Analysis
- user interaction
yes - max time kernel
599s - max time network
541s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 03:02
General
- Target http://voicemeeter.org
- Sample260503-djkddsax5w
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 40 IoCs
Run Powershell to get system information as a root user.
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 17 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Enumerates processes with tasklist 1 TTPs 7 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 28 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Kills process with taskkill 21 IoCs
- Modifies data under HKEY_USERS 9 IoCs
- Modifies registry class 64 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 50 IoCs
- Suspicious use of SendNotifyMessage 16 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://voicemeeter.org1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x214,0x2f0,0x7ffc0dddc188,0x7ffc0dddc194,0x7ffc0dddc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,5773164788732835703,7837134993988894561,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,4432177327879457535,7506204514599943403,262144 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,194129059473956982,14732082502216778791,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,3789764664264001884,1597132687219667405,2097152 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,216516849279182499,2395635160429635496,2097152 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4872,i,4510249205733452881,8348815420586986774,2097152 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,9867124048289141853,18341722915251853478,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,1306203262687997588,6318742535646004443,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,9825475266057621825,246918922122778838,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,17158625381861437866,16934842131349754147,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,17158625381861437866,16934842131349754147,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,7007979799376603707,17370269764362145586,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6352,i,15965320356977953652,10426299437660157705,2097152 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,1855677400698313114,16265338880489531405,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,6524747727965012995,17791317258726273958,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=568,i,2327343752750310744,7499408187081287191,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,8945124460361459343,5833749761226348512,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,10695427044430702612,10510579931846425091,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,2288122849341876100,16534665090704009289,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,5034256282198444222,8219052095024761886,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4968,i,8658008628020324276,5082406033322899474,2097152 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5020,i,1921777357762330359,1968504762780371586,2097152 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4904,i,4671562890961474024,15678170891375277547,2097152 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6852,i,6625306003945487170,17652714253936938630,2097152 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7704,i,1636568464767109858,12857455185409551324,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6380,i,8212192523724282607,10893351797892306543,262144 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7684,i,9549120077312792037,16372988417357858890,2097152 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7496,i,3822459326374858720,4876617893398741717,524288 --field-trial-handle=2060,i,6891771438807079141,13023833306750516801,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Voicemeeter_Drivers.zip\Voicemeeter_Drivers\VoicemeeterSetup_x64.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Voicemeeter_Drivers.zip\Voicemeeter_Drivers\VoicemeeterSetup_x64.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Voicemeeter.exe" /FO csv | "C:\Windows\system32\find.exe" "Voicemeeter.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Voicemeeter.exe" /FO csv3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\find.exe"C:\Windows\system32\find.exe" "Voicemeeter.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\voicemeeter\Voicemeeter.exe"C:\Users\Admin\AppData\Local\Programs\voicemeeter\Voicemeeter.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "openssl version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "npm -v"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "yarn --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "brew --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "git --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "mysql -V"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "php -v"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "redis-server --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "docker --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "mongod --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "perl -v"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"2⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -V3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"2⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython3 -V3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"2⤵
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -version3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "bash --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "zsh --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "fish --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "bun -v"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "deno -v"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "node -v"2⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Programs\voicemeeter\Voicemeeter.exe"C:\Users\Admin\AppData\Local\Programs\voicemeeter\Voicemeeter.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\voicemeeter" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2552 --field-trial-handle=2556,i,17452564463322072254,7770449018917401903,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\voicemeeter\Voicemeeter.exe"C:\Users\Admin\AppData\Local\Programs\voicemeeter\Voicemeeter.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\voicemeeter" --mojo-platform-channel-handle=2720 --field-trial-handle=2556,i,17452564463322072254,7770449018917401903,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "gcc --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM kometa.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM orbitum.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM centbrowser.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM 7star.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sputnik.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM epicprivacybrowser.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic product get name,version,vendor,installDate /format:list3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM uran.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM yandex.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM iridium.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM tor.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM waterfox.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM waterfox.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM arc.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM arc.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"2⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"2⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall show allprofiles state3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA"2⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
-
C:\Windows\system32\net.exenet session3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA="2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA=3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"2⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet3⤵
- Checks processor information in registry
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"2⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""2⤵
-
C:\Windows\system32\findstr.exefindstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "route print"2⤵
-
C:\Windows\system32\ROUTE.EXEroute print3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic service get name,displayName,state,startMode,pathName /format:list"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic service get name,displayName,state,startMode,pathName /format:list3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet3⤵
- Checks processor information in registry
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"2⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""2⤵
-
C:\Windows\system32\findstr.exefindstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "py -3 --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "py --version"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "python --version"2⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython --version3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "python3 --version"2⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython3 --version3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0"2⤵
-
C:\Users\Admin\AppData\Local\Temp\python312_installer.exe"C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{FE50B59C-D5D0-4F1A-A0F8-1E70032F2A86}\.cr\python312_installer.exe"C:\Windows\Temp\{FE50B59C-D5D0-4F1A-A0F8-1E70032F2A86}\.cr\python312_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" -burn.filehandle.attached=580 -burn.filehandle.self=732 /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=04⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=1 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0"2⤵
-
C:\Users\Admin\AppData\Local\Temp\python312_installer.exe"C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=1 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{2FF00783-195B-400D-94A5-C6CD640D4835}\.cr\python312_installer.exe"C:\Windows\Temp\{2FF00783-195B-400D-94A5-C6CD640D4835}\.cr\python312_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" -burn.filehandle.attached=580 -burn.filehandle.self=732 /quiet InstallAllUsers=1 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=04⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\Temp\{037D7002-0412-46B5-9BD3-EC1A42904CEA}\.be\python-3.12.10-amd64.exe"C:\Windows\Temp\{037D7002-0412-46B5-9BD3-EC1A42904CEA}\.be\python-3.12.10-amd64.exe" -q -burn.elevated BurnPipe.{E9B0DE1B-800E-4498-B598-BADEC4990C15} {DACD0A80-306E-471C-8E44-95B53E80DF0E} 62485⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\voicemeeter\Voicemeeter.exe"C:\Users\Admin\AppData\Local\Programs\voicemeeter\Voicemeeter.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\voicemeeter" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2264 --field-trial-handle=2556,i,17452564463322072254,7770449018917401903,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" --version"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" --version3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pythonforwindows3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome"2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir pycryptodome3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py""2⤵
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\verify_deps.py"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM javaw.exe /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM EpicGamesLauncher.exe /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM Steam.exe /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "sc config node DisplayName= "Windows System Helper""2⤵
-
C:\Windows\system32\sc.exesc config node DisplayName= "Windows System Helper"3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i svchost.exe"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\findstr.exefindstr /i svchost.exe3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i winlogon.exe"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\findstr.exefindstr /i winlogon.exe3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i services.exe"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\findstr.exefindstr /i services.exe3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i explorer.exe"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\findstr.exefindstr /i explorer.exe3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i dllhost.exe"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\findstr.exefindstr /i dllhost.exe3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i taskhostw.exe"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\findstr.exefindstr /i taskhostw.exe3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 87DF0EDB7372070773221C1B35063F192⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -I -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpviqxc00q\\pip-25.0.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpviqxc00q', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FEA887DE055D75873F91A8F63AE26A102⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files\Python312\python.exe"C:\Program Files\Python312\python.exe" -I -B -m ensurepip._uninstall3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20260503040633.log" InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=02⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20260503040633.log" InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=03⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
5System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Wi-Fi Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e5c11ae.rbs
e5c11b3.rbs
e5c11b8.rbs
e5c11bd.rbs
e5c11c2.rbs
e5c11c7.rbs
e5c11cb.rbs
e5c11ce.rbf
e5c11cf.rbf
e5c11d0.rbf
e5c11d1.rbf
e5c11d2.rbf
e5c11d3.rbf
e5c11d4.rbf
e5c11d5.rbf
e5c11d6.rbf
e5c11d7.rbf
e5c11d8.rbf
e5c11d9.rbf
e5c11da.rbf
e5c11db.rbf
e5c11dc.rbf
e5c11dd.rbf
e5c11de.rbf
e5c11df.rbf
e5c11e0.rbf
e5c11e1.rbf
e5c11e2.rbf
e5c11e3.rbf
e5c11e4.rbf
e5c11e5.rbf
e5c11e6.rbf
e5c11e7.rbf
e5c11e8.rbf
e5c11e9.rbf
e5c11ea.rbf
e5c11eb.rbf
e5c11ec.rbf
e5c11ed.rbf
e5c11ee.rbf
e5c11ef.rbf
e5c11f0.rbf
e5c11f1.rbf
e5c11f2.rbf
e5c11f3.rbf
e5c11f4.rbf
e5c11f5.rbf
e5c11f6.rbf
e5c11f7.rbf
e5c11f8.rbf
e5c11f9.rbf
e5c11fa.rbf
e5c11fb.rbf
e5c11fc.rbf
e5c11fd.rbf
e5c11fe.rbf
e5c11ff.rbf
e5c1200.rbf
e5c1201.rbf
e5c1202.rbf
e5c1203.rbf
e5c1204.rbf
e5c1205.rbf
e5c1207.rbf
e5c1208.rbf
e5c1209.rbf
e5c120a.rbf
e5c120b.rbf
e5c120c.rbf
e5c120d.rbf
e5c120e.rbf
e5c120f.rbf
e5c1210.rbf
e5c1211.rbf
e5c1212.rbf
e5c1213.rbf
e5c1214.rbf
e5c1215.rbf
e5c1216.rbf
e5c1217.rbf
e5c1218.rbf
e5c1219.rbf
e5c121a.rbf
e5c121b.rbf
e5c121c.rbf
e5c121d.rbf
e5c121e.rbf
e5c121f.rbf
e5c1220.rbf
e5c1221.rbf
e5c1222.rbf
e5c1223.rbf
e5c1224.rbf
e5c1225.rbf
e5c1226.rbf
e5c1227.rbf
e5c1228.rbf
e5c1229.rbf
e5c122a.rbf
e5c122b.rbf
e5c122c.rbf
e5c122d.rbf
e5c122e.rbf
e5c122f.rbf
e5c1230.rbf
e5c1231.rbf
e5c1232.rbf
e5c1233.rbf
e5c1234.rbf
e5c1235.rbf
e5c1236.rbf
e5c1237.rbf
e5c1238.rbf
e5c1239.rbf
e5c123a.rbf
e5c123b.rbf
e5c123c.rbf
e5c123d.rbf
e5c123e.rbf
e5c123f.rbf
e5c1240.rbf
e5c1241.rbf
e5c1242.rbf
e5c1243.rbf
e5c1244.rbf
e5c1245.rbf
e5c1246.rbf
e5c1247.rbf
e5c1248.rbf
e5c1249.rbf
e5c124a.rbf
e5c124b.rbf
e5c124c.rbf
e5c124d.rbf
e5c124e.rbf
e5c124f.rbf
e5c1250.rbf
e5c1251.rbf
e5c1252.rbf
e5c1253.rbf
e5c1254.rbf
e5c1255.rbf
e5c1256.rbf
e5c1257.rbf
e5c1258.rbf
e5c1259.rbf
e5c125a.rbf
e5c125b.rbf
e5c125c.rbf
e5c125d.rbf
e5c125e.rbf
e5c125f.rbf
e5c1260.rbf
e5c1261.rbf
e5c1262.rbf
e5c1263.rbf
e5c1264.rbf
e5c1265.rbf
e5c1266.rbf
e5c1267.rbf
e5c1268.rbf
e5c1269.rbf
e5c126a.rbf
e5c126b.rbf
e5c126c.rbf
e5c126d.rbf
e5c126e.rbf
e5c126f.rbf
e5c1270.rbf
e5c1271.rbf
e5c1272.rbf
e5c1273.rbf
e5c1274.rbf
e5c1275.rbf
e5c1276.rbf
e5c1277.rbf
e5c1278.rbf
e5c1279.rbf
e5c127a.rbf
e5c127b.rbf
e5c127c.rbf
e5c127d.rbf
e5c127e.rbf
e5c127f.rbf
e5c1280.rbf
e5c1281.rbf
e5c1282.rbf
e5c1283.rbf
e5c1284.rbf
e5c1285.rbf
e5c1286.rbf
e5c1287.rbf
e5c1288.rbf
e5c1289.rbf
e5c128a.rbf
e5c128b.rbf
e5c128c.rbf
e5c128d.rbf
e5c128e.rbf
e5c128f.rbf
e5c1290.rbf
e5c1291.rbf
e5c1292.rbf
e5c1293.rbf
e5c1294.rbf
e5c1295.rbf
e5c1296.rbf
e5c1297.rbf
e5c1298.rbf
e5c1299.rbf
e5c129a.rbf
e5c129b.rbf
e5c129c.rbf
e5c129d.rbf
e5c129e.rbf
e5c129f.rbf
e5c12a0.rbf
e5c12a1.rbf
e5c12a2.rbf
e5c12a3.rbf
e5c12a4.rbf
e5c12a5.rbf
e5c12a6.rbf
e5c12a7.rbf
e5c12a8.rbf
e5c12a9.rbf
e5c12aa.rbf
e5c12ab.rbf
e5c12ac.rbf
e5c12ad.rbf
e5c12ae.rbf
e5c12af.rbf
e5c12b0.rbf
e5c12b1.rbf
e5c12b2.rbf
e5c12b3.rbf
e5c12b4.rbf
e5c12b5.rbf
e5c12b6.rbf
e5c12b7.rbf
e5c12b8.rbf
e5c12b9.rbf
e5c12ba.rbf
e5c12bb.rbf
e5c12bc.rbf
e5c12bd.rbf
e5c12be.rbf
e5c12bf.rbf
e5c12c0.rbf
e5c12c1.rbf
e5c12c2.rbf
e5c12c3.rbf
e5c12c4.rbf
e5c12c5.rbf
e5c12c6.rbf
e5c12c7.rbf
e5c12c8.rbf
e5c12c9.rbf
e5c12ca.rbf
e5c12cb.rbf
e5c12cc.rbf
e5c12cd.rbf
e5c12ce.rbf
e5c12cf.rbf
e5c12d0.rbf
e5c12d1.rbf
e5c12d2.rbf
e5c12d3.rbf
e5c12d4.rbf
e5c12d5.rbf
e5c12d6.rbf
e5c12d7.rbf
e5c12d8.rbf
e5c12d9.rbf
e5c12da.rbf
e5c12db.rbf
e5c12dc.rbf
e5c12dd.rbf
e5c12de.rbf
e5c12df.rbf
e5c12e0.rbf
e5c12e1.rbf
e5c12e2.rbf
e5c12e3.rbf
e5c12e4.rbf
e5c12e5.rbf
e5c12e6.rbf
e5c12e7.rbf
e5c12e8.rbf
e5c12e9.rbf
e5c12ea.rbf
e5c12eb.rbf
e5c12ec.rbf
e5c12ed.rbf
e5c12ee.rbf
e5c12ef.rbf
e5c12f0.rbf
e5c12f1.rbf
e5c12f2.rbf
e5c12f3.rbf
e5c12f4.rbf
e5c12f5.rbf
e5c12f6.rbf
e5c12f7.rbf
e5c12f8.rbf
e5c12f9.rbf
e5c12fa.rbf
e5c12fb.rbf
e5c12fc.rbf
e5c12fd.rbf
e5c12fe.rbf
e5c12ff.rbf
e5c1300.rbf
e5c1301.rbf
e5c1302.rbf
e5c1303.rbf
e5c1304.rbf
e5c1305.rbf
e5c1306.rbf
e5c1307.rbf
e5c1308.rbf
e5c1309.rbf
e5c130a.rbf
e5c130b.rbf
e5c130c.rbf
e5c130d.rbf
e5c130e.rbf
e5c130f.rbf
e5c1310.rbf
e5c1311.rbf
e5c1312.rbf
e5c1313.rbf
e5c1314.rbf
e5c1315.rbf
e5c1316.rbf
e5c1317.rbf
e5c1318.rbf
e5c1319.rbf
e5c131a.rbf
e5c131b.rbf
e5c131c.rbf
e5c131d.rbf
e5c131e.rbf
e5c131f.rbf
e5c1320.rbf
e5c1321.rbf
e5c1322.rbf
e5c1323.rbf
e5c1324.rbf
e5c1325.rbf
e5c1326.rbf
e5c1327.rbf
e5c1328.rbf
e5c1329.rbf
e5c132a.rbf
e5c132b.rbf
e5c132c.rbf
e5c132d.rbf
e5c132e.rbf
e5c132f.rbf
e5c1330.rbf
e5c1331.rbf
e5c1332.rbf
e5c1333.rbf
e5c1334.rbf
e5c1335.rbf
e5c1336.rbf
e5c1337.rbf
e5c1338.rbf
e5c1339.rbf
e5c133a.rbf
e5c133b.rbf
e5c133c.rbf
e5c133d.rbf
e5c133e.rbf
e5c133f.rbf
e5c1340.rbf
e5c1341.rbf
e5c1342.rbf
e5c1343.rbf
e5c1344.rbf
e5c1345.rbf
e5c1346.rbf
e5c1347.rbf
e5c1348.rbf
e5c1349.rbf
e5c134a.rbf
e5c134b.rbf
e5c134c.rbf
e5c134d.rbf
e5c134e.rbf
e5c134f.rbf
e5c1350.rbf
e5c1351.rbf
e5c1352.rbf
e5c1353.rbf
e5c1354.rbf
e5c1355.rbf
e5c1356.rbf
e5c1357.rbf
e5c1358.rbf
e5c1359.rbf
e5c135a.rbf
e5c135b.rbf
e5c135c.rbf
e5c135d.rbf
e5c135e.rbf
e5c135f.rbf
e5c1360.rbf
e5c1361.rbf
e5c1362.rbf
e5c1363.rbf
e5c1364.rbf
e5c1365.rbf
e5c1366.rbf
e5c1367.rbf
e5c1368.rbf
e5c1369.rbf
e5c136a.rbf
e5c136b.rbf
e5c136c.rbf
e5c136d.rbf
e5c136e.rbf
e5c136f.rbf
e5c1370.rbf
e5c1371.rbf
e5c1372.rbf
e5c1373.rbf
e5c1374.rbf
e5c1375.rbf
e5c1376.rbf
e5c1377.rbf
e5c1378.rbf
e5c1379.rbf
e5c137a.rbf
e5c137b.rbf
e5c137c.rbf
e5c137d.rbf
e5c137e.rbf
e5c137f.rbf
e5c1380.rbf
e5c1381.rbf
e5c1382.rbf
e5c1383.rbf
e5c1384.rbf
e5c1385.rbf
e5c1386.rbf
e5c1387.rbf
e5c1388.rbf
e5c1389.rbf
e5c138a.rbf
e5c138b.rbf
e5c138c.rbf
e5c138d.rbf
e5c138e.rbf
e5c138f.rbf
e5c1390.rbf
e5c1391.rbf
e5c1392.rbf
e5c1393.rbf
e5c1394.rbf
e5c1395.rbf
e5c1396.rbf
e5c1397.rbf
e5c1398.rbf
e5c1399.rbf
e5c139a.rbf
e5c139b.rbf
e5c139c.rbf
e5c139d.rbf
e5c139e.rbf
e5c139f.rbf
e5c13a0.rbf
e5c13a1.rbf
e5c13a2.rbf
e5c13a3.rbf
e5c13a4.rbf
e5c13a5.rbf
e5c13a6.rbf
e5c13a7.rbf
e5c13a8.rbf
e5c13a9.rbf
e5c13aa.rbf
e5c13ab.rbf
e5c13ac.rbf
e5c13ad.rbf
e5c13ae.rbf
e5c13af.rbf
e5c13b0.rbf
e5c13b1.rbf
e5c13b2.rbf
e5c13b3.rbf
e5c13b4.rbf
e5c13b5.rbf
e5c13b6.rbf
e5c13b7.rbf
e5c13b8.rbf
e5c13b9.rbf
e5c13ba.rbf
e5c13bb.rbf
e5c13bc.rbf
e5c13bd.rbf
e5c13be.rbf
e5c13bf.rbf
e5c13c0.rbf
e5c13c1.rbf
e5c13c2.rbf
e5c13c3.rbf
e5c13c4.rbf
e5c13c5.rbf
e5c13c6.rbf
e5c13c7.rbf
e5c13c8.rbf
e5c13c9.rbf
e5c13ca.rbf
e5c13cb.rbf
e5c13cc.rbf
e5c13cd.rbf
e5c13ce.rbf
e5c13cf.rbf
e5c13d0.rbf
e5c13d1.rbf
e5c13d2.rbf
e5c13d3.rbf
e5c13d4.rbf
e5c13d5.rbf
e5c13d6.rbf
e5c13d7.rbf
e5c13d8.rbf
e5c13d9.rbf
e5c13da.rbf
e5c13db.rbf
e5c13dc.rbf
e5c13dd.rbf
e5c13de.rbf
e5c13df.rbf
e5c13e0.rbf
e5c13e1.rbf
e5c13e2.rbf
e5c13e3.rbf
e5c13e4.rbf
e5c13e5.rbf
e5c13e6.rbf
e5c13e7.rbf
e5c13e8.rbf
e5c13e9.rbf
e5c13ea.rbf
e5c13eb.rbf
e5c13ec.rbf
e5c13ed.rbf
e5c13ee.rbf
e5c13ef.rbf
e5c13f0.rbf
e5c13f1.rbf
e5c13f2.rbf
e5c13f3.rbf
e5c13f4.rbf
e5c13f5.rbf
e5c13f6.rbf
e5c13f7.rbf
e5c13f8.rbf
e5c13f9.rbf
e5c13fa.rbf
e5c13fb.rbf
e5c13fc.rbf
e5c13fd.rbf
e5c13fe.rbf
e5c13ff.rbf
e5c1400.rbf
e5c1401.rbf
e5c1402.rbf
e5c1403.rbf
e5c1404.rbf
e5c1405.rbf
e5c1406.rbf
e5c1407.rbf
e5c1408.rbf
e5c1409.rbf
e5c140a.rbf
e5c140b.rbf
e5c140c.rbf
e5c140d.rbf
e5c140e.rbf
e5c140f.rbf
e5c1410.rbf
e5c1411.rbf
e5c1412.rbf
e5c1413.rbf
e5c1414.rbf
e5c1415.rbf
e5c1416.rbf
e5c1417.rbf
e5c1418.rbf
e5c1419.rbf
e5c141a.rbf
e5c141b.rbf
e5c141c.rbf
e5c141d.rbf
e5c141e.rbf
e5c141f.rbf
e5c1420.rbf
e5c1421.rbf
e5c1422.rbf
e5c1423.rbf
e5c1424.rbf
e5c1425.rbf
e5c1426.rbf
e5c1427.rbf
e5c1428.rbf
e5c1429.rbf
e5c142a.rbf
e5c142b.rbf
e5c142c.rbf
e5c142d.rbf
e5c142e.rbf
e5c142f.rbf
e5c1430.rbf
e5c1431.rbf
e5c1432.rbf
e5c1433.rbf
e5c1434.rbf
e5c1435.rbf
e5c1436.rbf
e5c1437.rbf
e5c1438.rbf
e5c1439.rbf
e5c143a.rbf
e5c143b.rbf
e5c143c.rbf
e5c143d.rbf
e5c143e.rbf
e5c143f.rbf
e5c1440.rbf
e5c1441.rbf
e5c1442.rbf
e5c1443.rbf
e5c1444.rbf
e5c1445.rbf
e5c1446.rbf
e5c1447.rbf
e5c1448.rbf
e5c1449.rbf
e5c144a.rbf
e5c144b.rbf
e5c144c.rbf
e5c144d.rbf
e5c144e.rbf
e5c144f.rbf
e5c1450.rbf
e5c1451.rbf
e5c1452.rbf
e5c1453.rbf
e5c1454.rbf
e5c1455.rbf
e5c1456.rbf
e5c1457.rbf
e5c1458.rbf
e5c1459.rbf
e5c145a.rbf
e5c145b.rbf
e5c145c.rbf
e5c145d.rbf
e5c145e.rbf
e5c145f.rbf
e5c1460.rbf
e5c1461.rbf
e5c1462.rbf
e5c1463.rbf
e5c1464.rbf
e5c1465.rbf
e5c1466.rbf
e5c1467.rbf
e5c1468.rbf
e5c1469.rbf
e5c146a.rbf
e5c146b.rbf
e5c146c.rbf
e5c146d.rbf
e5c146e.rbf
e5c146f.rbf
e5c1470.rbf
e5c1471.rbf
e5c1472.rbf
e5c1473.rbf
e5c1474.rbf
e5c1475.rbf
e5c1476.rbf
e5c1477.rbf
e5c1478.rbf
e5c1479.rbf
e5c147a.rbf
e5c147b.rbf
e5c147c.rbf
e5c147d.rbf
e5c147e.rbf
e5c147f.rbf
e5c1480.rbf
e5c1481.rbf
e5c1482.rbf
e5c1483.rbf
e5c1484.rbf
e5c1485.rbf
e5c1486.rbf
e5c1487.rbf
e5c1488.rbf
e5c1489.rbf
e5c148a.rbf
e5c148b.rbf
e5c148c.rbf
e5c148d.rbf
e5c148e.rbf
e5c148f.rbf
e5c1490.rbf
e5c1491.rbf
e5c1492.rbf
e5c1493.rbf
e5c1494.rbf
e5c1495.rbf
e5c1496.rbf
e5c1497.rbf
e5c1498.rbf
e5c1499.rbf
e5c149a.rbf
e5c149b.rbf
e5c149c.rbf
e5c149d.rbf
e5c149e.rbf
e5c149f.rbf
e5c14a0.rbf
e5c14a1.rbf
e5c14a2.rbf
e5c14a3.rbf
e5c14a4.rbf
e5c14a5.rbf
e5c14a6.rbf
e5c14a7.rbf
e5c14a8.rbf
e5c14a9.rbf
e5c14aa.rbf
e5c14ab.rbf
e5c14ac.rbf
e5c14ad.rbf
e5c14ae.rbf
e5c14af.rbf
e5c14b0.rbf
e5c14b1.rbf
e5c14b2.rbf
e5c14b3.rbf
e5c14b4.rbf
e5c14b5.rbf
e5c14b6.rbf
e5c14b7.rbf
e5c14b8.rbf
e5c14b9.rbf
e5c14ba.rbf
e5c14bb.rbf
e5c14bc.rbf
e5c14bd.rbf
e5c14be.rbf
e5c14bf.rbf
e5c14c0.rbf
e5c14c1.rbf
e5c14c2.rbf
e5c14c3.rbf
e5c14c4.rbf
e5c14c5.rbf
e5c14c6.rbf
e5c14c7.rbf
e5c14c8.rbf
e5c14c9.rbf
e5c14ca.rbf
e5c14cb.rbf
e5c14cc.rbf
e5c14cd.rbf
e5c14ce.rbf
e5c14cf.rbf
e5c14d0.rbf
e5c14d1.rbf
e5c14d2.rbf
e5c14d3.rbf
e5c14d4.rbf
e5c14d5.rbf
e5c14d6.rbf
e5c14d7.rbf
e5c14d8.rbf
e5c14d9.rbf
e5c14da.rbf
e5c14db.rbf
e5c14dc.rbf
e5c14dd.rbf
e5c14de.rbf
e5c14df.rbf
e5c14e0.rbf
e5c14e1.rbf
e5c14e2.rbf
e5c14e3.rbf
e5c14e4.rbf
e5c14e5.rbf
e5c14e6.rbf
e5c14e7.rbf
e5c14e8.rbf
e5c14e9.rbf
e5c14ea.rbf
e5c14eb.rbf
e5c14ec.rbf
e5c14ed.rbf
e5c14ee.rbf
e5c14ef.rbf
e5c14f0.rbf
e5c14f1.rbf
e5c14f2.rbf
e5c14f3.rbf
e5c14f4.rbf
e5c14f5.rbf
e5c14f6.rbf
e5c14f7.rbf
e5c14f8.rbf
e5c14f9.rbf
e5c14fa.rbf
e5c14fb.rbf
e5c14fc.rbf
e5c14fd.rbf
e5c14fe.rbf
e5c14ff.rbf
e5c1500.rbf
e5c1501.rbf
e5c1502.rbf
e5c1503.rbf
e5c1504.rbf
e5c1505.rbf
e5c1506.rbf
e5c1507.rbf
e5c1508.rbf
e5c1509.rbf
e5c150a.rbf
e5c150b.rbf
e5c150c.rbf
e5c150d.rbf
e5c150e.rbf
e5c150f.rbf
e5c1510.rbf
e5c1511.rbf
e5c1512.rbf
e5c1513.rbf
e5c1514.rbf
e5c1515.rbf
e5c1516.rbf
e5c1517.rbf
e5c1518.rbf
e5c1519.rbf
e5c151a.rbf
e5c151b.rbf
e5c151c.rbf
e5c151d.rbf
e5c151e.rbf
e5c151f.rbf
e5c1520.rbf
e5c1521.rbf
e5c1522.rbf
e5c1523.rbf
e5c1524.rbf
e5c1525.rbf
e5c1526.rbf
e5c1527.rbf
e5c1528.rbf
e5c1529.rbf
e5c152a.rbf
e5c152b.rbf
e5c152c.rbf
e5c152d.rbf
e5c152e.rbf
e5c152f.rbf
e5c1530.rbf
e5c1531.rbf
e5c1532.rbf
e5c1533.rbf
e5c1534.rbf
e5c1535.rbf
e5c1536.rbf
e5c1537.rbf
e5c1538.rbf
e5c1539.rbf
e5c153a.rbf
e5c153b.rbf
e5c153c.rbf
e5c153d.rbf
e5c153e.rbf
e5c153f.rbf
e5c1540.rbf
e5c1541.rbf
e5c1542.rbf
e5c1543.rbf
e5c1544.rbf
e5c1545.rbf
e5c1546.rbf
e5c1547.rbf
e5c1548.rbf
e5c1549.rbf
e5c154a.rbf
e5c154b.rbf
e5c154c.rbf
e5c154d.rbf
e5c154e.rbf
e5c154f.rbf
e5c1550.rbf
e5c1551.rbf
e5c1552.rbf
e5c1553.rbf
e5c1554.rbf
e5c1555.rbf
e5c1556.rbf
e5c1557.rbf
e5c1558.rbf
e5c1559.rbf
e5c155a.rbf
e5c155b.rbf
e5c155c.rbf
e5c155d.rbf
e5c155e.rbf
e5c155f.rbf
e5c1560.rbf
e5c1561.rbf
e5c1562.rbf
e5c1563.rbf
e5c1564.rbf
e5c1565.rbf
e5c1566.rbf
e5c1567.rbf
e5c1568.rbf
e5c1569.rbf
e5c156a.rbf
e5c156b.rbf
e5c156c.rbf
e5c156d.rbf
e5c156e.rbf
e5c156f.rbf
e5c1570.rbf
e5c1571.rbf
e5c1572.rbf
e5c1573.rbf
e5c1576.rbf
e5c1577.rbf
e5c1578.rbf
e5c1579.rbf
e5c157a.rbf
e5c157d.rbf
e5c157e.rbf
e5c157f.rbf
e5c1580.rbf
e5c1581.rbf
e5c1582.rbf
e5c1583.rbf
e5c1584.rbf
e5c1585.rbf
e5c1586.rbf
e5c1587.rbf
e5c1588.rbf
e5c1589.rbf
e5c158a.rbf
e5c158b.rbf
e5c158c.rbf
e5c158d.rbf
e5c158e.rbf
e5c158f.rbf
e5c1590.rbf
e5c1591.rbf
e5c1592.rbf
e5c1593.rbf
e5c1594.rbf
e5c1595.rbf
e5c1596.rbf
e5c1597.rbf
e5c1598.rbf
e5c1599.rbf
e5c159a.rbf
e5c159b.rbf
e5c159c.rbf
e5c159d.rbf
e5c159e.rbf
e5c159f.rbf
e5c15a0.rbf
e5c15a1.rbf
e5c15a2.rbf
e5c15a3.rbf
e5c15a4.rbf
e5c15a5.rbf
e5c15a6.rbf
e5c15a7.rbf
e5c15a8.rbf
e5c15a9.rbf
e5c15aa.rbf
e5c15ab.rbf
e5c15ac.rbf
e5c15ad.rbf
e5c15ae.rbf
e5c15af.rbf
e5c15b0.rbf
e5c15b1.rbf
e5c15b2.rbf
e5c15b3.rbf
e5c15b4.rbf
e5c15b5.rbf
e5c15b6.rbf
e5c15b7.rbf
e5c15b8.rbf
e5c15b9.rbf
e5c15ba.rbf
e5c15bb.rbf
e5c15bc.rbf
e5c15bd.rbf
e5c15be.rbf
e5c15bf.rbf
e5c15c0.rbf
e5c15c1.rbf
e5c15c2.rbf
e5c15c3.rbf
e5c15c4.rbf
e5c15c5.rbf
e5c15c6.rbf
e5c15c7.rbf
e5c15c8.rbf
e5c15c9.rbf
e5c15ca.rbf
e5c15cb.rbf
e5c15cc.rbf
e5c15cd.rbf
e5c15ce.rbf
e5c15cf.rbf
e5c15d0.rbf
e5c15d1.rbf
e5c15d2.rbf
e5c15d3.rbf
e5c15d4.rbf
e5c15d5.rbf
e5c15d6.rbf
e5c15d7.rbf
e5c15d8.rbf
e5c15d9.rbf
e5c15da.rbf
e5c15db.rbf
e5c15dc.rbf
e5c15dd.rbf
e5c15de.rbf
e5c15df.rbf
e5c15e0.rbf
e5c15e1.rbf
e5c15e2.rbf
e5c15e3.rbf
e5c15e4.rbf
e5c15e5.rbf
e5c15e6.rbf
e5c15e7.rbf
e5c15e8.rbf
e5c15e9.rbf
e5c15ea.rbf
e5c15eb.rbf
e5c15ec.rbf
e5c15ed.rbf
e5c15ee.rbf
e5c15ef.rbf
e5c15f0.rbf
e5c15f1.rbf
e5c15f2.rbf
e5c15f3.rbf
e5c15f4.rbf
e5c15f5.rbf
e5c15f6.rbf
e5c15f7.rbf
e5c15f8.rbf
e5c15f9.rbf
e5c15fa.rbf
e5c15fb.rbf
e5c15fc.rbf
e5c15fd.rbf
e5c15fe.rbf
e5c15ff.rbf
e5c1600.rbf
e5c1601.rbf
e5c1602.rbf
e5c1603.rbf
e5c1604.rbf
e5c1605.rbf
e5c1606.rbf
e5c1607.rbf
e5c1608.rbf
e5c1609.rbf
e5c160a.rbf
e5c160b.rbf
e5c160c.rbf
e5c160d.rbf
e5c160e.rbf
e5c160f.rbf
e5c1610.rbf
e5c1611.rbf
e5c1612.rbf
e5c1613.rbf
e5c1614.rbf
e5c1615.rbf
e5c1616.rbf
e5c1617.rbf
e5c1618.rbf
e5c1619.rbf
e5c161a.rbf
e5c161b.rbf
e5c161c.rbf
e5c161d.rbf
e5c161e.rbf
e5c161f.rbf
e5c1620.rbf
e5c1621.rbf
e5c1622.rbf
e5c1623.rbf
e5c1624.rbf
e5c1625.rbf
e5c1626.rbf
e5c1627.rbf
e5c1628.rbf
e5c1629.rbf
e5c162a.rbf
e5c162b.rbf
e5c162c.rbf
e5c162d.rbf
e5c162e.rbf
e5c162f.rbf
e5c1630.rbf
e5c1631.rbf
e5c1632.rbf
e5c1633.rbf
e5c1634.rbf
e5c1635.rbf
e5c1636.rbf
e5c1637.rbf
e5c1638.rbf
e5c1639.rbf
e5c163a.rbf
e5c163b.rbf
e5c163c.rbf
e5c163d.rbf
e5c163e.rbf
e5c163f.rbf
e5c1640.rbf
e5c1641.rbf
e5c1642.rbf
e5c1643.rbf
e5c1644.rbf
e5c1645.rbf
e5c1646.rbf
e5c1647.rbf
e5c1648.rbf
e5c1649.rbf
e5c164a.rbf
e5c164b.rbf
e5c164c.rbf
e5c164d.rbf
e5c164e.rbf
e5c164f.rbf
e5c1650.rbf
e5c1651.rbf
e5c1652.rbf
e5c1653.rbf
e5c1654.rbf
e5c1655.rbf
e5c1656.rbf
e5c1657.rbf
e5c1658.rbf
e5c1659.rbf
e5c165a.rbf
e5c165b.rbf
e5c165c.rbf
e5c165d.rbf
e5c165e.rbf
e5c165f.rbf
e5c1660.rbf
e5c1661.rbf
e5c1662.rbf
e5c1663.rbf
e5c1664.rbf
e5c1665.rbf
e5c1666.rbf
e5c1667.rbf
e5c1668.rbf
e5c1669.rbf
e5c166a.rbf
e5c166b.rbf
e5c166c.rbf
e5c166d.rbf
e5c166e.rbf
e5c166f.rbf
e5c1670.rbf
e5c1671.rbf
e5c1672.rbf
e5c1673.rbf
e5c1674.rbf
e5c1675.rbf
e5c1676.rbf
e5c1677.rbf
e5c1678.rbf
e5c1679.rbf
e5c167a.rbf
e5c167b.rbf
e5c167d.rbf
e5c167e.rbf
e5c167f.rbf
e5c1680.rbf
e5c1681.rbf
e5c1682.rbf
e5c1683.rbf
e5c1684.rbf
e5c1685.rbf
e5c1686.rbf
e5c1687.rbf
e5c1689.rbf
e5c168a.rbf
e5c168b.rbf
e5c168c.rbf
e5c168d.rbf
e5c168e.rbf
e5c168f.rbf
e5c1690.rbf
e5c1691.rbf
e5c1692.rbf
e5c1693.rbf
e5c1694.rbf
e5c1695.rbf
e5c1696.rbf
e5c1697.rbf
e5c1698.rbf
e5c1699.rbf
e5c169a.rbf
e5c169b.rbf
e5c169c.rbf
e5c169d.rbf
e5c169e.rbf
e5c169f.rbf
e5c16a0.rbf
e5c16a1.rbf
e5c16a2.rbf
e5c16a3.rbf
e5c16a4.rbf
e5c16a5.rbf
e5c16a6.rbf
e5c16a7.rbf
e5c16a8.rbf
e5c16a9.rbf
e5c16aa.rbf
e5c16ab.rbf
e5c16ac.rbf
e5c16ad.rbf
e5c16ae.rbf
e5c16af.rbf
e5c16b0.rbf
e5c16b1.rbf
e5c16b2.rbf
e5c16b3.rbf
e5c16b4.rbf
e5c16b5.rbf
e5c16b6.rbf
e5c16b7.rbf
e5c16b8.rbf
e5c16b9.rbf
e5c16ba.rbf
e5c16bb.rbf
e5c16bc.rbf
e5c16bd.rbf
e5c16be.rbf
e5c16bf.rbf
e5c16c0.rbf
e5c16c1.rbf
e5c16c2.rbf
e5c16c3.rbf
e5c16c4.rbf
e5c16c5.rbf
e5c16c6.rbf
e5c16c7.rbf
e5c16c8.rbf
e5c16c9.rbf
e5c16ca.rbf
e5c16cb.rbf
e5c16cc.rbf
e5c16cd.rbf
e5c16ce.rbf
e5c16cf.rbf
e5c16d0.rbf
e5c16d1.rbf
e5c16d2.rbf
e5c16d3.rbf
e5c16d4.rbf
e5c16d5.rbf
e5c16d6.rbf
e5c16d7.rbf
e5c16d8.rbf
e5c16d9.rbf
e5c16da.rbf
e5c16db.rbf
e5c16dc.rbf
e5c16dd.rbf
e5c16de.rbf
e5c16df.rbf
e5c16e0.rbf
e5c16e1.rbf
e5c16e2.rbf
e5c16e3.rbf
e5c16e4.rbf
e5c16e5.rbf
e5c16e6.rbf
e5c16e7.rbf
e5c16e8.rbf
e5c16e9.rbf
e5c16ea.rbf
e5c16eb.rbf
e5c16ec.rbf
e5c16ed.rbf
e5c16ee.rbf
e5c16ef.rbf
e5c16f0.rbf
e5c16f1.rbf
e5c16f2.rbf
e5c16f3.rbf
e5c16f4.rbf
e5c16f5.rbf
e5c16f6.rbf
e5c16f7.rbf
e5c16f8.rbf
e5c16f9.rbf
e5c16fa.rbf
e5c16fb.rbf
e5c16fc.rbf
e5c16fd.rbf
e5c16fe.rbf
e5c16ff.rbf
e5c1700.rbf
e5c1701.rbf
e5c1702.rbf
e5c1703.rbf
e5c1704.rbf
e5c1705.rbf
e5c1706.rbf
e5c1707.rbf
e5c1708.rbf
e5c1709.rbf
e5c170a.rbf
e5c170b.rbf
e5c170c.rbf
e5c170d.rbf
e5c170e.rbf
e5c170f.rbf
e5c1710.rbf
e5c1711.rbf
e5c1712.rbf
e5c1713.rbf
e5c1714.rbf
e5c1715.rbf
e5c1716.rbf
e5c1717.rbf
e5c1718.rbf
e5c1719.rbf
e5c171a.rbf
e5c171b.rbf
e5c171c.rbf
e5c171d.rbf
e5c171e.rbf
e5c171f.rbf
e5c1720.rbf
e5c1721.rbf
e5c1722.rbf
e5c1723.rbf
e5c1724.rbf
e5c1725.rbf
e5c1726.rbf
e5c1727.rbf
e5c1728.rbf
e5c1729.rbf
e5c172a.rbf
e5c172b.rbf
e5c172c.rbf
e5c172d.rbf
e5c172e.rbf
e5c172f.rbf
e5c1730.rbf
e5c1731.rbf
e5c1732.rbf
e5c1733.rbf
e5c1734.rbf
e5c1735.rbf
e5c1736.rbf
e5c1737.rbf
e5c1738.rbf
e5c1739.rbf
e5c173a.rbf
e5c173b.rbf
e5c173c.rbf
e5c173d.rbf
e5c173e.rbf
e5c173f.rbf
e5c1740.rbf
e5c1741.rbf
e5c1742.rbf
e5c1743.rbf
e5c1744.rbf
e5c1745.rbf
e5c1746.rbf
e5c1747.rbf
e5c1748.rbf
e5c1749.rbf
e5c174a.rbf
e5c174b.rbf
e5c174c.rbf
e5c174d.rbf
e5c174e.rbf
e5c174f.rbf
e5c1750.rbf
e5c1751.rbf
e5c1752.rbf
e5c1753.rbf
e5c1754.rbf
e5c1755.rbf
e5c1756.rbf
e5c1757.rbf
e5c1758.rbf
e5c1759.rbf
e5c175a.rbf
e5c175b.rbf
e5c175c.rbf
e5c175d.rbf
e5c175e.rbf
e5c175f.rbf
e5c1760.rbf
e5c1761.rbf
e5c1762.rbf
e5c1763.rbf
e5c1764.rbf
e5c1765.rbf
e5c1766.rbf
e5c1767.rbf
e5c1768.rbf
e5c1769.rbf
e5c176a.rbf
e5c176b.rbf
e5c176c.rbf
e5c176d.rbf
e5c176e.rbf
e5c176f.rbf
e5c1770.rbf
e5c1771.rbf
e5c1772.rbf
e5c1773.rbf
e5c1774.rbf
e5c1775.rbf
e5c1776.rbf
e5c1777.rbf
e5c1778.rbf
e5c1779.rbf
e5c177a.rbf
e5c177b.rbf
e5c177c.rbf
e5c177d.rbf
e5c177e.rbf
e5c177f.rbf
e5c1780.rbf
e5c1781.rbf
e5c1782.rbf
e5c1783.rbf
e5c1784.rbf
e5c1785.rbf
e5c1786.rbf
e5c1787.rbf
e5c1788.rbf
e5c1789.rbf
e5c178a.rbf
e5c178b.rbf
e5c178f.rbs
e5c1793.rbs
e5c1796.rbf
e5c1799.rbf
e5c179a.rbf
e5c179b.rbf
e5c179c.rbf
e5c179d.rbf
e5c17a0.rbs
e5c17a6.rbs
e5c17ab.rbs
e5c17af.rbs
e5c17b2.rbs
e5c1855.rbf
e5c1856.rbf
e5c1857.rbf
e5c185a.rbf
e5c185b.rbf
e5c185c.rbf
e5c185d.rbf
e5c185e.rbf
e5c185f.rbf
e5c1860.rbf
e5c1861.rbf
e5c1862.rbf
e5c1863.rbf
e5c1864.rbf
e5c1865.rbf
e5c1866.rbf
e5c1867.rbf
e5c1868.rbf
e5c1869.rbf
e5c186a.rbf
e5c186b.rbf
e5c186c.rbf
e5c186d.rbf
e5c186e.rbf
e5c186f.rbf
e5c1870.rbf
e5c1871.rbf
e5c1872.rbf
e5c1873.rbf
e5c1874.rbf
e5c1875.rbf
e5c1876.rbf
e5c1877.rbf
e5c1878.rbf
e5c1879.rbf
e5c187a.rbf
e5c187c.rbf
e5c1880.rbf
e5c1881.rbf
e5c1882.rbf
e5c1883.rbf
e5c1884.rbf
e5c1885.rbf
e5c1886.rbf
e5c188b.rbf
e5c188c.rbf
e5c188d.rbf
e5c188e.rbf
e5c188f.rbf
e5c1892.rbf
e5c1895.rbf
e5c1896.rbf
e5c1898.rbf
e5c1899.rbf
e5c189a.rbf
e5c189b.rbf
e5c189c.rbf
e5c189d.rbf
e5c189e.rbf
e5c189f.rbf
e5c18a1.rbf
e5c18a4.rbf
e5c18a5.rbf
e5c18a6.rbf
e5c18a7.rbf
e5c18a8.rbf
e5c18ab.rbf
e5c18ac.rbf
e5c18ad.rbf
e5c18ae.rbf
e5c18b0.rbf
e5c18b2.rbf
e5c18b3.rbf
e5c18b6.rbf
e5c18ba.rbf
e5c18bc.rbf
e5c18bf.rbf
e5c18c0.rbf
e5c18c1.rbf
e5c18c2.rbf
e5c18c3.rbf
e5c18c4.rbf
e5c18c5.rbf
e5c18c6.rbf
e5c18c9.rbf
e5c18cd.rbf
e5c18d2.rbf
e5c18d3.rbf
e5c18d4.rbf
e5c18d5.rbf
e5c18d6.rbf
e5c18d7.rbf
e5c18d8.rbf
e5c18d9.rbf
e5c18da.rbf
e5c18db.rbf
e5c18dc.rbf
e5c18dd.rbf
e5c18de.rbf
e5c18e0.rbf
e5c18e1.rbf
e5c18e2.rbf
e5c18e3.rbf
e5c18e4.rbf
e5c18e5.rbf
e5c18e6.rbf
e5c18e7.rbf
e5c18e9.rbf
e5c18ea.rbf
e5c18eb.rbf
e5c18ec.rbf
e5c18ed.rbf
e5c18ee.rbf
e5c18ef.rbf
e5c18f0.rbf
e5c18f1.rbf
e5c18f2.rbf
e5c18f3.rbf
e5c18f4.rbf
e5c18f5.rbf
e5c18f6.rbf
e5c18f7.rbf
e5c18f8.rbf
e5c18f9.rbf
e5c18fa.rbf
e5c18fb.rbf
e5c18fc.rbf
e5c18fd.rbf
e5c18fe.rbf
e5c18ff.rbf
e5c1900.rbf
e5c1901.rbf
e5c1902.rbf
e5c1903.rbf
e5c1904.rbf
e5c1905.rbf
e5c1906.rbf
e5c1907.rbf
e5c1908.rbf
e5c1909.rbf
e5c190b.rbf
e5c190c.rbf
e5c190d.rbf
e5c190e.rbf
e5c190f.rbf
e5c1910.rbf
e5c1911.rbf
e5c1912.rbf
e5c1913.rbf
e5c1914.rbf
e5c1915.rbf
e5c1916.rbf
e5c1917.rbf
e5c1918.rbf
e5c1919.rbf
e5c191a.rbf
e5c191b.rbf
e5c191c.rbf
e5c191d.rbf
e5c191e.rbf
e5c191f.rbf
e5c1920.rbf
e5c1921.rbf
e5c1922.rbf
e5c1923.rbf
e5c1924.rbf
e5c1925.rbf
e5c1926.rbf
e5c1927.rbf
e5c1928.rbf
e5c1929.rbf
e5c192a.rbf
e5c192b.rbf
e5c192c.rbf
e5c192d.rbf
e5c192e.rbf
e5c192f.rbf
e5c1930.rbf
e5c1931.rbf
e5c1932.rbf
e5c1933.rbf
e5c1934.rbf
e5c1935.rbf
e5c1936.rbf
e5c1937.rbf
e5c1938.rbf
e5c1939.rbf
e5c193a.rbf
e5c193b.rbf
e5c193c.rbf
e5c193d.rbf
e5c193e.rbf
e5c193f.rbf
e5c1940.rbf
e5c1941.rbf
e5c1942.rbf
e5c1943.rbf
e5c1944.rbf
e5c1945.rbf
e5c1947.rbf
e5c1948.rbf
e5c1949.rbf
e5c194c.rbf
e5c1951.rbf
e5c1954.rbf
e5c1956.rbf
e5c1957.rbf
e5c195b.rbf
e5c1966.rbf
e5c1968.rbf
e5c1969.rbf
e5c196b.rbf
e5c1976.rbf
e5c197c.rbf
e5c197d.rbf
e5c197f.rbf
e5c1980.rbf
e5c1983.rbf
e5c1988.rbf
e5c198b.rbf
e5c198c.rbf
e5c198d.rbf
e5c198e.rbf
e5c198f.rbf
e5c1990.rbf
e5c1991.rbf
e5c1992.rbf
e5c1993.rbf
e5c1994.rbf
e5c1995.rbf
e5c1996.rbf
e5c1997.rbf
e5c1998.rbf
e5c1999.rbf
e5c199a.rbf
e5c199b.rbf
e5c199c.rbf
e5c199d.rbf
e5c199e.rbf
e5c199f.rbf
e5c19a0.rbf
e5c19a1.rbf
e5c19a2.rbf
e5c19a3.rbf
e5c19a4.rbf
e5c19a5.rbf
e5c19a6.rbf
e5c19a7.rbf
e5c19a8.rbf
e5c19a9.rbf
e5c19aa.rbf
e5c19ab.rbf
e5c19ac.rbf
e5c19ad.rbf
e5c19ae.rbf
e5c19af.rbf
e5c19b0.rbf
e5c19b1.rbf
e5c19b2.rbf
e5c19b3.rbf
e5c19b4.rbf
e5c19b5.rbf
e5c19b6.rbf
e5c19b7.rbf
e5c19b8.rbf
e5c19b9.rbf
e5c19ba.rbf
e5c19bb.rbf
e5c19bc.rbf
e5c19bd.rbf
e5c19be.rbf
e5c19bf.rbf
e5c19c0.rbf
e5c19c1.rbf
e5c19c2.rbf
e5c19c3.rbf
e5c19c4.rbf
e5c19c5.rbf
e5c19c6.rbf
e5c19c7.rbf
e5c19c8.rbf
e5c19c9.rbf
e5c19ca.rbf
e5c19cb.rbf
e5c19cc.rbf
e5c19cd.rbf
e5c19ce.rbf
e5c19cf.rbf
e5c19d0.rbf
e5c19d1.rbf
e5c19d2.rbf
e5c19d3.rbf
e5c19d4.rbf
e5c19d5.rbf
e5c19dc.rbf
e5c19dd.rbf
e5c19df.rbf
e5c19e0.rbf
e5c19e1.rbf
e5c19e2.rbf
e5c19e3.rbf
e5c19e4.rbf
e5c19e5.rbf
e5c19e6.rbf
e5c19e7.rbf
e5c19e8.rbf
e5c19e9.rbf
e5c19ea.rbf
e5c19eb.rbf
e5c19ec.rbf
e5c19ed.rbf
e5c19ee.rbf
e5c19ef.rbf
e5c19f0.rbf
e5c19f1.rbf
e5c19f2.rbf
e5c19f3.rbf
e5c19f4.rbf
e5c19f5.rbf
e5c19f6.rbf
e5c19f7.rbf
e5c19f8.rbf
e5c19f9.rbf
e5c19fa.rbf
e5c19fb.rbf
e5c19fc.rbf
e5c19fd.rbf
e5c1a03.rbf
e5c1a05.rbf
e5c1a07.rbf
e5c1a08.rbf
e5c1a0c.rbf
e5c1a0d.rbf
e5c1a0e.rbf
e5c1a0f.rbf
e5c1a10.rbf
e5c1a11.rbf
e5c1a12.rbf
e5c1a13.rbf
e5c1a14.rbf
e5c1a15.rbf
e5c1a21.rbf
e5c1a22.rbf
e5c1a23.rbf
e5c1a24.rbf
e5c1a26.rbf
e5c1a2a.rbf
e5c1a2b.rbf
e5c1a2c.rbf
e5c1a2d.rbf
e5c1a30.rbf
e5c1a31.rbf
e5c1a32.rbf
e5c1a33.rbf
e5c1a34.rbf
e5c1a35.rbf
e5c1a36.rbf
e5c1a38.rbf
e5c1a39.rbf
e5c1a3e.rbf
e5c1a3f.rbf
e5c1a41.rbf
e5c1a43.rbf
e5c1a46.rbf
e5c1a48.rbf
e5c1a4f.rbf
e5c1a51.rbf
e5c1a52.rbf
e5c1a53.rbf
e5c1a56.rbf
e5c1a57.rbf
e5c1a58.rbf
e5c1a59.rbf
e5c1a5a.rbf
e5c1a5b.rbf
e5c1a5c.rbf
e5c1a5d.rbf
e5c1a5e.rbf
e5c1a5f.rbf
e5c1a60.rbf
e5c1a61.rbf
e5c1a62.rbf
e5c1a67.rbf
e5c1a69.rbf
e5c1a6b.rbf
e5c1a6c.rbf
e5c1a6d.rbf
e5c1a6e.rbf
e5c1a6f.rbf
e5c1a70.rbf
e5c1a71.rbf
e5c1a72.rbf
e5c1a74.rbf
e5c1a76.rbf
e5c1a77.rbf
e5c1a78.rbf
e5c1a79.rbf
e5c1a7a.rbf
e5c1a7b.rbf
e5c1a7c.rbf
e5c1a7d.rbf
e5c1a7e.rbf
e5c1a80.rbf
e5c1a82.rbf
e5c1a83.rbf
e5c1a84.rbf
e5c1a85.rbf
e5c1a86.rbf
e5c1a87.rbf
e5c1a88.rbf
e5c1a89.rbf
e5c1a8a.rbf
e5c1a8b.rbf
e5c1a8c.rbf
e5c1a8d.rbf
e5c1a8e.rbf
e5c1a91.rbf
e5c1a92.rbf
e5c1a93.rbf
e5c1a94.rbf
e5c1a95.rbf
e5c1a96.rbf
e5c1a98.rbf
e5c1a9c.rbf
e5c1a9d.rbf
e5c1a9e.rbf
e5c1a9f.rbf
e5c1aa0.rbf
e5c1aa1.rbf
e5c1aa2.rbf
e5c1aa3.rbf
e5c1aa7.rbf
e5c1aa8.rbf
e5c1aa9.rbf
e5c1aaa.rbf
e5c1aab.rbf
e5c1aac.rbf
e5c1aad.rbf
e5c1aae.rbf
e5c1aaf.rbf
e5c1ab2.rbf
e5c1ab5.rbf
e5c1aba.rbf
e5c1abc.rbf
e5c1abf.rbf
e5c1ac2.rbf
e5c1ac5.rbf
e5c1ac6.rbf
e5c1ac7.rbf
e5c1acb.rbf
e5c1acc.rbf
e5c1ad0.rbf
e5c1ad1.rbf
e5c1ad2.rbf
e5c1ad6.rbs
e5c1ada.rbs
e5c1add.rbs
e5c1ae0.rbs
e5c1ae3.rbs
e5c1ae6.rbs
powershell.exe.log
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
the-real-index~RFe58b512.TMP
SiteList-Enterprise.json
HubApps
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
Local State
5c728ea0-a33b-4491-890f-9fbb8f817ab3.tmp
metadata.json
lib_JustForMe
tcltk_JustForMe
AILog.txt
AILog.txt
AILog.txt
SearchHoverUnifiedTileModelCache.dat
INSTALLER
__init__.py
__main__.py
__pip-runner__.py
__init__.py
build_env.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
index_command.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
metadata_legacy.py
wheel.py
wheel_editable.py
wheel_legacy.py
check.py
freeze.py
__init__.py
editable_legacy.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
packaging.py
retry.py
setuptools_build.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
cacert.pem
core.py
__init__.py
compat.py
database.py
index.py
locators.py
manifest.py
markers.py
metadata.py
resources.py
scripts.py
util.py
version.py
wheel.py
__init__.py
__main__.py
distro.py
__init__.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
__init__.py
_spdx.py
markers.py
metadata.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
cmdline.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
bbcode.py
groff.py
html.py
img.py
irc.py
latex.py
other.py
pangomarkup.py
rtf.py
svg.py
terminal.py
terminal256.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
_mapping.py
token.py
unistring.py
util.py
__init__.py
_impl.py
__init__.py
_in_process.py
__init__.py
__version__.py
_internal_utils.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
collections_abc.py
providers.py
reporters.py
resolvers.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
__init__.py
_parser.py
_re.py
_types.py
__init__.py
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
typing_extensions.py
__init__.py
_collections.py
_version.py
connection.py
connectionpool.py
_appengine_environ.py
bindings.py
low_level.py
appengine.py
ntlmpool.py
pyopenssl.py
securetransport.py
socks.py
exceptions.py
fields.py
filepost.py
makefile.py
weakref_finalize.py
six.py
poolmanager.py
request.py
response.py
__init__.py
connection.py
proxy.py
queue.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
wait.py
pip3.12.exe
python.exe
Vexx_SysDump_1777777532474.zip
__PSScriptPolicyTest_k3ck2x30.r2z.ps1
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
LICENSE
index.js
package.json
node.napi.node
dpapi_addon.h
dpapi_not_supported.cpp
dpapi_win.cpp
main.cpp
LICENSE
better_sqlite3.node
common.gypi
copy.js
defines.gypi
download.sh
1208.patch
sqlite3.gyp
sqlite3.c
sqlite3.h
sqlite3ext.h
test_extension.c
database.js
index.js
aggregate.js
backup.js
function.js
inspect.js
pragma.js
serialize.js
table.js
transaction.js
wrappers.js
sqlite-error.js
util.js
package.json
addon.cpp
better_sqlite3.cpp
backup.cpp
backup.hpp
database.cpp
database.hpp
statement-iterator.cpp
statement-iterator.hpp
statement.cpp
statement.hpp
bind-map.cpp
binder.cpp
constants.cpp
custom-aggregate.cpp
custom-function.cpp
custom-table.cpp
data-converter.cpp
data.cpp
helpers.cpp
macros.cpp
query-macros.cpp
row-builder.cpp
LICENSE
node_sqlite3.node
common-sqlite.gypi
extract.js
sqlite-autoconf-3440200.tar.gz
sqlite3.gyp
sqlite3-binding.js
sqlite3.js
trace.js
package.json
async.h
backup.h
database.h
gcc-preinclude.h
macros.h
statement.h
threading.h
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
SpiderBanner.dll
StdUtils.dll
System.dll
WinShell.dll
nsExec.dll
nsis7z.dll
verify_deps.py
IDLE (Python 3.12 64-bit).lnk
Python 3.12 (64-bit).lnk
Python 3.12 Module Docs (64-bit).lnk
f4bfc0ee-3da3-4e5f-b1ef-3144f4621ae7.tmp
BootstrapperApplicationData.xml
Default.thm
Default.wxl
SideBar.png
python-3.12.10-amd64.exe
path_JustForMe
PythonBA.dll
memory/332-1951-0x000002080E600000-0x000002080E71E000-memory.dmp
memory/404-1938-0x0000023EFF1B0000-0x0000023EFF1C2000-memory.dmp
memory/404-1937-0x0000023EFECA0000-0x0000023EFECAC000-memory.dmp
memory/784-2278-0x0000013C1B3E0000-0x0000013C1B3EC000-memory.dmp
memory/784-2279-0x0000013C33970000-0x0000013C33982000-memory.dmp
memory/1560-2133-0x0000016214120000-0x000001621412C000-memory.dmp
memory/1560-2134-0x000001622C6C0000-0x000001622C6D2000-memory.dmp
memory/1624-2141-0x000001DC71DA0000-0x000001DC71EBE000-memory.dmp
memory/1624-2139-0x000001DC71400000-0x000001DC7140C000-memory.dmp
memory/1624-2140-0x000001DC71460000-0x000001DC71472000-memory.dmp
memory/2036-1953-0x000002C44C160000-0x000002C44C27E000-memory.dmp
memory/2304-1829-0x0000023AEC9F0000-0x0000023AEC9F8000-memory.dmp
memory/2304-1830-0x0000023AECA20000-0x0000023AECA26000-memory.dmp
memory/2304-1825-0x0000023AEC9D0000-0x0000023AEC9DA000-memory.dmp
memory/2304-1834-0x0000023AD2990000-0x0000023AD299C000-memory.dmp
memory/2304-1824-0x0000023AEC910000-0x0000023AEC9C3000-memory.dmp
memory/2304-1835-0x0000023AEC760000-0x0000023AEC772000-memory.dmp
memory/2304-1810-0x0000023AEC800000-0x0000023AEC822000-memory.dmp
memory/2304-1826-0x0000023AECA00000-0x0000023AECA1C000-memory.dmp
memory/2304-1823-0x0000023AEC8F0000-0x0000023AEC90C000-memory.dmp
memory/2304-1827-0x0000023AEC9E0000-0x0000023AEC9EA000-memory.dmp
memory/2304-1831-0x0000023AECA30000-0x0000023AECA3A000-memory.dmp
memory/2304-1828-0x0000023AECA40000-0x0000023AECA5A000-memory.dmp
memory/2488-1943-0x000001ED866A0000-0x000001ED866AC000-memory.dmp
memory/2488-1944-0x000001ED9E950000-0x000001ED9E962000-memory.dmp
memory/2488-1922-0x000001ED9EC90000-0x000001ED9ECBA000-memory.dmp
memory/2488-1923-0x000001ED9EC90000-0x000001ED9ECB4000-memory.dmp
memory/2488-1921-0x000001ED9EB90000-0x000001ED9EC43000-memory.dmp
memory/2620-530-0x000002375FED0000-0x000002375FFEE000-memory.dmp
memory/2932-548-0x0000000000C20000-0x0000000000C84000-memory.dmp
memory/2948-2144-0x000001CAC1B80000-0x000001CAC1B92000-memory.dmp
memory/2948-2143-0x000001CAC1A40000-0x000001CAC1A4C000-memory.dmp
memory/3088-1978-0x000002B4800B0000-0x000002B4800C2000-memory.dmp
memory/3088-1976-0x000002B4E6030000-0x000002B4E6150000-memory.dmp
memory/3088-1977-0x000002B480010000-0x000002B48001C000-memory.dmp
memory/3088-1973-0x000002B480530000-0x000002B4805E3000-memory.dmp
memory/3536-1946-0x000001EECAE30000-0x000001EECAE3C000-memory.dmp
memory/3536-1947-0x000001EECAE70000-0x000001EECAE82000-memory.dmp
memory/3724-2125-0x000001FAD4B70000-0x000001FAD4B82000-memory.dmp
memory/3724-2124-0x000001FABC820000-0x000001FABC82C000-memory.dmp
memory/3908-1987-0x000002AEA4E10000-0x000002AEA4E22000-memory.dmp
memory/3908-1986-0x000002AEA4900000-0x000002AEA490C000-memory.dmp
memory/4016-2248-0x000001494CDC0000-0x000001494CDCC000-memory.dmp
memory/4016-2249-0x000001494D450000-0x000001494D462000-memory.dmp
memory/4208-1949-0x000002A201D40000-0x000002A201D4C000-memory.dmp
memory/4208-1950-0x000002A201F60000-0x000002A201F72000-memory.dmp
memory/4320-2154-0x000001CA77620000-0x000001CA77632000-memory.dmp
memory/4320-2153-0x000001CA773D0000-0x000001CA773DC000-memory.dmp
memory/4672-2137-0x0000018F09FE0000-0x0000018F09FF2000-memory.dmp
memory/4672-2136-0x0000018F09AD0000-0x0000018F09ADC000-memory.dmp
memory/4744-2182-0x0000023EAD1A0000-0x0000023EAD1B2000-memory.dmp
memory/4744-2181-0x0000023E932D0000-0x0000023E932DC000-memory.dmp
memory/5240-2038-0x00000155349D0000-0x00000155349E2000-memory.dmp
memory/5240-2037-0x000001551C720000-0x000001551C72C000-memory.dmp
memory/5240-2036-0x000001551AA60000-0x000001551AB80000-memory.dmp
memory/5252-1604-0x0000000002420000-0x0000000002484000-memory.dmp
memory/5252-1784-0x0000000002420000-0x0000000002484000-memory.dmp
memory/5392-1902-0x0000021FFFD70000-0x0000021FFFE8E000-memory.dmp
memory/5600-1809-0x000001821BBC0000-0x000001821BCDE000-memory.dmp
memory/5796-2346-0x0000029F31920000-0x0000029F319D3000-memory.dmp
memory/5956-1940-0x000001CA0D4A0000-0x000001CA0D4AC000-memory.dmp
memory/5956-1941-0x000001CA0D500000-0x000001CA0D512000-memory.dmp
memory/5960-2245-0x0000015583070000-0x000001558307C000-memory.dmp
memory/5960-2246-0x0000015584950000-0x0000015584962000-memory.dmp
memory/5964-1900-0x000002101A270000-0x000002101A271000-memory.dmp
memory/6184-2022-0x000001F5BEEE0000-0x000001F5BEEF2000-memory.dmp
memory/6184-2021-0x000001F5BECC0000-0x000001F5BECCC000-memory.dmp
memory/6504-1913-0x00000225FAE00000-0x00000225FAF20000-memory.dmp
memory/6524-1914-0x0000024177800000-0x0000024177920000-memory.dmp
memory/6752-2012-0x0000023626DE0000-0x0000023626DEC000-memory.dmp
memory/6752-2013-0x0000023627240000-0x0000023627252000-memory.dmp
memory/6752-2011-0x0000023625420000-0x0000023625540000-memory.dmp
memory/6832-2003-0x000001FD4E6C0000-0x000001FD4E6D2000-memory.dmp
memory/6832-2002-0x000001FD34880000-0x000001FD3488C000-memory.dmp
memory/6832-2001-0x000001FD34680000-0x000001FD347A0000-memory.dmp
memory/6876-2287-0x0000020004FF0000-0x0000020004FFC000-memory.dmp
memory/6876-2288-0x000002001D5F0000-0x000002001D602000-memory.dmp
memory/6940-2264-0x000001EBF6FF0000-0x000001EBF7002000-memory.dmp
memory/6940-2263-0x000001EBF6B80000-0x000001EBF6B8C000-memory.dmp