f72df71506054a23f2237e03bb4c9c63d9b9bdf15b7f65c465c92ec362123a7f

Resubmissions

28/02/2024, 21:08

240228-zy86ysdh6y7

28/02/2024, 20:31

28/02/2024, 20:23

24/02/2024, 18:14

24/02/2024, 18:13

24/02/2024, 18:11

Analysis

max time kernel
151s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
24/02/2024, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1337 tool.exe
Size 24.9MB
Sample240224-wvg2hsae53
SHA256 f72df71506054a23f2237e03bb4c9c63d9b9bdf15b7f65c465c92ec362123a7f
MD5 2a2135c6965642ef8735581b1af29ad0
SHA1 63b7af5ecdb2d4c9ed192c9d04528bdc5232dd72
SHA512 dd4adff5e3ebfc5c5d1c63d109efd702a50d3f9154383d9768192247427ca0d0e7a861d984172c44114b221d0fc202ab3367572d37071c6401d4e24bb5d8432b
SSDEEP 393216:hCfACNlMYcjzYvbokdqGeX4d6ui6Xw+LYv4nPWGBSpptGrji2VQ6hrXy2j++8WGI:gfazOoumL6NYv4nRQyVQgrX3Q5ovG
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
800	1337 tool.exe
3068	python-3.12.2-amd64.exe
1044	python-3.12.2-amd64.exe

Loads dropped DLL 5 IoCs

pid	Process
800	1337 tool.exe
800	1337 tool.exe
800	1337 tool.exe
800	1337 tool.exe
1044	python-3.12.2-amd64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{b6178a40-1665-4565-b73e-48dd6e039a65} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6178a40-1665-4565-b73e-48dd6e039a65}\\python-3.12.2-amd64.exe\" /burn.runonce"	python-3.12.2-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\WF.msc	mmc.exe

Drops file in Windows directory 45 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF6A92A80CD79F39CC.TMP	msiexec.exe
File created	C:\Windows\Installer\e5966b4.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF41976106D05E96C8.TMP	msiexec.exe
File created	C:\Windows\Installer\e5966bd.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF219241E2D684ABF7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF9303B698631CCAD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB4557ABBEA9E90C3.TMP	msiexec.exe
File created	C:\Windows\Installer\e5966c2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5966b4.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA1E907C4143D7509.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFACE89A2F5A60BD1D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3E344173245F54D1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB08D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A49.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5B542DF335AC5527.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1047F6244C18007B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E03.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6ED480CCD9BCC356.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5966af.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E90.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5966b9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAAC196F74E03F84C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF95D4CB787D00C2E9.TMP	msiexec.exe
File created	C:\Windows\Installer\e5966b8.msi	msiexec.exe
File created	C:\Windows\Installer\e5966b9.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}	msiexec.exe
File created	C:\Windows\Installer\e5966c3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5966c3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF786A5EDF22405E8E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF96A6A1114FF13E43.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF48E6AAA9618AC8B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6EE8F34D3F7A05D6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC6D8062D84A062F7.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}	msiexec.exe
File created	C:\Windows\Installer\e5966be.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5966be.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{94087C99-E4F5-4637-A789-3B6059DF787B}	msiexec.exe
File created	C:\Windows\Installer\e5966af.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4534F2ED-1616-434D-98A6-0DA358DCD466}	msiexec.exe
File created	C:\Windows\Installer\e5966b3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI74BB.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}\DisplayName = "Python 3.12.2 Executables (64-bit)"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\DisplayName = "Python 3.12.2 Development Libraries (64-bit)"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{94087C99-E4F5-4637-A789-3B6059DF787B}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\CPython-3.12	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{94087C99-E4F5-4637-A789-3B6059DF787B}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{94087C99-E4F5-4637-A789-3B6059DF787B}\ = "{94087C99-E4F5-4637-A789-3B6059DF787B}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}\Dependents	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\ = "{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\Dependents	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\DisplayName = "Python 3.12.2 Standard Library (64-bit)"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{94087C99-E4F5-4637-A789-3B6059DF787B}\DisplayName = "Python 3.12.2 Test Suite (64-bit)"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{b6178a40-1665-4565-b73e-48dd6e039a65}"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\Dependents	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.2 (64-bit)"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\ = "{4534F2ED-1616-434D-98A6-0DA358DCD466}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-647252928-2816094679-1307623958-1000\{06FDA735-D683-461F-901C-323068FE5532}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\DisplayName = "Python 3.12.2 Core Interpreter (64-bit)"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}\ = "{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\ = "{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}	python-3.12.2-amd64.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 45970.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\python-3.12.2-amd64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
4188	msedge.exe
4188	msedge.exe
4504	identity_helper.exe
4504	identity_helper.exe
964	msedge.exe
964	msedge.exe
4676	msedge.exe
4676	msedge.exe
1320	msedge.exe
1320	msedge.exe
3432	msiexec.exe
3432	msiexec.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
3432	msiexec.exe
3432	msiexec.exe
3432	msiexec.exe
3432	msiexec.exe
3432	msiexec.exe
3432	msiexec.exe
3432	msiexec.exe
3432	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4644	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	2740	mmc.exe
Token: SeIncBasePriorityPrivilege	2740	mmc.exe
Token: 33	2740	mmc.exe
Token: SeIncBasePriorityPrivilege	2740	mmc.exe
Token: 33	2740	mmc.exe
Token: SeIncBasePriorityPrivilege	2740	mmc.exe
Token: 33	2740	mmc.exe
Token: SeIncBasePriorityPrivilege	2740	mmc.exe
Token: 33	2740	mmc.exe
Token: SeIncBasePriorityPrivilege	2740	mmc.exe
Token: 33	2740	mmc.exe
Token: SeIncBasePriorityPrivilege	2740	mmc.exe
Token: 33	2740	mmc.exe
Token: SeIncBasePriorityPrivilege	2740	mmc.exe
Token: 33	2740	mmc.exe
Token: SeIncBasePriorityPrivilege	2740	mmc.exe
Token: 33	2740	mmc.exe
Token: SeIncBasePriorityPrivilege	2740	mmc.exe
Token: 33	2740	mmc.exe
Token: SeIncBasePriorityPrivilege	2740	mmc.exe
Token: 33	2740	mmc.exe
Token: SeIncBasePriorityPrivilege	2740	mmc.exe
Token: SeShutdownPrivilege	1044	python-3.12.2-amd64.exe
Token: SeIncreaseQuotaPrivilege	1044	python-3.12.2-amd64.exe
Token: SeSecurityPrivilege	3432	msiexec.exe
Token: SeCreateTokenPrivilege	1044	python-3.12.2-amd64.exe
Token: SeAssignPrimaryTokenPrivilege	1044	python-3.12.2-amd64.exe
Token: SeLockMemoryPrivilege	1044	python-3.12.2-amd64.exe
Token: SeIncreaseQuotaPrivilege	1044	python-3.12.2-amd64.exe
Token: SeMachineAccountPrivilege	1044	python-3.12.2-amd64.exe
Token: SeTcbPrivilege	1044	python-3.12.2-amd64.exe
Token: SeSecurityPrivilege	1044	python-3.12.2-amd64.exe
Token: SeTakeOwnershipPrivilege	1044	python-3.12.2-amd64.exe
Token: SeLoadDriverPrivilege	1044	python-3.12.2-amd64.exe
Token: SeSystemProfilePrivilege	1044	python-3.12.2-amd64.exe
Token: SeSystemtimePrivilege	1044	python-3.12.2-amd64.exe
Token: SeProfSingleProcessPrivilege	1044	python-3.12.2-amd64.exe
Token: SeIncBasePriorityPrivilege	1044	python-3.12.2-amd64.exe
Token: SeCreatePagefilePrivilege	1044	python-3.12.2-amd64.exe
Token: SeCreatePermanentPrivilege	1044	python-3.12.2-amd64.exe
Token: SeBackupPrivilege	1044	python-3.12.2-amd64.exe
Token: SeRestorePrivilege	1044	python-3.12.2-amd64.exe
Token: SeShutdownPrivilege	1044	python-3.12.2-amd64.exe
Token: SeDebugPrivilege	1044	python-3.12.2-amd64.exe
Token: SeAuditPrivilege	1044	python-3.12.2-amd64.exe
Token: SeSystemEnvironmentPrivilege	1044	python-3.12.2-amd64.exe
Token: SeChangeNotifyPrivilege	1044	python-3.12.2-amd64.exe
Token: SeRemoteShutdownPrivilege	1044	python-3.12.2-amd64.exe
Token: SeUndockPrivilege	1044	python-3.12.2-amd64.exe
Token: SeSyncAgentPrivilege	1044	python-3.12.2-amd64.exe
Token: SeEnableDelegationPrivilege	1044	python-3.12.2-amd64.exe
Token: SeManageVolumePrivilege	1044	python-3.12.2-amd64.exe
Token: SeImpersonatePrivilege	1044	python-3.12.2-amd64.exe
Token: SeCreateGlobalPrivilege	1044	python-3.12.2-amd64.exe
Token: SeRestorePrivilege	3432	msiexec.exe
Token: SeTakeOwnershipPrivilege	3432	msiexec.exe
Token: SeRestorePrivilege	3432	msiexec.exe
Token: SeTakeOwnershipPrivilege	3432	msiexec.exe
Token: SeRestorePrivilege	3432	msiexec.exe
Token: SeTakeOwnershipPrivilege	3432	msiexec.exe
Token: SeRestorePrivilege	3432	msiexec.exe
Token: SeTakeOwnershipPrivilege	3432	msiexec.exe
Token: SeRestorePrivilege	3432	msiexec.exe
Token: SeTakeOwnershipPrivilege	3432	msiexec.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1044	python-3.12.2-amd64.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4644	OpenWith.exe
2740	mmc.exe
2740	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 3792	1376	msedge.exe	81
PID 1376 wrote to memory of 3792	1376	msedge.exe	81
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 1116	1376	msedge.exe	82
PID 1376 wrote to memory of 4188	1376	msedge.exe	84
PID 1376 wrote to memory of 4188	1376	msedge.exe	84
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83
PID 1376 wrote to memory of 4452	1376	msedge.exe	83

C:\Users\Admin\AppData\Local\Temp\1337 tool.exe
"C:\Users\Admin\AppData\Local\Temp\1337 tool.exe"
1⤵
PID:5008
- C:\Users\Admin\AppData\Local\Temp\onefile_5008_133532720913217538\1337 tool.exe
  "C:\Users\Admin\AppData\Local\Temp\1337 tool.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffdd6e73cb8,0x7ffdd6e73cc8,0x7ffdd6e73cd8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2372 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2632 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2156 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2932 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1320
- C:\Users\Admin\Downloads\python-3.12.2-amd64.exe
  "C:\Users\Admin\Downloads\python-3.12.2-amd64.exe"
  2⤵
  - Executes dropped EXE
  PID:3068
- - C:\Windows\Temp\{25F37228-1ADD-437C-9479-C6503819B23A}\.cr\python-3.12.2-amd64.exe
    "C:\Windows\Temp\{25F37228-1ADD-437C-9479-C6503819B23A}\.cr\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.2-amd64.exe" -burn.filehandle.attached=596 -burn.filehandle.self=604
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,2158207510275410755,13713234187170534833,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4600 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4216

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4644

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\WF.msc"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2740

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5966b2.rbs

Path C:\Config.Msi\e5966b2.rbs
Size 8KB
SHA256 819b85ca71ed519ed4d608402c24bd47ee05b75936d02a817e7e67775176189b
MD5 54f49b96bd4b878a4a2bd7f2126878c3
SHA1 7b37fe593f8ddf5e397f3450923bd00ae5b69ccf
SHA512 4026b2a2614ca411cc7e4bbad41b01e6ecf4dff45b70a63a6518c2e5ff8f9de2060df9b7b448c5fac7becb63b296c186ff7f5f0b89f377196f57d76b203d0b08
SSDEEP 96:nmknp/A+rteCTQZE5cEvCUZAX+ZcCsTlyUZAX+ZcC6jV2E2TrTlLTbhMoaaFgBPF:mU/8Czxv1K+ZzI7K+ZzE0VkApw
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5966b7.rbs

Path C:\Config.Msi\e5966b7.rbs
Size 12KB
SHA256 1a0ac5d96497a4612deb931c5ccde7512a10d75144f850af95d4af4d1d684b72
MD5 6759aee0d2d16802adce14ea0dcf491f
SHA1 22556cb8b39f527ec181e567dc11248bcd6eadbb
SHA512 8d85d730271b8b4a8c623b62d188a0bc3ddd546d5a5ab3dee284ad7ac871d94050f8bdda70a0f2f8422b118fddf386d3735e3d816516ff89404ef44e90afae5b
SSDEEP 384:mGvhhp1N+mlifPC9F37YW+KwcNwcKFHbc+kO+1l:mGvhhpX+mlifPC9FLnwOwDBc+kO+1l
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5966bc.rbs

Path C:\Config.Msi\e5966bc.rbs
Size 50KB
SHA256 b9b20b2644b6b9bafd01514bc67d8e3c8c0361ca20fcbc2fc03324fd49a56c54
MD5 fcb7503f7c32070d121d8eabe7c4b8ed
SHA1 b07c79580f0187ae625159b319b5b6a9bc4a06ad
SHA512 68e019e0d3930299b07fe878cad09565f798460ef89a16d452719400866b04cc195a677b92ded3c4df6e10977a7f3f726c8024eb4cf5b3dc3dd2ca2c6edf0758
SSDEEP 1536:diAJUP6sCJWC2g9RT5HKAOMY3gwas+No2DemvqO7ze4v1KABfTaxRAVIbyh8Wl6U:9Fl
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5966c1.rbs

Path C:\Config.Msi\e5966c1.rbs
Size 138KB
SHA256 f2ef2e87685ceee242cc2f3674bd4737dd5737f36f2845bae793e8159fff949a
MD5 ad6816de200b833eb884f9f707ab01d4
SHA1 46fcf1a8cc17026ee54118d7f8f8f3890a7f8b34
SHA512 f32d6c436c61e566c66aaa0b3f3bcef3091429476223d79f8555c9453adbefbc07275667b75809b9191565114ff13e0a818906e8b134b0c3e182feadf1039d7b
SSDEEP 1536:6fRz+8G2s/PUtg32GWX9vgD9r7s52uUE803x0s0hQ+9OI9eQPu/fJH3vJdJDG9c/:BJaZIBz46Lswa
MD5 SHA1 SHA512 SSDEEP

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_26B14BC5FFF8CCADF0E4994815CF2509

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_26B14BC5FFF8CCADF0E4994815CF2509
Size 727B
SHA256 7db63087823541676510d98823c79c619abcc769fb605225b0d531d65413a5f7
MD5 c0b79d94a13c13edb91c33832ddaf19b
SHA1 7d9fb6535f92dde3a7f5f315dcd5c7d2336e4969
SHA512 ea3ad925ff0575e851ef1489ed763aef6d29a8c3d1df632f07c51db57a00a0f64eb829ad57f1ef698ce5500bfdd6873dc6be8cf2acf912c853433340034828a4
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_26B14BC5FFF8CCADF0E4994815CF2509

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_26B14BC5FFF8CCADF0E4994815CF2509
Size 404B
SHA256 f9c08675bfb39cf80e101300819c98bccd6256856bf8efc25c3af73530685e53
MD5 a2b45b3353ded2442c669a57181c53a9
SHA1 91c0f0ac64e23119c2266287ab95436f7fcb5ff4
SHA512 4ffee1ab84e4171503004f0eafb4ae14046771d9c0be9aee598edca67b6e92e2c02fa17d47d2309287d4197b3108aff85b97d294c4b50e4362a8d84eb528b95e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 34070e3eea41c0e180cb5541de76cea15ef6f9e5c641e922d82a2d97bdce3aa3
MD5 ce319bd3ed3c89069337a6292042bbe0
SHA1 7e058bce90e1940293044abffe993adf67d8d888
SHA512 d42f7fc32a337ecd3a24bcbf6cd6155852646cae5fb499003356f713b791881fc2e46825c4ff61d09db2289f25c0992c10d6fadb560a9bea33284bd5acc449f7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c353020621fa6cea80eaa45215934d5f44f181ffa1a673cdb7880f20a4e898e0
MD5 12b71c4e45a845b5f29a54abb695e302
SHA1 8699ca2c717839c385f13fb26d111e57a9e61d6f
SHA512 09f0d1a739102816c5a29106343d3b5bb54a31d67ddbfcfa21306b1a6d87eaa35a9a2f0358e56cc0f78be15eeb481a7cc2038ce54d552b9b791e7bee78145241
MD5 SHA1 SHA512

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Size 32KB
SHA256 04c7f19e1ae294cc641f6c497653b5c13c41b258559f5f05b790032ccca16c82
MD5 b582b2eca79a750948dbb3777aeaaadb
SHA1 bf0ea1c8a7b4a55779cbb3df1f1d75cc19910e9f
SHA512 35cfd88afe4e4e8091d3a5c53f0f3e2dcd92aa58b7544b94d4d9d7cdf508d429c5292aa97b813c9c8ad18e4d121d4e6595c49f5ddafbeab7b39f3a7c9d0b58dd
SSDEEP 768:S5rsd4sFCihE6OYoEs/5pn7A8o690DW1d3zt0OG:+4d4CbdOjEQp7ho6x1djPG
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Size 66KB
SHA256 274befc7b39609fed270e69335bc92b3d8251545594636eb408d5d93e0ae1a4f
MD5 33411bb179575dfc40cc62c61899664f
SHA1 d03c06d5893d632e1a7f826a6ffd9768ba885e11
SHA512 dc830766c928ac84df16d094fc92586b9c2c25f819123dc9b5ec259220b4b1c45e2af28c89a710f047c00c9dcf7df8dd859a9a7a2d2228703f616df13caef2c7
SSDEEP 1536:DQFVtT8CbB1R8u7uT2yW7tLkpVmWYK9XoTEPnq0K+XeooPpcmgK:6gI1kT2PiiuXoBSuoohKK
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 d8c1b82b7d88a8c33543a68f57a02c698b650cb5e7883087bd02fc49f02ac661
MD5 a5385026c743e5e5d80bae6a09ac30c8
SHA1 f21056b64f2bdefcb3c04fc57eb99d799d81727b
SHA512 0aeb33233cabd2982be608520ca18de66bde21fc5cfa815f9358bea53273644896b408393ab6f027baa56b02ec9342879e96d7a7dd0aaadb617656da193c10f5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 714d5b7afaf142f88ae94ad1a2a0441514bf36bf39aa2e0c012015864309d220
MD5 8059e6b91b7f63f12c07f892eef2c9ef
SHA1 2b0066f1e58b7bef61449b474de1ca7607ec0aef
SHA512 aa1dfdbcdb613228e7948a877932d466fd9eadeea46845346b8cb2265a1e4f85b3c3101fdc23ddfe92dded2ec3b800b45f46830f5981734c6fb6f93a1b649211
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 703c01f125930aeaf135c22d02e039765d881f6dbf39e480cea17ab33981b91b
MD5 89b142ad393b1501f87aedb7664ff1dd
SHA1 8c643bc31033c13f4dd2d371f5d53a49affd901a
SHA512 31f0482909a413517e4ba1c41c500ba3eb4b36ef2467abf2aed0ebf7594855d41b1da604fcc6341c912b1ce28d48259a3961fb093ca7f20a11f0cc693076ed13
SSDEEP 96:nfk3HSxm/FQYmt8dk4uYkwSv0MoiVmdHI15JTgL0WQyV+VpziX3wI3:nfk3HPOmdkZ1v0MAI1LTgLLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 01a9d94b5c7dffe875e6558d7b82b56a0ed7deda119c2635811f5daf9cd6f48f
MD5 cb1a73fd5e2a974ebff40f1f73196a4a
SHA1 224354e196e49bc8f7ffe8aa2976e8aa7d87b5f6
SHA512 83e6f8f0fcab4ae4b60f034677894c0a091383de57af5a795a7c3619b5e067c1da6cb7b3690198d17c3252aa02755d4b43d33bde97952cbba56fdad21bbb2633
SSDEEP 192:nfk3NPrmdkb1670MQKu5DyP1V22I1prgLLe93:nfeNadkbY0rpW1VC1pr6C93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f557ef29bf9152546fdac9a67848eaa03ab824bd3385adf7803695e35470c34f
MD5 ea2671b58b867c4ecd650ababce71539
SHA1 5eb090e293eb33a60fbfe406741e43fd4cef20f7
SHA512 4d36054fa059346d5be2be9c8844f28f69bc6dd6ec0816ddac64173e45631e5b4912b11930f09eb1156ab0cb058c8d1aed9b214b67534c6f76a2458d5afec101
SSDEEP 192:nfk3DPGmdkw1670MQKu51V22I1Af3gLLe93:nfeDldkwY0rp1VC1Af36C93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 65c759ca8345a3eaa1bfdf2dbfe422fb8ad034052ed873b80a7066189a16f0ed
MD5 381ffcf455d122b939b67e3c6ed7865e
SHA1 6433322427529d8c167d48ee67965e5ef2514451
SHA512 abae25f8b45bc608af290dc783619f0c265250952a1f9c6c8b2cf055d71e03fe4e13b278d83a95410e14b6286985861dde21327ee5f1a70f630c07784b85e524
SSDEEP 192:nfk3UPrmdkb1670MQKu5DyP1V22I1pBgLLe93:nfeUadkbY0rpW1VC1pB6C93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1a7c1f1c003da6ff5f3429be89bf4516db53e3f550740247707592d8851f106d
MD5 cc851e736bc56765d5e0f9b4094fe3bd
SHA1 0795801ef1c6f36642e9f0ae5ba102069e2ca8ff
SHA512 f8e701b6227fdd7902106699ef7b4f3de6c5f0348cbc97aa5dd01e34b1502ab256414e6586413e6cb8e593e7c853e8dcf2e32562bff1a6cd39f1b7df32aba340
SSDEEP 96:nfk3HSxm/Fnmt8dk4uYkwSv0MoiVmdHI15JTgL0WQyV+VpAiX3wI3:nfk3HP8mdkZ1v0MAI1LTgLLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 c3118c458b6ee203a88241acaea09bba704f0df94143014cec5602da67c512e8
MD5 5bbe42a4d7986ab69a5d418f353035b7
SHA1 4b71b8f26bc8c6adf8504a1e294ad6c53b0ebd01
SHA512 536796747a3b3784a548fdbb5613b17bab4802c7ff0ca7454bbceb848087d86d357f11c0fba714b6fc7e20d6a10d1d3a6fff804584d1097b32bcc08cb7daa537
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe588c7c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588c7c.TMP
Size 1KB
SHA256 7f2fe44a28c27a8d03fadc6cbef608ce5eaaaa11c0edd79c14ab3cb4694b4826
MD5 c38f5d1fe6139d8502efc41f44537913
SHA1 49e4429f5be2ef20a4c13164099021a198b77548
SHA512 a9950271a71629d503def7e84b0d01562da17f5ea51d38d57b176f185685dbf6433d6c272042e498db11cc1bc5e6c00f72dae7b583ad132423ad1c5f27425ca8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2fe77108f562b1df9e0b059f7a8a2964bd192e01f3cbb12f19574323e9c9faf5
MD5 d6875d27e0a594a23e6ef177cdfe9cfc
SHA1 def9b531ecc94b054756d85f2d4f80bafdc3dd5c
SHA512 8e92154d5b331cd27c5da36d453eb14a8d7fc9b2624a96bd782032e5a06d93d6ad57a2764b3b8335939935136a869b891b5c8beaff5f6a08ad71757959bc0033
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG14Ne2RUfDR6g7PJE7Eu/PgQ9:M9iIxuERzA83h09RZxASG2JWIYJE7ZPD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 044cc395f4e8fa9e74f65a72b4a78a840a639dc2dac563d1913a0a7f8e1f9e85
MD5 c1ab790c2129fca847b2f5a853042b04
SHA1 797aeaea3a03f0b6191b52db08fc8d8bedf5e805
SHA512 2fc3cc6c4a22e5ead7a2bbf8401b0f470d033a355a66be79a6d9ca08f3addbbfe4704052ad235a0dcacbbeebfce506521edf035b68013ebc966f79354e9b5c93
SSDEEP 384:R9iIxuERzA83h09RZxASG2doWrAI7E7ZPIMr2hoo+:aIxuERzA83h09RZxbG2lrAI7E7ZPVihM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8b11b1916dbcd394f8cb017ea58ad13fda9f02d42f3d184a7e61f19355b8f253
MD5 94b11807252848ddb875a44cb900d5d5
SHA1 d26c006a4f10cabe45281bd47ab8f38b0ce7bd57
SHA512 c2dc8e0e0f68e749fd7828edebdd31b6de2a9ed1cb2dbc6fa19b7727f52e98e33e2e1cee2d66fd642a290c520a526a4f0c477b8bec3053dc1e39279a4db7d0c2
SSDEEP 384:t9iIxuERzA83h09RZxASG2doWrAI7E7ZPIMr2hoo+:WIxuERzA83h09RZxbG2lrAI7E7ZPVihM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ae494ca69b4c8b22dce413941aba60cb3fb59236cbd01c60bfcfb8cb875aa0b6
MD5 8c08c25054b3dacbec4cfff240211d5c
SHA1 2c68dca4fa234da91765cfc3a4bb4bcbfa9b5a5f
SHA512 621542183b9c7bb80cce865995a5e970ad8d58782c4b961c39657653f724ce787475990dcc3f8be12b71bbe7d4e49d63bb4ae0bdef932583e73fad29e0b85623
SSDEEP 192:ZoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG14Ne2RUfDR6g7PYE7Eu/PgQ9:F9iIxuERzA83h09RZxASG2JWIYYE7ZPD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3126ee1d9c17691607a6754d245676c6ef1d076a937c3bb5364b5a6191dc806e
MD5 0ea396ce0c21e38b4aa525406ad4905c
SHA1 50f4b470e74c95c15d5bb677940c357aa9e16f26
SHA512 975361d4f6454b4ab5d1806d79a60ac7393503ee595e66b0055b9dde347b0686a2834a5e01eed3396636f25c2c7caed13ae5fad4de75e0a1757378959d61ff7a
SSDEEP 192:yoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG14Ne2RUfDR6g7P2E7Eu/PgQ9:G9iIxuERzA83h09RZxASG2JWIY2E7ZPD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5b8688a7fa47affe6c9f80acb73d3f29a176aaa87fb0d09301d06de0ce3522bf
MD5 04f97004509264190a916fe090487b54
SHA1 d916aa018de1afb2dd0472dea98a491515c5d7f7
SHA512 f3b60c2cba55d92c1caa2b98de5d1fa5470021a555d3c64b09961d118f29d3641a5c76636eb2d8c61414b83a2c17b697c3932752172579129559e979e5dc81b4
SSDEEP 384:19iIxuERzA83h09RZxASG2doWrAIqE7ZPIMr2hoo+:+IxuERzA83h09RZxbG2lrAIqE7ZPVihM
MD5 SHA1 SHA512 SSDEEP

Submit Download

doc_JustForMe

Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\doc_JustForMe
Size 4.5MB
SHA256 44661fadd0afa8f11e175ae90c5d11bc3adba7d23eab7f7884fc32507b317ba0
MD5 d3976bd0c75a09d1512966d14498d65a
SHA1 86ba5858613e8cd0184b5572c8549cc669957836
SHA512 c43ca99fe44b2644e59bb043ff07273d17852cb20798aed79c1f7fb4f570f406823adc039772cb1f3f996d046cf994f57241e3eb679a25f9cd7eb980f2705c4c
SSDEEP 98304:FTiYDGYk3Ht55urtOD1pTZg16/2HvECLIchYOoI6KLnuUG:F9Pk3N55uhO3906gE+ISYxIb6
MD5 SHA1 SHA512 SSDEEP

Submit Download

lib_JustForMe

Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe
Size 4.2MB
SHA256 9a43a7f0b4d0ec9b327394cda44eda44129c4269230099c19cb7d47c57e8e487
MD5 cdc1ee474936b8759007b69f7c6774c5
SHA1 e8ac111699d3fe1a5afca2db11c2555401cb2d0c
SHA512 645ee0aa122bd8f0019dfac8cf05365a909c629ba889b36edc0c31a642d21120b0d774676a6a306addb8e4fed0634fc9c46891be6f54152b9ca95910ed9f4bd7
SSDEEP 98304:clI/F3BVvTWfSkah/++KxwdnswBJ+suAQ8LzHpYO6SwrA:wI/5DvISjQKd3Jd48Lzx9
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcltk_JustForMe

Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\tcltk_JustForMe
Size 3.4MB
SHA256 f0d5c603ff7d87412f5a1e45e8ab7bd95d6f40bb90fd107125964421d7f06233
MD5 cedd6738fae24edddfff69b10e4f46dd
SHA1 97538a7df13e0354a5eaccee7057192d10466a9f
SHA512 0c75c2d1263eeb6ed638d49b1cf3c3004353fff8452ed7288a8853133dc2ad32fe913cc7020b864aaf362b5b29be55e4ec0b38ef978a811c6462552c8cf32e1b
SSDEEP 98304:FhG7ppFbWM8d55yH9KlsEmBaqRf8ZkT8w9JDe0:fGdbbWzd55ds3Tf8ZkTF9w0
MD5 SHA1 SHA512 SSDEEP

Submit Download

exe.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}v3.12.2150.0\exe.msi
Size 712KB
SHA256 91f05b779c2bbeb7a371c2ca24f600d8c21664ad8d2bc464e5565bb90e9405d2
MD5 9245623543644d494cc7ebe9ba4bdf49
SHA1 416d483ececc8a6e5ba092d1ae75e7880fa4be36
SHA512 4946990d92c6dce2da3c9eaf16cfb7e61a8070af11b8ffd67d75e541b6007e4ea459d3b0e27da9d08e39b407fec9ca9da3ea5cad789cad9722f0408d62d02366
SSDEEP 12288:BxGY2hyeC6lG7iqsgKxyy+76ygSL1ct9DUxj2i1pkY0wCZWdd2IYw9:BUYxeC69Hghz6ygAcnUZ1pkY0wCWTw
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{4534F2ED-1616-434D-98A6-0DA358DCD466}v3.12.2150.0\core.msi
Size 2.0MB
SHA256 e747ceb205400dcdd45cbedc372f9c3cacdd158277e4d27ae1b95d223e323918
MD5 1c1df711824f2575637d68f9e79f0467
SHA1 28de3cc8ad3d32739a4eb9d93106c18f028aaedd
SHA512 7a9d7d1f5823c36504e645562117cd494f8de79b5c0724326b6cbee7add3c617c7ba1a1a69012646840071ccbc29e8b3ed518875cce8466fb7208fd272de87c5
SSDEEP 49152:9e8lSeBBsXOOvvw4PuADn2sseYjWi4fzJ7AdEu2Wbphs+h32/+UnkJxz8:c8oeUe+WwnDszjWHdBtopa+h++A
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{94087C99-E4F5-4637-A789-3B6059DF787B}v3.12.2150.0\test.msi
Size 5.3MB
SHA256 fc1036043979b114687df71c1d80abb91734e8fa1e39e7b60056801f0c39db4a
MD5 7cc11322ca54161b318a49a85caac8bf
SHA1 333e12785f407e5d930c98fa9578bf8c8b6b5d5f
SHA512 84e189bd7f4379ebd6261cdcd7cfeca6b4a2229bb116f9f47ab649cbc01a325aecc4a514855280488515590c794545eb1fb783e064d4d3921efe452d7dea31f6
SSDEEP 98304:CwvGPRlsD1nLgSowrjXPgt2bjU3ISvHEwIcZfZ2SgTTs0dyAs:Cw+yLgOrM0PQbvHEWB2PMJAs
MD5 SHA1 SHA512 SSDEEP

Submit Download

lib.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}v3.12.2150.0\lib.msi
Size 1.3MB
SHA256 06f74015240bbdf4d5822703953bd6a4d1016ceae7a8501dbcca70ca17a5c7d1
MD5 b876f09b9e02d5319a89afa18339a41a
SHA1 ae65a05a1a7f88573faba0872dbbcc3dcfcbae6b
SHA512 4796f2b095cd5d5cae2fe7a4fd4110003a7eeab8c0f3e28cea9d2049e571419d31f1696a82737108ad8c74ca076aec6ddcf09b92c678eb25ffddbb68764c7587
SSDEEP 24576:UewDOUL5a9rVDHs+dVaVe3a6NNoNyIww6fdz6R/Mj5thoEoSK4HuKtk:cyU9WHdVao3BFIwwQ+FMjTFoSASk
MD5 SHA1 SHA512 SSDEEP

Submit Download

dev.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}v3.12.2150.0\dev.msi
Size 384KB
SHA256 633283cfcc5e870c6ce19404267a5e0509625b6b106d0c68e7133557d5c1bcb6
MD5 f7a21ea8323d54f6348c08e185d4a429
SHA1 4a969a5aa49728821e5b0064ab20e36f8d1825c5
SHA512 161b3d0392cc0626f222a9d525f9af8cae3184c6c71d9c6e90749f1c6a71df0bf4a130234a50648c63e56099b72a0647c647b57b7ff05db3161cd5fac2c5bdd7
SSDEEP 6144:k0jiPeOnOmuUsPrZ8ug9kD392micgbGejKQS7EEEpOu:k0mPeOnnqruyveWLEEEpOu
MD5 SHA1 SHA512 SSDEEP

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\test\test_importlib\extension\__init__.py
Size 147B
SHA256 6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225
MD5 c3239b95575b0ad63408b8e633f9334d
SHA1 7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc
SHA512 5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25
MD5 SHA1 SHA512

Submit Download

__main__.py

Path C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\test\test_importlib\frozen\__main__.py
Size 62B
SHA256 b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216
MD5 47878c074f37661118db4f3525b2b6cb
SHA1 9671e2ef6e3d9fa96e7450bcee03300f8d395533
SHA512 13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5
MD5 SHA1 SHA512

Submit Download

Python 3.12.2 (64-bit)_20240224181646_000_core_JustForMe.log

Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20240224181646_000_core_JustForMe.log
Size 1KB
SHA256 99244b6307878ac1297043c091f1f078c330b34545ef1ffa54cdccd46e573aad
MD5 06cccebe3482702b26435be5344fe106
SHA1 054a6fb06f2137ea9b0a866a512257b2f9671dc3
SHA512 8d2fa605cb15f7cbabb921afe3d292bb0f82000e26e54686a1264dad2148ed89ab948e18ab4806316d0848008895c5f28a548b8df738855f37251b7c8cd6393c
MD5 SHA1 SHA512

Submit Download

Python 3.12.2 (64-bit)_20240224181646_001_exe_JustForMe.log

Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20240224181646_001_exe_JustForMe.log
Size 1KB
SHA256 563f47d8fbf0950a3716859fb0969946a8bc0a52e45ba227458fc929c4025bc1
MD5 2d05167910f02440799afea43e3cba3d
SHA1 28642f8b394a8e3ce64ffc9ead5fa078ec12ee45
SHA512 3717b648404dec50a8ac9a0d2e2e9d2211f50f11ed584fb7bd86e7d40951c8a8b57cf460f0537dcf1e4ddf97de9a80cda432c92968be4632068c594d891cb8c5
MD5 SHA1 SHA512

Submit Download

Python 3.12.2 (64-bit)_20240224181646_002_dev_JustForMe.log

Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20240224181646_002_dev_JustForMe.log
Size 1KB
SHA256 2392b20063f21a7dc7983af0d6d7db24f7f4edac7b9dd5d117fc22aac0a352be
MD5 c37883c3976ac6f511f703d322862b8f
SHA1 decedf0a41e4626342f34a319d0fca887d33371e
SHA512 f47db3a4724ca1abdd0c614b5816d2dcaf9bb056f4e83336deb523459ac81a88c86b6f7e9097fcfb5c2a761d2a4cde562fc286c4e1c9e1534b83579f70d88a14
MD5 SHA1 SHA512

Submit Download

Python 3.12.2 (64-bit)_20240224181646_003_lib_JustForMe.log

Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20240224181646_003_lib_JustForMe.log
Size 3KB
SHA256 3fd70101dbcaa199e912604489a4f3ba7f137a8d2ab510c8d8d8b8e50441cb9a
MD5 f560707db12607c0d44e8b9a5a8ec83a
SHA1 2a9f901349b97773a2de9ad60a324d880e4f858c
SHA512 dbe442b57e42f74d99240771afdbcafd44c3d939d2a41ebe9400ca901f96a76de540a3ac8bd8a6d651173b4bde1d03ce17012b48d9288b6a7fe7408ad59dba5c
MD5 SHA1 SHA512

Submit Download

Python 3.12.2 (64-bit)_20240224181646_004_test_JustForMe.log

Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20240224181646_004_test_JustForMe.log
Size 1KB
SHA256 fe4b7dac40dd10b9931e0cf18037c2a27af6511c12c0e37eb854c6666e754edb
MD5 72a236f5ac9cac581457737801678d5a
SHA1 9636e5f0533aa06451da468d9677fdc2668617da
SHA512 c56a19b8d38660dc56b6094fea494cf880df48bcc1758a385174e12aa54d9cb5155b649b83e0e30bce8b7267bb19eb0c538a750a43756b4b248339339c5520a1
MD5 SHA1 SHA512

Submit Download

1337 tool.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_5008_133532720913217538\1337 tool.exe
Size 704KB
SHA256 19b6256a17c1c792624cde6d1cc44a9777dc95fc6c2b65912c383db58f6dedff
MD5 50480d424f199b3e783f3714f54063c8
SHA1 9102314027cc5e7e8e937763583837abdb3e0512
SHA512 4c8c72cff2c2d21a6cd5dfe2ef2fbf8865581e52cd0bf06ca45a450e53ab60c8435a41b62847c19941a8154f70791dc2b37164a0cc4de32f6782938d979d4faa
SSDEEP 12288:rgxbeQVachjjFuGTu4MnufICNE5fsxEgmVgs5l:sFXhjjFj0HXV15l
MD5 SHA1 SHA512 SSDEEP

Submit Download

1337 tool.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_5008_133532720913217538\1337 tool.exe
Size 256KB
SHA256 8c34e0068c520b9f2a32f0fd2b12f23a35f4c4f6877df8ba882de310ee94e178
MD5 5a7d0646634b0c48aeadfebf82e4b3bc
SHA1 6f91860e9715dc471826667ff09e537ec09a0544
SHA512 9d1d11756a2ca8b5b61e813e78cd59b4d87104da127b05dbec8fafe0cc3ea58c5959971313cb782de340ed4dc718281232de16d53094a631d55e53cae20f328d
SSDEEP 3072:bl32kDBLOxbTq3ApgbhnQHAzr8QPayuiKzXBnYEMBbdcI089S:rBKxbeQMQgXciShjAPJE
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5008_133532720913217538\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5008_133532720913217538\_ctypes.pyd
Size 120KB
SHA256 e28d4e46e5d10b5fdcf0292f91e8fd767e33473116247cd5d577e4554d7a4c0c
MD5 22c4892caf560a3ee28cf7f210711f9e
SHA1 b30520fadd882b667ecef3b4e5c05dc92e08b95a
SHA512 edb86b3694fff0b05318decf7fc42c20c348c1523892cce7b89cc9c5ab62925261d4dd72d9f46c9b2bda5ac1e6b53060b8701318b064a286e84f817813960b19
SSDEEP 3072:aS7u5LnIxdP3fPHW+QfLIrAYKpemW9IVLPjo:aSw+3FQfLIrIemW3
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5008_133532720913217538\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5008_133532720913217538\python311.dll
Size 640KB
SHA256 bc2201200bfef52d2dc68a2122b277ae5f4dbb3537b7e8b62f2c8976f0673da3
MD5 869c530239e4a433121c67896f083056
SHA1 a35c00ffc4c0ba3997608f7294e7142e6e08b58c
SHA512 7359d03a5e2e55a355accb38e09ff99c8d23b14326e4b29aa0207f4d465c04b5379088f817decddeccdbf32ae80b7289929d28bad8e371701c7c97025c9bbc15
SSDEEP 12288:J7bjfl+/QPAs2P+IB0K9t5OXA5lNvQSxsDu6P8nqW4OX2Lqlt8mbSm:xTPEdT9tyksDVUCmltxb
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5008_133532720913217538\python311.dll
Size 540KB
SHA256 e27d49915d48d655b13a96aca5328137146adbc07d9f68e591506c62b2506567
MD5 84ceb7125fb2972917ecac24843adbc5
SHA1 3a0ec8496b6246fc8c4ca0ed3e79e1ba539a0f8e
SHA512 e57fedacd27ddebb055065e3f520b9d67eec3b1dd524cc7b4746394a5fa94de251dbb2a261f351ee557714c482c7a604f4abece63dc4b9de06b83a867eb1f395
SSDEEP 12288:J7bjfl+/QPAs2P+IB0K9t5OXA5lNvQSxsDu6P8nqW4w:xTPEdT9tyksDVUf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 45970.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 45970.crdownload
Size 9KB
SHA256 eb7dbbc45e0306b1a67edd666633dc332999d28f344698f75ce3c23de985a758
MD5 4223d4beb8e839f8e735b474190013cb
SHA1 6c4a070cf44f6ca933f216d220beacd65650c14c
SHA512 ce7c52328234c5fec7927a7477e692ce473051fad0af263b160d819f90121644a1ace388296184731752e950e7c90f6f167158a898a950ee6a0986564aea9820
SSDEEP 192:kjl99HCG0udCDz3s3j91ckoF4Wl2ZA8PzO88bHBDo6gYW6cxwdeI:kjvFCGzdC/3swkn9ZDzODbJo6gYGwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

python-3.12.2-amd64.exe

Path C:\Users\Admin\Downloads\python-3.12.2-amd64.exe
Size 25.4MB
SHA256 b9314802f9efbf0f20a8e2cb4cacc4d5cfb0110dac2818d94e770e1ba5137c65
MD5 44abfae489d87cc005d50a9267b5d58d
SHA1 af778548383c17cb154530f1c06344c9cced9272
SHA512 e955f0bee350cd8f7e4da6a8e8f02db40e477b7465a77c8ecab46a54338c0a9d8acf3d22d524af2c45c25685df2468970ea1b70b83321c7f8e3fae230f3c7f16
SSDEEP 786432:uNcuYm2DFVdFu6P92HSenQKvgzu6V9C8DBH:gt2DNFuI9+nQKvgzdJH
MD5 SHA1 SHA512 SSDEEP

Submit Download

python-3.12.2-amd64.exe

Path C:\Users\Admin\Downloads\python-3.12.2-amd64.exe
Size 11.2MB
SHA256 a2d05b244150d06dc8ca02d788341634f551622d535902934594fa5cf4fbf749
MD5 d400f891e13f0bc433459ebbc9d2be54
SHA1 b70e7bc7c7bda464c47bdfcdff4e8b9593b70ebf
SHA512 f334bf3c9031d27dd9d43e809a0aa3ba1b52cda77dabf726907f2d0a40d5c6c46bd814375e8369e3a3253861b3876d79ad2a0dda3b2ea28ba4495600c0572fe1
SSDEEP 196608:2/jNm4O3uXosXNIcDVj2Zpf/osnp0+PtwGsSvGkglJQbciqhaJv9JX1Xey:uNdeuXoerF2EsW+VdvGkglJQQaBt
MD5 SHA1 SHA512 SSDEEP

Submit Download

python-3.12.2-amd64.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\python-3.12.2-amd64.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

python-3.12.2-amd64.exe

Path C:\Windows\Temp\{25F37228-1ADD-437C-9479-C6503819B23A}\.cr\python-3.12.2-amd64.exe
Size 858KB
SHA256 1474dbd6a33da8f2f0b50007ba48f0c1ddb3e0e6f8c969722eed1e683a9af68a
MD5 ab21a1bea9e3eaab64a2c062ab613221
SHA1 310b1f7921af8edf125eacba71944b6e5356acdf
SHA512 b39b5a24bb7b2d3ead8aed284452c94280398a9e4855f17a8e3593fe718e9b3573e88b15f1dd4659030827e754b17e7f918ba24803e4d522ad9601167fb70df4
SSDEEP 24576:l5mWpI2jFM5sFzfTpiYG+Nm4OIIAnSOlRR0EZCcxt:l5BjBbTpiY9m4O3dOHR0E7xt
MD5 SHA1 SHA512 SSDEEP

Submit Download

PythonBA.dll

Path C:\Windows\Temp\{503A5FDF-7E15-435C-8C8A-9907B7FFA484}\.ba\PythonBA.dll
Size 517KB
SHA256 948d43e068d19cc34c43a7820b010f62df3679bfb466f45aa650544ac3fc2340
MD5 71951e6884f33cc3ed42917a3c6c11bf
SHA1 05b3494122e13f8bff73c7586aaddb103c2fa2dd
SHA512 2eea9fb1fc4de38fd7c6d971bacb945cad92b770ed5fe74d4a0433dae875f6f2477c6724e30d782651285afdaaa06a379f5617ac315040d3aadce1d68ef5345e
SSDEEP 6144:VphOWXo5ULF/5Pi/kVCXAac4tTYRakY5YeMAuymS:vhO5UJ/HYXFDtkDAuymS
MD5 SHA1 SHA512 SSDEEP

Submit Download

SideBar.png

Path C:\Windows\Temp\{503A5FDF-7E15-435C-8C8A-9907B7FFA484}\.ba\SideBar.png
Size 50KB
SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
MD5 888eb713a0095756252058c9727e088a
SHA1 c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA512 7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
SSDEEP 1536:/c/aRsg1fYfJt0Bg74nWPMMCNBaeQzxxj8ckBo:UcsgGfP0yCWTAaeyxxjGBo
MD5 SHA1 SHA512 SSDEEP

Submit Download

pip_JustForMe

Path C:\Windows\Temp\{503A5FDF-7E15-435C-8C8A-9907B7FFA484}\pip_JustForMe
Size 268KB
SHA256 cfe1f73cd965e2cf1bcb94143fd87b7a6cb0d315977cab1da3002f5029948b98
MD5 083842cfa5cb8331820b45599cb883ef
SHA1 2858179692c35368251f72894a8612db25fecc74
SHA512 e3325c99fc05280dc05d2d458ee942aa406b13b95993d2415817ab3c55752cb66a8d1613514382b092eb55c08c2319b57dd261120db525253398b7a456091229
SSDEEP 3072:mp3AMq06T/ttluwYNCwzMVVv2BZb3X3DncAiE2l4v79WTflQnjSAFP40SrwMvRIP:mvAVt07kub3jcA/2c9u0AIYsq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/800-87-0x00007FF6F71F0000-0x00007FF6F9D83000-memory.dmp

Download

memory/2740-536-0x000000001CB10000-0x000000001CB20000-memory.dmp

Download

memory/2740-537-0x00007FF466570000-0x00007FF466580000-memory.dmp

Download

memory/2740-538-0x000000001CB10000-0x000000001CB20000-memory.dmp

Download

memory/2740-530-0x000000001CB10000-0x000000001CB20000-memory.dmp

Download

memory/2740-529-0x000000001CB10000-0x000000001CB20000-memory.dmp

Download

memory/2740-527-0x000000001CB10000-0x000000001CB20000-memory.dmp

Download

memory/2740-540-0x00007FFDC0650000-0x00007FFDC1112000-memory.dmp

Download

memory/2740-528-0x000000001D180000-0x000000001D666000-memory.dmp

Download

memory/2740-526-0x00007FFDC0650000-0x00007FFDC1112000-memory.dmp

Download

memory/5008-165-0x00007FF700910000-0x00007FF702212000-memory.dmp

Download