base.vsix
Microsoft.VC.14.39.17.9.ASAN.X86.base.vsix
Microsoft.VC.14.39.17.9.CA.Ext.Hostx64.Targetx64.Res.base.enu.vsix
Microsoft.VC.14.39.17.9.CA.Ext.Hostx64.Targetx64.base.vsix
Microsoft.VC.14.39.17.9.CA.Ext.Hostx64.Targetx86.Res.base.enu.vsix
Microsoft.VC.14.39.17.9.CA.Ext.Hostx64.Targetx86.base.vsix
Microsoft.VC.14.39.17.9.CA.Ext.Hostx86.Targetx64.Res.base.enu.vsix
Microsoft.VC.14.39.17.9.CA.Ext.Hostx86.Targetx64.base.vsix
Microsoft.VC.14.39.17.9.CA.Ext.Hostx86.Targetx86.Res.base.enu.vsix
Microsoft.VC.14.39.17.9.CA.Ext.Hostx86.Targetx86.base.vsix
Microsoft.VC.14.39.17.9.CA.Rulesets.base.vsix
Microsoft.VC.14.39.17.9.CRT.Headers.base.vsix
Microsoft.VC.14.39.17.9.CRT.Source.base.vsix
Microsoft.VC.14.39.17.9.CRT.x64.Desktop.base.vsix
Microsoft.VC.14.39.17.9.CRT.x64.OneCore.Desktop.base.vsix
Microsoft.VC.14.39.17.9.CRT.x64.Store.base.vsix
Microsoft.VC.14.39.17.9.CRT.x86.Desktop.base.vsix
Microsoft.VC.14.39.17.9.CRT.x86.OneCore.Desktop.base.vsix
Microsoft.VC.14.39.17.9.CRT.x86.Store.base.vsix
Microsoft.VC.14.39.17.9.PGO.Headers.base.vsix
Microsoft.VC.14.39.17.9.PGO.X64.base.vsix
Microsoft.VC.14.39.17.9.PGO.X86.base.vsix
Microsoft.VC.14.39.17.9.Prem.HostX64.TargetX64.Res.base.enu.vsix
Microsoft.VC.14.39.17.9.Prem.HostX64.TargetX86.Res.base.enu.vsix
Microsoft.VC.14.39.17.9.Prem.HostX86.TargetX86.Res.base.enu.vsix
Microsoft.VC.14.39.17.9.Prem.Hostx86.Targetx64.Res.base.enu.vsix
Microsoft.VC.14.39.17.9.Premium.Tools.HostX64.TargetX64.base.vsix
Microsoft.VC.14.39.17.9.Premium.Tools.HostX64.TargetX86.base.vsix
Microsoft.VC.14.39.17.9.Premium.Tools.HostX86.TargetX64.base.vsix
Microsoft.VC.14.39.17.9.Premium.Tools.HostX86.TargetX86.base.vsix
Microsoft.VC.14.39.17.9.Props.vsix
Microsoft.VC.14.39.17.9.Props.x64.vsix
Microsoft.VC.14.39.17.9.Props.x86.vsix
Microsoft.VC.14.39.17.9.Servicing.CAExtensions.vsix
Microsoft.VC.14.39.17.9.Servicing.CARulesets.vsix
Microsoft.VC.14.39.17.9.Servicing.Compilers.vsix
Microsoft.VC.14.39.17.9.Servicing.CrtHeaders.vsix
Microsoft.VC.14.39.17.9.Servicing.vsix
Microsoft.VC.14.39.17.9.Tools.Core.Props.vsix
Microsoft.VC.14.39.17.9.Tools.HostX64.TargetX64.Res.base.enu.vsix
Microsoft.VC.14.39.17.9.Tools.HostX64.TargetX64.base.vsix
Microsoft.VC.14.39.17.9.Tools.HostX64.TargetX86.Res.base.enu.vsix
Microsoft.VC.14.39.17.9.Tools.HostX64.TargetX86.base.vsix
Microsoft.VC.14.39.17.9.Tools.HostX86.TargetX64.base.vsix
Microsoft.VC.14.39.17.9.Tools.HostX86.TargetX86.Res.base.enu.vsix
Microsoft.VC.14.39.17.9.Tools.HostX86.TargetX86.base.vsix
Microsoft.VC.14.39.17.9.Tools.Hostx86.Targetx64.Res.base.enu.vsix
payload.vsix
payload.vsix
Microsoft.VisualCpp.ASAN.X86.vsix
Microsoft.VisualCpp.CA.Ext.Hostx64.Targetx64.vsix
Microsoft.VisualCpp.CA.Ext.Hostx64.Targetx86.vsix
Microsoft.VisualCpp.CA.Ext.Hostx86.Targetx64.vsix
Microsoft.VisualCpp.CA.Ext.Hostx86.Targetx86.vsix
Microsoft.VisualCpp.CRT.Headers.vsix
Microsoft.VisualCpp.CRT.Redist.Resources.enu.vsix
Microsoft.VisualCpp.CRT.Redist.X64.vsix
Microsoft.VisualCpp.CRT.Redist.X86.vsix
Microsoft.VisualCpp.CRT.Redist.x64.OneCore.Desktop.vsix
Microsoft.VisualCpp.CRT.Redist.x86.OneCore.Desktop.vsix
Microsoft.VisualCpp.CRT.Source.vsix
Microsoft.VisualCpp.CRT.x64.Desktop.vsix
Microsoft.VisualCpp.CRT.x64.OneCore.Desktop.vsix
Microsoft.VisualCpp.CRT.x64.Store.vsix
Microsoft.VisualCpp.CRT.x86.Desktop.vsix
Microsoft.VisualCpp.CRT.x86.OneCore.Desktop.vsix
Microsoft.VisualCpp.CRT.x86.Store.vsix
payload.vsix
Microsoft.VisualCpp.DIA.SDK.vsix
Microsoft.VisualCpp.PGO.Headers.vsix
Microsoft.VisualCpp.PGO.X64.vsix
Microsoft.VisualCpp.PGO.X86.vsix
Microsoft.VisualCpp.Premium.Tools.HostX64.TargetX64.vsix
Microsoft.VisualCpp.Premium.Tools.HostX64.TargetX86.vsix
Microsoft.VisualCpp.Premium.Tools.HostX86.TargetX64.vsix
Microsoft.VisualCpp.Premium.Tools.HostX86.TargetX86.vsix
VCRedistInstall.ps1
VC_redist.x86.exe
VC_redist.x64.exe
cab1.cab
cab1.cab
Microsoft.VisualCpp.Servicing.DIASDK.vsix
Microsoft.VisualCpp.Servicing.Redist.vsix
Microsoft.VisualCpp.Tools.Common.Utils.vsix
Microsoft.VisualCpp.Tools.Common.Utils.Resources.enu.vsix
Microsoft.VisualCpp.Tools.Core.Resources.enu.vsix
Microsoft.VisualCpp.Tools.Core.x86.vsix
Microsoft.VisualCpp.Tools.HostX64.TargetX64.vsix
Microsoft.VisualCpp.Tools.HostX64.TargetX86.vsix
Microsoft.VisualCpp.Tools.HostX86.TargetX64.vsix
Microsoft.VisualCpp.Tools.HostX86.TargetX86.vsix
Microsoft.VisualCpp.Tools.HostX86.TargetX86.Res.enu.vsix
Microsoft.VisualCpp.Tools.Hostx86.Targetx64.Res.enu.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
cab1.cab
cab1.cab
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
cab1.cab
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.Connected.Auto.vsix
Microsoft.VisualStudio.Connected.Auto.vsix
payload.vsix
Microsoft.VisualStudio.CoreDotNet.vsix
payload.vsix
Microsoft.VisualStudio.Debugger.BrokeredServices.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.Debugger.VSCodeDebuggerHost.vsix
payload.vsix
payload.vsix
VisualStudioEditorsSetup.vsix
Microsoft.VisualStudio.Extensibility.Container.vsix
Microsoft.VisualStudio.ExtensionManager.Auto.vsix
Microsoft.VisualStudio.ExtensionManager.vsix
cab1.cab
cab1.cab
Microsoft.VisualStudio.Finalizer.vsix
cab1.cab
payload.vsix
payload.vsix
Microsoft.VisualStudio.Identity.vsix
payload.vsix
VSInitializer.exe
Microsoft.VisualStudio.LanguageServer.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.MefHosting.vsix
payload.vsix
Microsoft.VisualStudio.MinShell.Auto.vsix
Microsoft.VisualStudio.MinShell.Auto.vsix
payload.vsix
cab1.cab
cab1.cab
cab1.cab
cab1.cab
payload.vsix
cab1.cab
Microsoft.VisualStudio.MinShell.x86.vsix
Microsoft.VisualStudio.OpenFolder.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.Platform.CallHierarchy.vsix
Microsoft.VisualStudio.Platform.Editor.vsix
Microsoft.VisualStudio.Platform.Markdown.vsix
Microsoft.VisualStudio.Platform.NavigateTo.vsix
Microsoft.VisualStudio.ProjectSystem.Vsix
Microsoft.VisualStudio.ProjectSystem.Full.vsix
Microsoft.VisualStudio.ProjectSystem.Query.Vsix
Microsoft.VisualStudio.ScriptedHost.vsix
Microsoft.VisualStudio.ScriptedHost.x64.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.TestWindow.Setup.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.TextMateGrammars.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.UIInternal.vsix
Microsoft.VisualStudio.UIInternal.Guide.vsix
Microsoft.VisualStudio.UIInternal.vsix
Microsoft.VisualStudio.VC.CMake.x86.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.VC.Ide.LanguageService.Dependencies.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
cab1.cab
Microsoft.VisualStudio.Web.Azure.Common.vsix
payload.vsix
Microsoft.WebTools.DotNet.Core.ItemTemplates.vsix
Microsoft.WebTools.Shared.vsix
MicrosoftEdgeWebView2RuntimeInstallerX64.exe
9126f6ff98d955951fe9323f4444c119.cab
948a611cd2aca64b1e5113ffb7b95d5f.cab
fef2cfedd6135e0ed85290b83f3682c3.cab
Roslyn.VisualStudio.Setup.ServiceHub.Desktop.Config.vsix
payload.vsix
SQLitePCLRaw.x86.vsix
03fbc2dfe9d3e7bb2389c7ed18c6ad3e.cab
05047a45609f311645eebcac2739fc4c.cab
05254f60ea43b4e3959b17cdb03268c0.cab
07a57cdb41ba28cced14005f087267be.cab
08e9468089f54c8455f59fd9bb48fcec.cab
0b2a4987421d95d0cb37640889aa9e9b.cab
12613ba26e037e99a874a64c1084f880.cab
126c039acc6f1c0a9426a128efb713e7.cab
12a529d45b148a2d28290a8a7535b37b.cab
13bf5f9b75a9d1c9f44ba5d34a14227f.cab
13d68b8a7b6678a368e2d13ff4027521.cab
15bc5316e373960d82abc253bceaa25d.cab
1623efce9d1a46396798f44a7bc769e9.cab
16ab2ea2187acffa6435e334796c8c89.cab
19248fabbb2098a7b88c4a2786066bcc.cab
1a296530f0182ff1e94f088c27d05da0.cab
1de82860db02f762c5f65a73daa31f3e.cab
1f32e9acf0bb1e6a5f485cd8670cd8e1.cab
20e79882c0bf37840a94a4ce06bc571e.cab
220daf459e79c5d26366654b1b482e87.cab
262fa3187c00a1f695e0c3eeb7ecf423.cab
2630bae9681db6a9f6722366f47d055c.cab
263104e5ce3a72f68151a93d88a3f22f.cab
26ea25236f12b23db661acf268a70cfa.cab
2868a02217691d527e42fe0520627bfa.cab
2a30b5d1115d515c6ddd8cd6b5173835.cab
2cd67f5657d2cee1a106c4fdab506e58.cab
2dd914bb5abd9365f932d15eede09c52.cab
2e876dd22fa5e6785f137e3422dd50ec.cab
306e26e920fd32cb02bf538b4e799a0d.cab
31ec2a68a04d58dc4a3d639fddc68493.cab
353be8f91891a6a5761b9ac157fa2ff1.cab
3988e4dfdc3f1d180c47a61a0ca76215.cab
3cf96a08c3b29e9dcf5946d28affb747.cab
3e2f7be479e3679d700ce0782e4cc318.cab
40d92f424eff54b03db4c51669f9a8d6.cab
43cc1b2daf931a3f0ea4ad696c2327fb.cab
43d52fdb99b86048e15fbd34f5b99cb5.cab
441901505fcd0b2e997ea7d954f04171.cab
44472e2321abba45e828de25827264a3.cab
463ad1b0783ebda908fd6c16a4abfe93.cab
47133212c2f5ccf49392d7762293a075.cab
4a4c678668584fc994ead5b99ccf7f03.cab
4ad4df991deb0eaa1f79f896b959d580.cab
4c3ef4b2b1dc72149f979f4243d2accf.cab
4c59234340aaf3a96ec480c1aad8d179.cab
4dc69cc131b3f4fdde53e76d759509dc.cab
4e2dea081242e821596b58b31bc22cca.cab
4ec14c5368b7642563c070cd168960a8.cab
4fe4c8b88812f5339018c0eef95acdb9.cab
50ce7925226cb6ab8e0fe9ad9fd58433.cab
52a8e5203ade8fe7174c590308f2e44a.cab
53174a8154da07099db041b9caffeaee.cab
5509e4710313421be8d5e7cfbfde4d30.cab
559dbc3a49a69c6adf60b1c87b4df71b.cab
563138901adf40a699df4654138ac397.cab
56a114848fda9a7e47bad4b3fc4be9a6.cab
576cff9c50e8085ab8d9c28ee12bac3e.cab
58314d0646d7e1a25e97c902166c3155.cab
590d28783ff280b8b0016c3492433241.cab
598442d9f84639d200d4f3af477da95c.cab
5a22e5cde814b041749fb271547f4dd5.cab
5c2fcb46e03eada0ed0cad44a3f5c71f.cab
5c9ecffb06ed5f4fe5fb7db86bf7328b.cab
5cf1d61a223a02ff2f52fe05f058d52e.cab
5f6cfec263cd265cf3b0d97fd78ddf05.cab
61d57a7a82309cd161a854a6f4619e52.cab
66c7c64126fbf84f47ccec556d149b12.cab
67c9fd1fab36154e6e7e429610cd67c8.cab
67fb2af3d2219b403e419535a547c019.cab
685f3d4691f444bc382762d603a99afc.cab
68a5a2b14625f935761325cddfadca11.cab
68de71e3e2fb9941ee5b7c77500c0508.cab
69661e20556b3ca9456b946c2c881ddd.cab
6b5a91701fdb98ac8bc4af6e238e0390.cab
6e86d5003787b5a44d77f0142b20f2ff.cab
6ee7bbee8435130a869cf971694fd9e2.cab
703316c9de0a32acf316d03b1cffc559.cab
73b80f421d7f3df5a71bd772f56bf3ae.cab
75122a9de1700f465c29b6cc76fa6372.cab
766c0ffd568bbb31bf7fb6793383e24a.cab
77db8ab55a0b236db83c55ced6e8a9a3.cab
78fa3c824c2c48bd4a49ab5969adaaf7.cab
7afc7b670accd8e3cc94cfffd516f5cb.cab
7b7c7382fe1ea268787e911da88eb37e.cab
7c3667a45d36470bf3cb648878a6ac2e.cab
8016f7584c8fbeff0b032c65f4173e78.cab
8038f3cc95dc4b7d0346cb2ab7e044ff.cab
80dcdb79b8a5960a384abe5a217a7e3a.cab
8125ee239710f33ea485965f76fae646.cab
818d2d3634f0efb6e64d7e7c8ca5f98b.cab
838060235bcd28bf40ef7532c50ee032.cab
89d9bbd87f7a5560bafa520a4ebfdf17.cab
8c44e508e7582f9362c66a2e47a19b5e.cab
8ce0662e0e014576121e526f53d8f6b5.cab
8da73ae89e24f0b5cdf1787799c2a65f.cab
8daf1f236e631041cdaa802ddb9ccc3d.cab
8e4755178e6b5bcba8d3538c3630b7a5.cab
8eec88833ea319aaa1061d6528c77b93.cab
8fe3c1ca244ece932599eb0b61855d8f.cab
90e1202895672ce81992e71be30528cc.cab
9126f6ff98d955951fe9323f4444c119.cab
921968b1c32e680f338247ac68950f5a.cab
931721e121ef91707ddcb6cac354d95c.cab
93a74a1d34a22ae9d2e1ccc5208ad21a.cab
94521fd1a9c57258998d60ce60dc43c3.cab
948a611cd2aca64b1e5113ffb7b95d5f.cab
9494c0c1f781298600a3c07e837acd0f.cab
96076045170fe5db6d5dcf14b6f6688e.cab
9a7145bc3b132e5da6d44c0ab4a1af70.cab
9ba47e440ec2fbe9a3d32a53bf0f68dc.cab
9bcb3fab78e80d68be28892ea7ad46c3.cab
9bfca1e044c38e04afe2363d3db899c8.cab
a17683486ace64c3f9a1cacb81ee0260.cab
a1e2a83aa8a71c48c742eeaff6e71928.cab
a330840cf08ad4d210703c9acd1bf2b8.cab
a35cd6c9233b6ba3da66eecaa9190436.cab
a68c0988d16ee124783efd98074dcbf9.cab
a76e4219ecb0f1c0006a6fe080c54ad9.cab
aa9c58552bdb82dae4ed48ece081cfe3.cab
ac4ddfcf1101c483559a5f6e36f1ef2d.cab
b1a824e2952532fe8fd0145f5d148d25.cab
b1a8ecf890b4ffddd05e8c9422f55db7.cab
b2f03f34ff83ec013b9e45c7cd8e8a73.cab
b4eea6c909a31ab051e6f9b6218beec8.cab
b5f177b84c0ec473cbd69557634b27cd.cab
b80b7321357f7c9f281536f9440dfe68.cab
b82881a61b7477bd4eb5de2cd5037fe2.cab
b913ca15956d14df2d4b1f11ae07885b.cab
ba60f891debd633ae9c26e1372703e3c.cab
be06eca425b0c3c2f4de61cbfe9bc7a7.cab
beb5360d2daaa3167dea7ad16c28f996.cab
c0aa6d435b0851bf34365aadabd0c20f.cab
c1be9e93e88be3f6207f5cc074775d81.cab
c1c7e442409c0adbf81ae43aa0e4351f.cab
c2aabf6ea5c1d348ec22f3aeb92f8656.cab
c4d38a2c963178a1a3469ca3d913768e.cab
cd9128b760c06a010e1621af6528432e.cab
cdea5502a35d09ddfbcda12e3a391dc0.cab
d117bb4bc77abadc7c603552e122e513.cab
d3e405ab232f8aca8c5b6a48a913d6b0.cab
d67259e233ce975d91c3b02d483becad.cab
dcfb1aa345e349091a44e86ce1766566.cab
de111c3d435b0785b31b28c386ee691f.cab
e072b3b3d3164e26b63338dce51862a7.cab
e10768bb6e9d0ea730280336b697da66.cab
e10f8811d44b50885777f56f8272f66b.cab
e24dd258b3bbfa69c0842948fe0dd670.cab
e3bfdbe21d5f48f62e6347294e6e8492.cab
e3d1b35aecfccda1b4af6fe5988ac4be.cab
e5950ce9ba509b3370ebf328742a5f45.cab
e59830bab4961666e8d8c2af1e5fa771.cab
e5c4b31ff9997ac5603f4f28cd7df602.cab
e87de81a902e0c8cde9e1355c3ff5f3f.cab
e98fa5eb5fee6ce17a7a69d585870b7c.cab
ec0637c03f99046936d32d51e13a392a.cab
ec9ab4bbb809719605d27da343b909e8.cab
ec9d39539c27e8cf5ad39bffce00c34e.cab
eca0aa33de85194cd50ed6e0aae0156f.cab
ed4d1c6b9811d81e3cebc553ae604f0d.cab
ed5aa2f399092df3084cce671f072cac.cab
ef4472fd7552490fd759075186ed2ec8.cab
f105a73f98cfc88c7b64d8f7b39a474c.cab
f4661eda3692e166927c14c96164150a.cab
f7b25543b47329ef932ad391c72c4ab7.cab
f87007e985bc5453a0f01ed1a5510abe.cab
f9b24c8280986c0683fbceca5326d806.cab
f9ff50431335056fb4fbac05b8268204.cab
fe38b2fd0d440e3c6740b626f51a22fc.cab
fef2cfedd6135e0ed85290b83f3682c3.cab
ff8dd5a961e46b5d05906ac4b7a5ba37.cab
WinSdkInstaller.exe
winsdksetup.exe
aspnetcore-runtime-8.0.2-servicing.24068.4-win-x86.msi
Microsoft.Build.vsix
payload.vsix
cab1.cab
Microsoft.Build.UnGAC.exe
cab1.cab
cab1.cab
cab1.cab
Microsoft.CodeAnalysis.Compilers.x86.vsix
Microsoft.CredentialProvider.vsix
cab1.cab
cab1.cab
Windows10.0-KB5003304-x64-NDP48.msu
sdk_tools48.cab
cab1.cab
cab1.cab
cab1.cab
payload.vsix
payload.vsix
cab1.cab
dotnet-runtime-8.0.2-win-x86.msi
payload.vsix
dotnet-sdk-internal-8.0.200-win-x64.msi
Microsoft.NuGet.Build.Tasks.Setup.vsix
Microsoft.PythonTools.BuildCore.Vsix.vsix
cab1.cab
cab1.cab
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.NuGet.BuildTools.vsix
Microsoft.VisualStudio.Docker.BuildTools.Vsix.vsix
Microsoft.VisualStudio.Package.NodeJs.vsix
Microsoft.VisualStudio.Package.TypeScript.TSServer.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
WebDeploy_amd64_en-US.msi
Microsoft.VisualStudio.WebToolsExtensions.MSBuild.vsix
payload.vsix
windowsdesktop-runtime-8.0.2-win-x64.msi
pb17tf6e
LICENSE.txt
RECORD
entry_points.txt
vendor.txt
distutils-precedence.pth
more.pyi
recipes.pyi
LICENSE
RECORD
entry_points.txt
top_level.txt
more.pyi
recipes.pyi
cli-64.exe
cli-arm64.exe
launcher manifest.xml
gui-64.exe
gui-arm64.exe
script (dev).tmpl
script.tmpl
WHEEL
__init__.pyi
RECORDf46x10q6.tmp
py.typed
cli-32.exe
gui-32.exe
__init__.py
__main__.py
_setuptools_logging.py
bdist_wheel.py
__init__.py
convert.py
pack.py
tags.py
unpack.py
macosx_libfile.py
metadata.py
util.py
_manylinux.py
_musllinux.py
requirements.py
tags.py
utils.py
version.py
wheelfile.py
__init__.py
override.py
__init__.py
__init__.py
_adapters.py
_common.py
_compat.py
_itertools.py
_legacy.py
abc.py
readers.py
simple.py
context.py
functools.py
__init__.py
__init__.py
more.py
recipes.py
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_tokenizer.py
markers.py
metadata.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
typing_extensions.py
zipp.py
__init__.py
__init__.py
_core_metadata.py
__init__.py
_collections.py
_functools.py
_log.py
_macos_compat.py
_modified.py
_msvccompiler.py
archive_util.py
bcppcompiler.py
ccompiler.py
cmd.py
__init__.py
_framework_compat.py
bdist.py
bdist_dumb.py
bdist_rpm.py
build.py
build_clib.py
build_ext.py
build_py.py
build_scripts.py
check.py
clean.py
config.py
install.py
install_data.py
install_egg_info.py
install_headers.py
install_lib.py
install_scripts.py
py37compat.py
register.py
sdist.py
upload.py
config.py
core.py
cygwinccompiler.py
debug.py
dep_util.py
dir_util.py
dist.py
errors.py
extension.py
fancy_getopt.py
file_util.py
filelist.py
log.py
msvc9compiler.py
msvccompiler.py
py38compat.py
py39compat.py
spawn.py
sysconfig.py
text_file.py
unixccompiler.py
util.py
version.py
versionpredicate.py
_entry_points.py
_imp.py
_importlib.py
_itertools.py
_normalization.py
_path.py
_reqs.py
__init__.py
_adapters.py
_collections.py
_compat.py
_functools.py
_itertools.py
_meta.py
_py39compat.py
_text.py
functools.py
__init__.py
__init__.py
more.py
recipes.py
ordered_set.py
typing_extensions.py
archive_util.py
build_meta.py
__init__.py
_requirestxt.py
alias.py
bdist_egg.py
bdist_rpm.py
build.py
build_clib.py
build_ext.py
build_py.py
develop.py
dist_info.py
easy_install.py
editable_wheel.py
egg_info.py
install.py
install_egg_info.py
install_lib.py
install_scripts.py
register.py
rotate.py
saveopts.py
sdist.py
setopt.py
test.py
upload.py
upload_docs.py
py310.py
py311.py
__init__.py
_apply_pyprojecttoml.py
__init__.py
error_reporting.py
extra_validations.py
fastjsonschema_exceptions.py
fastjsonschema_validations.py
formats.py
expand.py
pyprojecttoml.py
setupcfg.py
dep_util.py
depends.py
discovery.py
dist.py
errors.py
extension.py
__init__.py
glob.py
installer.py
launch.py
logging.py
modified.py
monkey.py
msvc.py
namespaces.py
package_index.py
sandbox.py
unicode_utils.py
version.py
warnings.py
wheel.py
windows_support.py
83bf20910daa52d25acbc86528cf514acdfe75e997920078fd639fd7
SOURCES.txt
__init__.py
PKG-INFO
top_level.txt
PKG-INFO
webview.c
webview.h
setup.py
PKG-INFO
SOURCES.txt
__init__.py
__main__.py
PKG-INFO
top_level.txt
SOURCES.txt
dependency_links.txt
top_level.txt
not-zip-safe
METADATA
AUTHORS.txt
LICENSE.txt
sniffio-1.3.0-py3-none-any.whl
pymem-1.13.1-py3-none-any.whl
httpcore-1.0.2-py3-none-any.whl.metadata
bottle-0.12.25-py3-none-any.whl
anyio-4.2.0-py3-none-any.whl.metadata
pymem-1.13.1-py3-none-any.whl.metadata
proxy_tools-0.1.0.tar.gz
httpx-0.26.0-py3-none-any.whl.metadata
idna-3.6-py3-none-any.whl.metadata
pythonnet-3.0.3-py3-none-any.whl.metadata
pyperclip-1.8.2.tar.gz
wheel-0.42.0-py3-none-any.whl.metadata
pywebview-4.4.1-py3-none-any.whl.metadata
wheel-0.42.0-py3-none-any.whl
h11-0.14.0-py3-none-any.whl
cffi-1.16.0-cp312-cp312-win_amd64.whl.metadata
pycparser-2.21-py2.py3-none-any.whl
clr_loader-0.2.6-py3-none-any.whl.metadata
certifi-2024.2.2-py3-none-any.whl.metadata
plyer-2.1.0-py2.py3-none-any.whl
typing_extensions-4.9.0-py3-none-any.whl.metadata
webview-0.1.5.tar.gz
cffi-1.16.0-cp312-cp312-win_amd64.whl
clr_loader-0.2.6-py3-none-any.whl
pythonnet-3.0.3-py3-none-any.whl
pywebview-4.4.1-py3-none-any.whl
typing_extensions-4.9.0-py3-none-any.whl
anyio-4.2.0-py3-none-any.whl
certifi-2024.2.2-py3-none-any.whl
httpcore-1.0.2-py3-none-any.whl
httpx-0.26.0-py3-none-any.whl
idna-3.6-py3-none-any.whl
setuptools-69.1.0-py3-none-any.whl.metadata
setuptools-69.1.0-py3-none-any.whl
c5b4zik0.json
s5fhp5bb.json
input.json
output.json
protocols.json
crl-set
settings.dat
settings.dat
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe7adf2a.TMP
SCT Auditing Pending Reports
Preferences
a9256fc3-aa59-4522-9e96-8ca570295507.tmp
Local State
Local State
Local State
Local State
Local State~RFe79b929.TMP
crs.pb
Filtering Rules
LICENSE
output.json
omzl5d5x.json
user.json
Malwarelympia.zip
Unconfirmed 335655.crdownload
Unconfirmed 729301.crdownload
python-3.12.2-amd64.exe
python-3.12.2-amd64.exe
MSI2EDC.tmp
MSI6758.tmp
MSIA7CD.tmp
ngen.log
ngen.log
Microsoft.Web.Deployment.resources.dll
appverif.exe
logo.png
VC_redist.x86.exe
wixstdba.dll
BootstrapperCore.config
Microsoft.Bootstrapper.dll
Microsoft.Diagnostics.Tracing.EventSource.dll
license.rtf
thm.wxl
thm.xml
VC_redist.x64.exe
python-3.12.2-amd64.exe
PythonBA.dll
SideBar.png
launcher_AllUsers
pip_JustForMe
Microsoft.Web.Deployment.Tracing.dll
Microsoft.Web.Delegation.dll
Microsoft.Web.Deployment.dll
stdole.dll
Microsoft.Web.Deployment.Powershell.dll
Microsoft.Web.Deployment.dll
memory/388-19868-0x0000000006290000-0x00000000062B6000-memory.dmp
memory/388-19859-0x0000000005900000-0x0000000005A62000-memory.dmp
memory/388-19870-0x0000000006650000-0x0000000006660000-memory.dmp
memory/388-19874-0x0000000006830000-0x0000000006852000-memory.dmp
memory/388-19875-0x0000000006980000-0x0000000006CD4000-memory.dmp
memory/388-19876-0x00000000076E0000-0x0000000007746000-memory.dmp
memory/388-20431-0x000000000B230000-0x000000000B330000-memory.dmp
memory/388-19877-0x0000000007B70000-0x0000000007C02000-memory.dmp
memory/388-20406-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/388-19867-0x0000000006270000-0x0000000006282000-memory.dmp
memory/388-20405-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/388-20000-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/388-20408-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/388-19928-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/388-19927-0x000000000C8F0000-0x000000000C912000-memory.dmp
memory/388-19926-0x000000000AED0000-0x000000000AEDA000-memory.dmp
memory/388-19924-0x00000000732E0000-0x0000000073A90000-memory.dmp
memory/388-19913-0x000000000CA30000-0x000000000CA80000-memory.dmp
memory/388-19892-0x000000000C130000-0x000000000C138000-memory.dmp
memory/388-20410-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/388-20417-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/388-19889-0x000000000B230000-0x000000000B330000-memory.dmp
memory/388-19858-0x0000000000F10000-0x0000000000F78000-memory.dmp
memory/388-19890-0x000000000AFB0000-0x000000000AFE8000-memory.dmp
memory/388-19891-0x000000000AF90000-0x000000000AF9E000-memory.dmp
memory/388-19869-0x0000000005ED0000-0x0000000005ED8000-memory.dmp
memory/388-19860-0x00000000732E0000-0x0000000073A90000-memory.dmp
memory/388-19888-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/388-19887-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/388-19886-0x0000000008120000-0x0000000008128000-memory.dmp
memory/388-19883-0x00000000080C0000-0x00000000080C8000-memory.dmp
memory/388-19884-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/388-19861-0x0000000005D50000-0x0000000005DE4000-memory.dmp
memory/388-19862-0x0000000005EF0000-0x0000000005FEC000-memory.dmp
memory/388-19863-0x00000000058D0000-0x00000000058D8000-memory.dmp
memory/388-19885-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/388-19882-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/388-19881-0x0000000007FA0000-0x000000000805A000-memory.dmp
memory/388-19878-0x00000000081C0000-0x0000000008764000-memory.dmp
memory/388-19864-0x0000000005D00000-0x0000000005D50000-memory.dmp
memory/388-19865-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/388-19866-0x0000000006330000-0x00000000063E2000-memory.dmp
memory/1248-12265-0x00000000648C0000-0x0000000064968000-memory.dmp
memory/1500-14779-0x00000000648C0000-0x0000000064968000-memory.dmp
memory/1560-105429-0x00000000648C0000-0x0000000064968000-memory.dmp
memory/1620-107171-0x00007FFD55B00000-0x00007FFD55B01000-memory.dmp
memory/2128-107239-0x0000020E4BDC0000-0x0000020E4BDEB000-memory.dmp
memory/2128-107169-0x00007FFD56350000-0x00007FFD56351000-memory.dmp
memory/2128-107170-0x0000020E4BDF0000-0x0000020E4BDF1000-memory.dmp
memory/2212-20413-0x000002707FCD0000-0x000002707FD0C000-memory.dmp
memory/2212-20427-0x000002707F580000-0x000002707F588000-memory.dmp
memory/2212-20414-0x000002707F5A0000-0x000002707F5CA000-memory.dmp
memory/2212-20433-0x0000027080200000-0x000002708028A000-memory.dmp
memory/2212-20432-0x000002707F5D0000-0x000002707F5E0000-memory.dmp
memory/2212-20407-0x000002707D570000-0x000002707D85E000-memory.dmp
memory/2212-20430-0x000002707FE10000-0x000002707FE1E000-memory.dmp
memory/2212-20429-0x000002707FD60000-0x000002707FD68000-memory.dmp
memory/2212-20428-0x000002707F590000-0x000002707F5A0000-memory.dmp
memory/2212-20411-0x000002707FD70000-0x000002707FE04000-memory.dmp
memory/2212-20412-0x0000027080080000-0x0000027080132000-memory.dmp
memory/2212-20424-0x000002707F570000-0x000002707F57A000-memory.dmp
memory/2212-20409-0x000002707FE50000-0x000002707FFB2000-memory.dmp
memory/2212-20425-0x000002707FD40000-0x000002707FD52000-memory.dmp
memory/2212-20416-0x00007FFD36140000-0x00007FFD36C01000-memory.dmp
memory/2212-20415-0x000002707FD10000-0x000002707FD32000-memory.dmp
memory/2212-20418-0x000002707F5D0000-0x000002707F5E0000-memory.dmp
memory/2212-20426-0x000002707FFC0000-0x000002707FFE6000-memory.dmp
memory/2212-20420-0x0000027080140000-0x00000270801F6000-memory.dmp
memory/2212-20422-0x000002707F5E0000-0x000002707F5FA000-memory.dmp
memory/2212-20421-0x000002707F550000-0x000002707F55C000-memory.dmp
memory/2212-20423-0x0000027080300000-0x00000270803FC000-memory.dmp
memory/2856-107219-0x00000000648C0000-0x0000000064968000-memory.dmp
memory/3200-10721-0x00000000648C0000-0x0000000064968000-memory.dmp
memory/4816-108314-0x0000013F89370000-0x0000013F8939B000-memory.dmp
memory/4816-108302-0x0000013F893A0000-0x0000013F893A1000-memory.dmp
memory/4820-107688-0x0000023724460000-0x0000023724461000-memory.dmp
memory/4820-107706-0x00000237215D0000-0x00000237215FB000-memory.dmp
memory/4984-51236-0x0000020BABF40000-0x0000020BABF50000-memory.dmp
memory/4984-51252-0x0000020BAC040000-0x0000020BAC050000-memory.dmp
memory/4984-51268-0x0000020BB4350000-0x0000020BB4351000-memory.dmp
memory/4984-51270-0x0000020BB4380000-0x0000020BB4381000-memory.dmp
memory/4984-51271-0x0000020BB4380000-0x0000020BB4381000-memory.dmp
memory/4984-51272-0x0000020BB4490000-0x0000020BB4491000-memory.dmp
memory/5396-102789-0x00000000648C0000-0x0000000064968000-memory.dmp
memory/5556-107161-0x00007FFD55B00000-0x00007FFD55B01000-memory.dmp
memory/5936-106878-0x00000000648C0000-0x0000000064968000-memory.dmp