Resubmissions
18-04-2024 16:57
240418-vgmjeaaa67 916-04-2024 15:15
240416-sm328sdc55 916-04-2024 14:46
240416-r5c34acf52 916-04-2024 13:32
240416-qs9e4ach4t 915-04-2024 23:55
240415-3yn3kabg48 915-04-2024 22:47
240415-2qtgmsad66 915-04-2024 20:55
240415-zqqpmsgb58 815-04-2024 13:28
240415-qq2x8shg6y 6Analysis
-
max time kernel
1412s -
max time network
1418s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 13:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bit.ly/triageshare2024
Resource
win10v2004-20240412-en
General
-
Target
https://bit.ly/triageshare2024
Malware Config
Signatures
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" python.exe -
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Control Panel\International\Geo\Nation python-3.12.3-amd64.exe -
Executes dropped EXE 64 IoCs
pid Process 4064 python-3.12.3-amd64.exe 4868 python-3.12.3-amd64.exe 4424 python-3.12.3-amd64.exe 4212 python.exe 4264 python.exe 4308 py.exe 4884 python.exe 3344 py.exe 1600 python.exe 4956 py.exe 4020 python.exe 2128 pip.exe 1788 python.exe 4828 python.exe 2920 python.exe 364 python.exe 2660 python.exe 2676 python.exe 1176 python.exe 224 python.exe 1876 python.exe 4280 python.exe 1136 python.exe 1440 auto-py-to-exe.exe 3748 python.exe 4028 python.exe 5232 python.exe 660 python.exe 3300 python.exe 5024 python.exe 6024 python.exe 5388 python.exe 556 runme.exe 2660 runme.exe 4888 runme.exe 4308 runme.exe 4584 runme.exe 4576 runme.exe 2732 runme.exe 4016 runme.exe 2140 runme.exe 1732 runme.exe 3012 runme.exe 1992 runme.exe 4804 runme.exe 440 runme.exe 2684 runme.exe 3508 runme.exe 5644 runme.exe 1272 runme.exe 2092 runme.exe 2908 runme.exe 5384 runme.exe 5700 runme.exe 3792 runme.exe 964 runme.exe 5828 runme.exe 980 runme.exe 4264 runme.exe 5428 runme.exe 5108 runme.exe 1348 runme.exe 2624 runme.exe 5856 runme.exe -
Loads dropped DLL 64 IoCs
pid Process 4868 python-3.12.3-amd64.exe 2820 MsiExec.exe 4212 python.exe 4212 python.exe 4212 python.exe 4212 python.exe 4212 python.exe 4212 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4264 python.exe 4884 python.exe 4884 python.exe 4884 python.exe 4884 python.exe 4884 python.exe 4884 python.exe 4884 python.exe 1600 python.exe 1600 python.exe 1600 python.exe 1600 python.exe 1600 python.exe 1600 python.exe 1600 python.exe 4020 python.exe 4020 python.exe 4020 python.exe 4020 python.exe 4020 python.exe 4020 python.exe 4020 python.exe 1788 python.exe 1788 python.exe 1788 python.exe 1788 python.exe 1788 python.exe 1788 python.exe 1788 python.exe 1788 python.exe 1788 python.exe 1788 python.exe 1788 python.exe 1788 python.exe -
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsStartupManager = "C:\\Program Files\\Python312\\your_script_name.exe" python.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsStartupManager = "C:\\Program Files\\Python312\\your_script_name.exe" python.exe Set value (str) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce" python-3.12.3-amd64.exe Set value (str) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsStartupManager = "C:\\Users\\Admin\\output\\MicrosoftSecurity64\\main.py" python.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 229 3600 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
flow ioc 351 raw.githubusercontent.com 385 raw.githubusercontent.com 403 raw.githubusercontent.com 587 raw.githubusercontent.com 433 raw.githubusercontent.com 442 raw.githubusercontent.com 470 raw.githubusercontent.com 511 raw.githubusercontent.com 474 raw.githubusercontent.com 383 raw.githubusercontent.com 427 raw.githubusercontent.com 438 raw.githubusercontent.com 466 raw.githubusercontent.com 521 raw.githubusercontent.com 14 drive.google.com 409 raw.githubusercontent.com 462 raw.githubusercontent.com 516 raw.githubusercontent.com 425 raw.githubusercontent.com 560 raw.githubusercontent.com 464 raw.githubusercontent.com 558 raw.githubusercontent.com 713 raw.githubusercontent.com 348 raw.githubusercontent.com 353 raw.githubusercontent.com 357 raw.githubusercontent.com 697 raw.githubusercontent.com 564 raw.githubusercontent.com 702 raw.githubusercontent.com 393 raw.githubusercontent.com 417 raw.githubusercontent.com 492 raw.githubusercontent.com 527 raw.githubusercontent.com 519 raw.githubusercontent.com 365 raw.githubusercontent.com 375 raw.githubusercontent.com 452 raw.githubusercontent.com 456 raw.githubusercontent.com 395 raw.githubusercontent.com 446 raw.githubusercontent.com 481 raw.githubusercontent.com 367 raw.githubusercontent.com 379 raw.githubusercontent.com 391 raw.githubusercontent.com 401 raw.githubusercontent.com 423 raw.githubusercontent.com 381 raw.githubusercontent.com 525 raw.githubusercontent.com 721 raw.githubusercontent.com 355 raw.githubusercontent.com 478 raw.githubusercontent.com 347 raw.githubusercontent.com 361 raw.githubusercontent.com 405 raw.githubusercontent.com 533 raw.githubusercontent.com 454 raw.githubusercontent.com 495 raw.githubusercontent.com 15 drive.google.com 359 raw.githubusercontent.com 448 raw.githubusercontent.com 363 raw.githubusercontent.com 450 raw.githubusercontent.com 575 raw.githubusercontent.com 369 raw.githubusercontent.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Python312\Lib\idlelib\Icons\README.txt msiexec.exe File created C:\Program Files\Python312\Lib\site-packages\pip\_internal\resolution\legacy\__pycache__\__init__.cpython-312.pyc.1971781945264 python.exe File created C:\Program Files\Python312\Lib\site-packages\pip\_vendor\platformdirs\__pycache__\android.cpython-312.pyc.1971781959504 python.exe File created C:\Program Files\Python312\Lib\site-packages\setuptools\command\__pycache__\bdist_egg.cpython-312.pyc.1842178069472 python.exe File created C:\Program Files\Python312\Lib\site-packages\PyInstaller\hooks\hook-PyQt5.QtNetworkAuth.py python.exe File created C:\Program Files\Python312\Lib\test\test_tomllib\data\valid\five-quotes.json msiexec.exe File created C:\Program Files\Python312\Lib\site-packages\PyInstaller\hooks\hook-PySide2.QtSql.py python.exe File created C:\Program Files\Python312\Lib\json\__pycache__\__init__.cpython-312.opt-1.pyc.2725353654832 python.exe File created C:\Program Files\Python312\Lib\site-packages\zope\interface\registry.py python.exe File created C:\Program Files\Python312\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\__pycache__\hook-pingouin.cpython-312.pyc.1842191698736 python.exe File created C:\Program Files\Python312\Lib\asyncio\__pycache__\queues.cpython-312.pyc.2134210081840 python.exe File opened for modification C:\Program Files\Python312\Lib\site-packages\PyInstaller\utils\osx.py python.exe File created C:\Program Files\Python312\Lib\tabnanny.py msiexec.exe File created C:\Program Files\Python312\DLLs\_testimportmultiple.pyd msiexec.exe File created C:\Program Files\Python312\Lib\test\test_unittest\testmock\__pycache__\testhelpers.cpython-312.pyc.2134228644416 python.exe File created C:\Program Files\Python312\Lib\site-packages\requests-2.31.0.dist-info\WHEEL python.exe File created C:\Program Files\Python312\Lib\__pycache__\crypt.cpython-312.opt-1.pyc.2725352766160 python.exe File created C:\Program Files\Python312\Lib\lib2to3\fixes\__pycache__\fix_exitfunc.cpython-312.opt-2.pyc.2558319435408 python.exe File created C:\Program Files\Python312\Lib\__pycache__\pickle.cpython-312.opt-2.pyc.2558320259600 python.exe File created C:\Program Files\Python312\Lib\site-packages\PyInstaller\hooks\hook-PyQt5.QtQuick.py python.exe File created C:\Program Files\Python312\Lib\__pycache__\_strptime.cpython-312.pyc.2134210542400 python.exe File created C:\Program Files\Python312\Lib\__pycache__\bdb.cpython-312.opt-2.pyc.2558320262736 python.exe File created C:\Program Files\Python312\Lib\test\__pycache__\test_msilib.cpython-312.opt-2.pyc.2558318977712 python.exe File created C:\Program Files\Python312\Lib\site-packages\urllib3\util\__pycache__\ssltransport.cpython-312.pyc.1842178068752 python.exe File created C:\Program Files\Python312\Lib\site-packages\future\types\__pycache__\newmemoryview.cpython-312.pyc.1842178181136 python.exe File created C:\Program Files\Python312\tcl\tcl8.6\tzdata\Zulu msiexec.exe File created C:\Program Files\Python312\tcl\tix8.4.3\demos\MkDirLis.tcl msiexec.exe File created C:\Program Files\Python312\Lib\idlelib\idle_test\__pycache__\test_statusbar.cpython-312.opt-2.pyc.2558319438288 python.exe File created C:\Program Files\Python312\Lib\multiprocessing\__pycache__\resource_sharer.cpython-312.opt-2.pyc.2558319438288 python.exe File created C:\Program Files\Python312\Lib\site-packages\gevent\tests\test__issue639.py python.exe File created C:\Program Files\Python312\Lib\test\certdata\keycert3.pem msiexec.exe File created C:\Program Files\Python312\Lib\test\test_importlib\source\__pycache__\__main__.cpython-312.opt-1.pyc.2725363644672 python.exe File created C:\Program Files\Python312\Lib\test\test_json\__pycache__\test_default.cpython-312.opt-2.pyc.2558329929520 python.exe File created C:\Program Files\Python312\Lib\ctypes\_endian.py msiexec.exe File created C:\Program Files\Python312\Lib\test\test__xxsubinterpreters.py msiexec.exe File created C:\Program Files\Python312\Lib\test\__pycache__\test_code_module.cpython-312.pyc.2134211048496 python.exe File created C:\Program Files\Python312\Lib\test\test_gdb\__pycache__\test_cfunction.cpython-312.pyc.2134226995248 python.exe File created C:\Program Files\Python312\Lib\test\test_pydoc\__pycache__\__init__.cpython-312.opt-1.pyc.2725363644528 python.exe File created C:\Program Files\Python312\Lib\__pycache__\functools.cpython-312.opt-2.pyc.2558311962800 python.exe File created C:\Program Files\Python312\include\cpython\complexobject.h msiexec.exe File created C:\Program Files\Python312\Lib\test\test_json\__pycache__\test_pass1.cpython-312.opt-1.pyc.2725363641504 python.exe File created C:\Program Files\Python312\Lib\test\test_htmlparser.py msiexec.exe File created C:\Program Files\Python312\Lib\collections\__pycache__\abc.cpython-312.opt-1.pyc.2725353045040 python.exe File created C:\Program Files\Python312\Lib\site-packages\PyInstaller\hooks\hook-PyQt6.QtDesigner.py python.exe File opened for modification C:\Program Files\Python312\Lib\site-packages\PyInstaller\hooks\hook-PySide6.Qt3DAnimation.py python.exe File created C:\Program Files\Python312\Lib\site-packages\PyInstaller\hooks\hook-gi.repository.Atk.py python.exe File created C:\Program Files\Python312\Lib\encodings\koi8_r.py msiexec.exe File created C:\Program Files\Python312\Lib\venv\__init__.py msiexec.exe File created C:\Program Files\Python312\Lib\test\__pycache__\test_yield_from.cpython-312.pyc.2134211047728 python.exe File created C:\Program Files\Python312\Lib\site-packages\PyInstaller\hooks\__pycache__\hook-PyQt5.QtSensors.cpython-312.pyc.1842178923920 python.exe File created C:\Program Files\Python312\Lib\test\support\os_helper.py msiexec.exe File created C:\Program Files\Python312\Lib\__pycache__\mimetypes.cpython-312.pyc.2134210543296 python.exe File created C:\Program Files\Python312\Lib\opcode.py msiexec.exe File created C:\Program Files\Python312\Lib\json\__pycache__\__init__.cpython-312.pyc.1971767292464 python.exe File created C:\Program Files\Python312\Lib\site-packages\pyinstaller_hooks_contrib-2024.4.dist-info\WHEEL python.exe File created C:\Program Files\Python312\Lib\site-packages\gevent\tests\__pycache__\test__hub_join.cpython-312.pyc.1842191700960 python.exe File created C:\Program Files\Python312\tcl\tcl8.6\tzdata\Asia\Phnom_Penh msiexec.exe File created C:\Program Files\Python312\Lib\test\test_ctypes\__pycache__\__init__.cpython-312.pyc.2134210080560 python.exe File created C:\Program Files\Python312\Lib\test\__pycache__\test_stable_abi_ctypes.cpython-312.opt-2.pyc.2558329923616 python.exe File created C:\Program Files\Python312\Lib\site-packages\pywin32_ctypes-0.2.2.dist-info\LICENSE.txt python.exe File created C:\Program Files\Python312\Lib\wsgiref\simple_server.py msiexec.exe File created C:\Program Files\Python312\Lib\site-packages\pip\_internal\commands\__pycache__\wheel.cpython-312.pyc.1971780019536 python.exe File created C:\Program Files\Python312\Lib\site-packages\PyInstaller\hooks\__pycache__\hook-PyQt5.QtMultimediaWidgets.cpython-312.pyc.1842184862016 python.exe File created C:\Program Files\Python312\Lib\site-packages\gevent\resolver\_addresses.py python.exe -
Drops file in Windows directory 56 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5de3da.msi msiexec.exe File opened for modification C:\Windows\Installer\e5de3df.msi msiexec.exe File created C:\Windows\py.exe msiexec.exe File created C:\Windows\Installer\{52ABF617-F7B4-40F9-8197-C7490DAA97A3}\ARPIcon msiexec.exe File created C:\Windows\Installer\SourceHash{837260D6-3959-452B-A557-666302BEA663} msiexec.exe File opened for modification C:\Windows\Installer\e5de3f3.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE6A9.tmp msiexec.exe File created C:\Windows\Installer\e5de3df.msi msiexec.exe File created C:\Windows\Installer\e5de3e8.msi msiexec.exe File created C:\Windows\Installer\SourceHash{474E5879-A9D5-4DF5-9385-ADF7E224CEC7} msiexec.exe File opened for modification C:\Windows\Installer\e5de3d5.msi msiexec.exe File created C:\Windows\Installer\e5de3ed.msi msiexec.exe File created C:\Windows\Installer\e5de3ee.msi msiexec.exe File created C:\Windows\Installer\e5de3f7.msi msiexec.exe File created C:\Windows\Installer\e5de3d9.msi msiexec.exe File created C:\Windows\Installer\e5de3e3.msi msiexec.exe File created C:\Windows\Installer\e5de3e4.msi msiexec.exe File opened for modification C:\Windows\Installer\e5de3e9.msi msiexec.exe File opened for modification C:\Windows\Installer\e5de3cb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIEA73.tmp msiexec.exe File created C:\Windows\Installer\e5de3f2.msi msiexec.exe File created C:\Windows\Installer\e5de3d0.msi msiexec.exe File created C:\Windows\Installer\SourceHash{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD} msiexec.exe File created C:\Windows\Installer\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\idle.exe msiexec.exe File opened for modification C:\Windows\Installer\{52ABF617-F7B4-40F9-8197-C7490DAA97A3}\ARPIcon msiexec.exe File opened for modification C:\Windows\Installer\MSIBBF4.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\e5de3ee.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC} msiexec.exe File created C:\Windows\Installer\e5de3de.msi msiexec.exe File created C:\Windows\pyshellext.amd64.dll msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{575FEF7A-71FE-437E-91B0-D3838C1026DA} msiexec.exe File opened for modification C:\Windows\Installer\e5de3e4.msi msiexec.exe File created C:\Windows\Installer\e5de3e9.msi msiexec.exe File created C:\Windows\Installer\SourceHash{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9} msiexec.exe File created C:\Windows\Installer\SourceHash{8EB1F259-1326-4583-B383-F5C3D7C93D7D} msiexec.exe File created C:\Windows\Installer\SourceHash{A2FC8FF0-021A-431C-826E-E4B85D3F064F} msiexec.exe File created C:\Windows\Installer\e5de3f3.msi msiexec.exe File created C:\Windows\Installer\e5de3d5.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI52A7.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{52ABF617-F7B4-40F9-8197-C7490DAA97A3} msiexec.exe File created C:\Windows\pyw.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI7C78.tmp msiexec.exe File created C:\Windows\Installer\e5de3cf.msi msiexec.exe File opened for modification C:\Windows\Installer\e5de3d0.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIEF56.tmp msiexec.exe File created C:\Windows\Installer\e5de3cb.msi msiexec.exe File created C:\Windows\Installer\e5de3d4.msi msiexec.exe File created C:\Windows\Installer\e5de3da.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIFC57.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI22EB.tmp msiexec.exe File opened for modification C:\Windows\Installer\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\idle.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI7999.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7CA8.tmp msiexec.exe -
Detects Pyinstaller 3 IoCs
resource yara_rule behavioral1/files/0x000b000000025ea5-46199.dat pyinstaller behavioral1/files/0x000c000000025ea6-46222.dat pyinstaller behavioral1/files/0x000d000000025ea6-46255.dat pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e5c2a4af95b248be0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e5c2a4af0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e5c2a4af000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de5c2a4af000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e5c2a4af00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 21 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133577479940373299" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell\open\command\ = "\"C:\\Windows\\py.exe\" \"%L\" %*" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Installer\Dependencies python-3.12.3-amd64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shellex msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\716FBA254B7F9F0418797C94D0AA793A\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFED3BF868D49884B9A0F07EEA097D9C\DeploymentFlags = "2" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D7C91534D075F640A9AA311D5372ECE\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}v3.12.3150.0\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.pyc msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6D0627389593B2545A75663620EB6A36\DefaultFeature msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" python.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\Shell\editwithidle\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\27932F84D2615EE56B3101F4136C7E98 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell python.exe Set value (data) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0 = 50003100000000009058126e100041646d696e003c0009000400efbe8c583d5c9058196e2e0000007fe10100000001000000000000000000000000000000d5dd0201410064006d0069006e00000014000000 chrome.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9785E4745D9A5FD43958DA7F2E42EC7C\Language = "1033" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\952F1BE8623138543B385F3C7D9CD3D7\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A7FEF575EF17E734190B3D38C80162AD\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\Shell\editwithidle\shell\edit312\command\ = "\"C:\\Program Files\\Python312\\pythonw.exe\" -m idlelib \"%L\" %*" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\716FBA254B7F9F0418797C94D0AA793A\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{52ABF617-F7B4-40F9-8197-C7490DAA97A3}v3.12.3150.0\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FFED3BF868D49884B9A0F07EEA097D9C msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D7C91534D075F640A9AA311D5372ECE\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FF8CF2AA120C13428E64E8BD5F360F4\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\DefaultIcon msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\716FBA254B7F9F0418797C94D0AA793A\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B70F0B1695A41135B8B478FEAE3703E9\0D7C91534D075F640A9AA311D5372ECE msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\716FBA254B7F9F0418797C94D0AA793A\SourceList\Net msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A7FEF575EF17E734190B3D38C80162AD\PackageCode = "2C1D5B965BE9C5C459E35F7F91215BBE" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\Shell\editwithidle\MUIVerb = "&Edit with IDLE" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg python.exe Set value (int) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\NodeSlot = "6" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.File\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell python.exe Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} python.exe Set value (int) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" python.exe Set value (int) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295" chrome.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\952F1BE8623138543B385F3C7D9CD3D7\DeploymentFlags = "2" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "5" chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",5" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" chrome.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9785E4745D9A5FD43958DA7F2E42EC7C\Version = "51121230" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\MUIVerb = "Edit with IDLE 3.12 (64-bit)" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.Extension\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.Extension\DefaultIcon\ = "\"C:\\Windows\\py.exe\",3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 chrome.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\952F1BE8623138543B385F3C7D9CD3D7\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2BE9381A03C3DCB4AAFC406FFFC609DC msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FF8CF2AA120C13428E64E8BD5F360F4\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shellex\DropHandler msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff python.exe Set value (str) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic" chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\27932F84D2615EE56B3101F4136C7E98\FFED3BF868D49884B9A0F07EEA097D9C msiexec.exe Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags python.exe Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\952F1BE8623138543B385F3C7D9CD3D7\SourceList\Media\1 = ";" msiexec.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 5056 NOTEPAD.EXE -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 1216 chrome.exe 1216 chrome.exe 4320 chrome.exe 4320 chrome.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 3600 msiexec.exe 968 powershell.exe 968 powershell.exe 968 powershell.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3400 chrome.exe 4436 OpenWith.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeCreatePagefilePrivilege 1216 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 4868 python-3.12.3-amd64.exe 1216 chrome.exe 1216 chrome.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe -
Suspicious use of SendNotifyMessage 54 IoCs
pid Process 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe -
Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 3748 python.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 4436 OpenWith.exe 4436 OpenWith.exe 4436 OpenWith.exe 4436 OpenWith.exe 4436 OpenWith.exe 4436 OpenWith.exe 4436 OpenWith.exe 4436 OpenWith.exe 4436 OpenWith.exe 4436 OpenWith.exe 4436 OpenWith.exe 4436 OpenWith.exe 4436 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1216 wrote to memory of 4292 1216 chrome.exe 83 PID 1216 wrote to memory of 4292 1216 chrome.exe 83 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 1720 1216 chrome.exe 85 PID 1216 wrote to memory of 4620 1216 chrome.exe 86 PID 1216 wrote to memory of 4620 1216 chrome.exe 86 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 PID 1216 wrote to memory of 1728 1216 chrome.exe 87 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bit.ly/triageshare20241⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95722ab58,0x7ff95722ab68,0x7ff95722ab782⤵PID:4292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:22⤵PID:1720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:4620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2220 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:12⤵PID:3528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:12⤵PID:1116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4176 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:12⤵PID:1544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4576 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4724 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:12⤵PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4900 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:12⤵PID:3540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3052 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:4300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5260 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4016 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:12⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4904 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:12⤵PID:3188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:3424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4204 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:12⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5428 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5444 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:1520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3972 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:5020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5448 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:3712
-
-
C:\Users\Admin\Downloads\python-3.12.3-amd64.exe"C:\Users\Admin\Downloads\python-3.12.3-amd64.exe"2⤵
- Executes dropped EXE
PID:4064 -
C:\Windows\Temp\{DA577ABB-D6A4-4CF0-977B-12D8F04ABDB9}\.cr\python-3.12.3-amd64.exe"C:\Windows\Temp\{DA577ABB-D6A4-4CF0-977B-12D8F04ABDB9}\.cr\python-3.12.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.3-amd64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=5683⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:4868 -
C:\Windows\Temp\{4EF51225-2377-4221-8757-C02D2919AEB0}\.be\python-3.12.3-amd64.exe"C:\Windows\Temp\{4EF51225-2377-4221-8757-C02D2919AEB0}\.be\python-3.12.3-amd64.exe" -q -burn.elevated BurnPipe.{AD2E6330-ECD9-4063-9569-4905DE526008} {ED60A9D4-333C-4144-9544-E6BAB5FF87DF} 48684⤵
- Executes dropped EXE
PID:4424 -
C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe"C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe" -3.12 -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"5⤵
- Executes dropped EXE
PID:4308 -
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:4884
-
-
-
C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe"C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe" -3.12 -O -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"5⤵
- Executes dropped EXE
PID:3344 -
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -O -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1600
-
-
-
C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe"C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe" -3.12 -OO -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"5⤵
- Executes dropped EXE
PID:4956 -
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -OO -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:4020
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=3952 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:12⤵PID:2684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5608 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:12⤵PID:4848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5148 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:12⤵PID:468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5660 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5796 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:3600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=5516 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:12⤵PID:5392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5936 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:6072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵PID:1700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 --field-trial-handle=1904,i,16273712707790129522,6763886053877670043,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3400
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2060
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3068
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:1840
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Registers COM server for autorun
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3600 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B724A5D9275333B912D61765312D2BFC2⤵
- Loads dropped DLL
PID:2820 -
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -E -s -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4212 -
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpd618s8ys\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpd618s8ys', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:4264
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:968 -
C:\Program Files\Python312\Scripts\pip.exe"C:\Program Files\Python312\Scripts\pip.exe" install auto-py-to-exe2⤵
- Executes dropped EXE
PID:2128 -
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Scripts\pip.exe" install auto-py-to-exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1788 -
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-h9m6b16e\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.04⤵
- Executes dropped EXE
PID:4828
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpesu3svmh4⤵
- Executes dropped EXE
PID:2920
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-h9m6b16e\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel4⤵
- Executes dropped EXE
PID:364
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpaxwved764⤵
- Executes dropped EXE
PID:2660
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-h4wm2b1i\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.04⤵
- Executes dropped EXE
PID:2676
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpo53pal0k4⤵
- Executes dropped EXE
PID:1176
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-h4wm2b1i\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel4⤵
- Executes dropped EXE
PID:224
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpwst8ckn94⤵
- Executes dropped EXE
PID:1876
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" build_wheel C:\Users\Admin\AppData\Local\Temp\tmp467xp6zf4⤵
- Executes dropped EXE
PID:4280
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" build_wheel C:\Users\Admin\AppData\Local\Temp\tmp5j2aphzl4⤵
- Executes dropped EXE
PID:1136
-
-
-
-
C:\Program Files\Python312\Scripts\auto-py-to-exe.exe"C:\Program Files\Python312\Scripts\auto-py-to-exe.exe"2⤵
- Executes dropped EXE
PID:1440 -
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Scripts\auto-py-to-exe.exe"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3748 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --app=http://localhost:63199/index.html --disable-http-cache4⤵
- Enumerates system info in registry
PID:3164 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95722ab58,0x7ff95722ab68,0x7ff95722ab785⤵PID:5708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=2016,i,2962144237771187594,10705656327688705972,131072 /prefetch:25⤵PID:5760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=2016,i,2962144237771187594,10705656327688705972,131072 /prefetch:85⤵PID:1568
-
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\PyInstaller\isolated\_child.py" 1540 15364⤵
- Executes dropped EXE
PID:4028
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\PyInstaller\isolated\_child.py" 3208 33164⤵
- Executes dropped EXE
PID:5232
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\PyInstaller\isolated\_child.py" 3344 29284⤵
- Executes dropped EXE
PID:660
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\PyInstaller\isolated\_child.py" 2928 31604⤵
- Executes dropped EXE
PID:3300
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\PyInstaller\isolated\_child.py" 3160 31924⤵
- Executes dropped EXE
PID:5024
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\PyInstaller\isolated\_child.py" 3192 31884⤵
- Executes dropped EXE
PID:6024
-
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\PyInstaller\isolated\_child.py" 3328 33604⤵
- Executes dropped EXE
PID:5388
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5300
-
C:\Users\Admin\output\runme.exe"C:\Users\Admin\output\runme.exe"1⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\output\runme.exe"C:\Users\Admin\output\runme.exe"2⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftSecurity64\main.py3⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftSecurity64\main.py4⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\MicrosoftSecurity64\main.py5⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\MicrosoftSecurity64\main.py6⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py7⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py8⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py9⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py10⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py11⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py12⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py13⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py14⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py15⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py16⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py17⤵
- Executes dropped EXE
PID:5644 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py18⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py19⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py20⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py21⤵
- Executes dropped EXE
PID:5384 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py22⤵
- Executes dropped EXE
PID:5700 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py23⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py24⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py25⤵
- Executes dropped EXE
PID:5828 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py26⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py27⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py28⤵
- Executes dropped EXE
PID:5428 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py29⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py30⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py31⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py32⤵
- Executes dropped EXE
PID:5856 -
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py33⤵PID:5304
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py34⤵PID:5224
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py35⤵PID:4688
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py36⤵PID:2796
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py37⤵PID:1604
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py38⤵PID:5024
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py39⤵PID:5020
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py40⤵PID:5128
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py41⤵PID:5444
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py42⤵PID:1828
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py43⤵PID:684
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py44⤵PID:5300
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py45⤵PID:5404
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py46⤵PID:5624
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py47⤵PID:3208
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py48⤵PID:6040
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py49⤵PID:4800
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py50⤵PID:556
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py51⤵PID:3404
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py52⤵PID:4904
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py53⤵PID:1596
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py54⤵PID:5656
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py55⤵PID:2176
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py56⤵PID:1696
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py57⤵PID:5252
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py58⤵PID:1992
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py59⤵PID:6032
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py60⤵PID:1028
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py61⤵PID:5488
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py62⤵PID:5792
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py63⤵PID:5780
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py64⤵PID:5676
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py65⤵PID:6132
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py66⤵PID:3840
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py67⤵PID:4820
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py68⤵PID:648
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py69⤵PID:1040
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py70⤵PID:1772
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py71⤵PID:4916
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py72⤵PID:5932
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py73⤵PID:4028
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py74⤵PID:4388
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py75⤵PID:448
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py76⤵PID:1684
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py77⤵PID:1964
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py78⤵PID:5220
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py79⤵PID:1176
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py80⤵PID:5468
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py81⤵PID:5372
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py82⤵PID:3100
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py83⤵PID:5824
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py84⤵PID:2896
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py85⤵PID:5548
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py86⤵PID:5572
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py87⤵PID:3092
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py88⤵PID:5684
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py89⤵PID:4020
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py90⤵PID:748
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py91⤵PID:900
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py92⤵PID:6008
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py93⤵PID:4952
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py94⤵PID:5264
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py95⤵PID:4956
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py96⤵PID:2764
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py97⤵PID:4800
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py98⤵PID:4788
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py99⤵PID:3404
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py100⤵PID:3228
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py101⤵PID:5200
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py102⤵PID:4016
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py103⤵PID:2548
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py104⤵PID:5920
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py105⤵PID:464
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py106⤵PID:364
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py107⤵PID:5488
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py108⤵PID:6084
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py109⤵PID:5960
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py110⤵PID:3840
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py111⤵PID:5812
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py112⤵PID:5240
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py113⤵PID:3660
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py114⤵PID:1616
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py115⤵PID:5888
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py116⤵PID:4028
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py117⤵PID:6120
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py118⤵PID:5224
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py119⤵PID:4816
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py120⤵PID:3364
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py121⤵PID:5636
-
C:\Users\Admin\output\runme.exeC:\Users\Admin\output\runme.exe C:\Users\Admin\output\main.py122⤵PID:3120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-