f039d3435f8bf7862ed25e1342d6c19fc4fdf0c4d1634340822bbce0ba3b49dc

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
628s
max time network
906s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VanishSetup.exe
Size 135.0MB
Sample260622-jsmsrsas4k
SHA256 f039d3435f8bf7862ed25e1342d6c19fc4fdf0c4d1634340822bbce0ba3b49dc
MD5 235b60aff298e74178d28920ae56683e
SHA1 f52d6a2d22b392abc1af0803284f0b862d825d24
SHA512 ae23ab5c516eb5590f804761443fc4fcf21595dcabea87040b317ccf561784b3a16383ce36892b43942a6d4162a6420130f3a836fd9cb9d7871b9f1bef3b1e09
SSDEEP 3145728:CMQZi1AYJFmGlrkuboVAefUDSGzsRGxJgOybM0RfZD4k:CTZebjD0krbuIsR4
TLSH
T18368333C0A1ACC4FD32CF5B1AAA5075174D6BD202746B4B1D6A747FAAC79AC3D70A2D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
120	6340	msiexec.exe
122	6340	msiexec.exe
363	1224	Process not Found
372	1224	Process not Found
386	1224	Process not Found
393	1224	Process not Found
398	1224	Process not Found

Downloads MZ/PE file 1 IoCs

flow	pid	Process
101	1100	msedge.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5592	netsh.exe
5076	netsh.exe
1148	netsh.exe

Executes dropped EXE 64 IoCs

pid	Process
5600	Update.exe
6600	Squirrel.exe
3004	Vanish.exe
2664	Update.exe
6116	Vanish.exe
1052	Vanish.exe
7064	Vanish.exe
6140	Vanish.exe
6708	Update.exe
6016	python.exe
2508	python.exe
5008	python.exe
3280	python.exe
7152	python.exe
4960	python.exe
1316	python.exe
3924	python.exe
7108	python.exe
708	python.exe
1664	python.exe
6452	python.exe
5368	python.exe
716	python.exe
4312	python.exe
6516	python.exe
3964	python.exe
6108	python.exe
7160	python.exe
1500	python.exe
3216	python.exe
4688	python.exe
4592	python.exe
5456	python.exe
2980	python.exe
1316	python.exe
3552	python.exe
2844	python.exe
2404	python.exe
5784	python.exe
6692	python.exe
7024	iTunes64Setup.exe
120	iTunes64Setup.exe
1272	iTunes64Setup.exe
5904	python.exe
2272	python.exe
4740	python.exe
1520	python.exe
4444	python.exe
4516	Vanish.exe
2012	python.exe
4312	python.exe
7152	python.exe
5988	python.exe
6428	python.exe
1692	python.exe
6996	python.exe
6544	python.exe
1768	python.exe
3744	python.exe
4800	python.exe
2676	python.exe
2644	python.exe
5588	python.exe
6932	python.exe

Loads dropped DLL 64 IoCs

pid	Process
3004	Vanish.exe
6116	Vanish.exe
1052	Vanish.exe
7064	Vanish.exe
6140	Vanish.exe
1052	Vanish.exe
1052	Vanish.exe
1052	Vanish.exe
1052	Vanish.exe
1052	Vanish.exe
6016	python.exe
5008	python.exe
2508	python.exe
6016	python.exe
5008	python.exe
2508	python.exe
5008	python.exe
5008	python.exe
2508	python.exe
2508	python.exe
6016	python.exe
6016	python.exe
5008	python.exe
2508	python.exe
6016	python.exe
5008	python.exe
6016	python.exe
2508	python.exe
6016	python.exe
5008	python.exe
2508	python.exe
6016	python.exe
5008	python.exe
2508	python.exe
5008	python.exe
2508	python.exe
6016	python.exe
5008	python.exe
2508	python.exe
6016	python.exe
6016	python.exe
5008	python.exe
2508	python.exe
2508	python.exe
6016	python.exe
5008	python.exe
5008	python.exe
6016	python.exe
2508	python.exe
5008	python.exe
2508	python.exe
6016	python.exe
6016	python.exe
5008	python.exe
2508	python.exe
5008	python.exe
6016	python.exe
2508	python.exe
6016	python.exe
2508	python.exe
5008	python.exe
2508	python.exe
5008	python.exe
6016	python.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_1372722159\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_701618077\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_1482918279\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_1372722159\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_1372722159\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_701618077\well_known_domains.dll	msedge.exe
File opened for modification	C:\Windows\SystemTemp	Vanish.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_1482918279\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_2111285427\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_2111285427\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_1372722159\crs.pb	msedge.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 48 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5320	powershell.exe
4568	powershell.exe
5124	powershell.exe
2220	powershell.exe
5192	powershell.exe
6448	powershell.exe
5896	powershell.exe
2308	powershell.exe
4884	powershell.exe
1228	powershell.exe
1056	powershell.exe
2968	powershell.exe
2612	powershell.exe
2068	powershell.exe
464	powershell.exe
5244	powershell.exe
6688	powershell.exe
4260	powershell.exe
2580	powershell.exe
3024	powershell.exe
5240	powershell.exe
1152	powershell.exe
5768	powershell.exe
3860	powershell.exe
6480	powershell.exe
4444	powershell.exe
3864	powershell.exe
3012	powershell.exe
5580	powershell.exe
6412	powershell.exe
6636	powershell.exe
6636	powershell.exe
5860	powershell.exe
4412	powershell.exe
3568	powershell.exe
1416	powershell.exe
5016	powershell.exe
2552	powershell.exe
4872	powershell.exe
6300	powershell.exe
3128	powershell.exe
3056	powershell.exe
2036	powershell.exe
2488	powershell.exe
6044	powershell.exe
2168	powershell.exe
6356	powershell.exe
4892	powershell.exe

Launches sc.exe 48 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6928	sc.exe
1096	sc.exe
4648	sc.exe
5460	sc.exe
2196	sc.exe
6068	sc.exe
5488	sc.exe
4776	sc.exe
6176	sc.exe
1240	sc.exe
3520	sc.exe
4484	sc.exe
3028	sc.exe
1040	sc.exe
5704	sc.exe
7008	sc.exe
5500	sc.exe
1452	sc.exe
5780	sc.exe
5276	sc.exe
2308	sc.exe
3392	sc.exe
4872	sc.exe
1820	sc.exe
5572	sc.exe
6420	sc.exe
4136	sc.exe
3568	sc.exe
2484	sc.exe
2832	sc.exe
1188	sc.exe
552	sc.exe
2368	sc.exe
256	sc.exe
3512	sc.exe
4148	sc.exe
7004	sc.exe
2008	sc.exe
3272	sc.exe
5472	sc.exe
2832	sc.exe
3988	sc.exe
5780	sc.exe
5192	sc.exe
4772	sc.exe
3296	sc.exe
5788	sc.exe
1200	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VanishSetup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1100	msedge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Vanish.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Vanish.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Vanish.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134265887647985434"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2882181966-868590553-1461876573-1000\{97D9AE5F-FB80-41E4-96C4-AEED2AE9D1D9}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5600	Update.exe
5600	Update.exe
5320	powershell.exe
5320	powershell.exe
5320	powershell.exe
6116	Vanish.exe
6116	Vanish.exe
4412	powershell.exe
4412	powershell.exe
4412	powershell.exe
6044	powershell.exe
6044	powershell.exe
6044	powershell.exe
4568	powershell.exe
4568	powershell.exe
4568	powershell.exe
5124	powershell.exe
5124	powershell.exe
5124	powershell.exe
4444	powershell.exe
4444	powershell.exe
4444	powershell.exe
3128	powershell.exe
3128	powershell.exe
3128	powershell.exe
2580	powershell.exe
2580	powershell.exe
2580	powershell.exe
2220	powershell.exe
2220	powershell.exe
2220	powershell.exe
4516	Vanish.exe
4516	Vanish.exe
5192	powershell.exe
5192	powershell.exe
5192	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
3024	powershell.exe
3024	powershell.exe
3024	powershell.exe
3864	powershell.exe
3864	powershell.exe
3864	powershell.exe
5736	msedge.exe
5736	msedge.exe
3568	powershell.exe
3568	powershell.exe
3568	powershell.exe
5240	powershell.exe
5240	powershell.exe
5240	powershell.exe
1228	powershell.exe
1228	powershell.exe
1228	powershell.exe
6448	powershell.exe
6448	powershell.exe
6448	powershell.exe
1152	powershell.exe
1152	powershell.exe
1152	powershell.exe
5896	powershell.exe
5896	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5600	Update.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeDebugPrivilege	6708	Update.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeDebugPrivilege	5320	powershell.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeDebugPrivilege	5140	whoami.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeShutdownPrivilege	6116	Vanish.exe
Token: SeCreatePagefilePrivilege	6116	Vanish.exe
Token: SeShutdownPrivilege	6116	Vanish.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
5600	Update.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
6340	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6340	msiexec.exe
5124	msiexec.exe
6172	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 5600	3240	VanishSetup.exe	89
PID 5600 wrote to memory of 6600	5600	Update.exe	90
PID 5600 wrote to memory of 3004	5600	Update.exe	91
PID 3004 wrote to memory of 2664	3004	Vanish.exe	92
PID 5600 wrote to memory of 6116	5600	Update.exe	93
PID 6116 wrote to memory of 1052	6116	Vanish.exe	94
PID 6116 wrote to memory of 1052	6116	Vanish.exe	94
PID 6116 wrote to memory of 7064	6116	Vanish.exe	95
PID 6116 wrote to memory of 6140	6116	Vanish.exe	96
PID 6116 wrote to memory of 6140	6116	Vanish.exe	96
PID 6116 wrote to memory of 6708	6116	Vanish.exe	97
PID 6116 wrote to memory of 6016	6116	Vanish.exe	99
PID 6116 wrote to memory of 5788	6116	Vanish.exe	100
PID 6116 wrote to memory of 2508	6116	Vanish.exe	101
PID 6116 wrote to memory of 5008	6116	Vanish.exe	102
PID 6116 wrote to memory of 5320	6116	Vanish.exe	107
PID 6016 wrote to memory of 5628	6016	python.exe	109
PID 2508 wrote to memory of 2784	2508	python.exe	110
PID 5008 wrote to memory of 1872	5008	python.exe	111
PID 6116 wrote to memory of 5140	6116	Vanish.exe	113
PID 6116 wrote to memory of 3280	6116	Vanish.exe	115
PID 3280 wrote to memory of 4748	3280	python.exe	117
PID 6116 wrote to memory of 5592	6116	Vanish.exe	118
PID 6116 wrote to memory of 5076	6116	Vanish.exe	120
PID 6116 wrote to memory of 1148	6116	Vanish.exe	122
PID 6116 wrote to memory of 7152	6116	Vanish.exe	124
PID 6116 wrote to memory of 4960	6116	Vanish.exe	126
PID 6116 wrote to memory of 1316	6116	Vanish.exe	129
PID 6116 wrote to memory of 2008	6116	Vanish.exe	131
PID 6116 wrote to memory of 4412	6116	Vanish.exe	133
PID 6116 wrote to memory of 3924	6116	Vanish.exe	135
PID 6116 wrote to memory of 1040	6116	Vanish.exe	137
PID 6116 wrote to memory of 6044	6116	Vanish.exe	139
PID 6116 wrote to memory of 7108	6116	Vanish.exe	141
PID 7108 wrote to memory of 2172	7108	python.exe	143
PID 6116 wrote to memory of 708	6116	Vanish.exe	144
PID 6116 wrote to memory of 1188	6116	Vanish.exe	146
PID 6116 wrote to memory of 4568	6116	Vanish.exe	148
PID 6116 wrote to memory of 1664	6116	Vanish.exe	150
PID 6116 wrote to memory of 6452	6116	Vanish.exe	152
PID 6116 wrote to memory of 1200	6116	Vanish.exe	154
PID 6116 wrote to memory of 5124	6116	Vanish.exe	156
PID 6116 wrote to memory of 5368	6116	Vanish.exe	158
PID 6116 wrote to memory of 716	6116	Vanish.exe	160
PID 6116 wrote to memory of 6928	6116	Vanish.exe	162
PID 6116 wrote to memory of 4444	6116	Vanish.exe	164
PID 6116 wrote to memory of 4312	6116	Vanish.exe	166
PID 6116 wrote to memory of 6516	6116	Vanish.exe	168
PID 6116 wrote to memory of 5704	6116	Vanish.exe	170
PID 6116 wrote to memory of 3128	6116	Vanish.exe	172
PID 6116 wrote to memory of 3964	6116	Vanish.exe	174
PID 6116 wrote to memory of 6108	6116	Vanish.exe	176
PID 6116 wrote to memory of 7160	6116	Vanish.exe	178
PID 6116 wrote to memory of 4320	6116	Vanish.exe	180
PID 4320 wrote to memory of 4112	4320	msedge.exe	181
PID 4320 wrote to memory of 1100	4320	msedge.exe	182
PID 4320 wrote to memory of 1484	4320	msedge.exe	184
PID 4320 wrote to memory of 1484	4320	msedge.exe	184
PID 6116 wrote to memory of 1500	6116	Vanish.exe	185
PID 4320 wrote to memory of 5488	4320	msedge.exe	186
PID 4320 wrote to memory of 5488	4320	msedge.exe	186
PID 4320 wrote to memory of 5488	4320	msedge.exe	186
PID 4320 wrote to memory of 6424	4320	msedge.exe	187
PID 4320 wrote to memory of 6424	4320	msedge.exe	187

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VanishSetup.exe
"C:\Users\Admin\AppData\Local\Temp\VanishSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Squirrel.exe
    "C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:6600
- - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Vanish.exe
    "C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Vanish.exe" --squirrel-install 1.2.4
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Users\Admin\AppData\Local\vanish\Update.exe
      C:\Users\Admin\AppData\Local\vanish\Update.exe --createShortcut C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Vanish.exe --shortcut-locations Desktop,StartMenu
      4⤵
      Executes dropped EXE
      PID:2664
- - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Vanish.exe
    "C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Vanish.exe" --squirrel-firstrun
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Vanish.exe
      "C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Vanish.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Vanish" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1700,i,16628813814077509600,4042195746043349369,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1052
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Vanish.exe
      "C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Vanish.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Vanish" --field-trial-handle=2300,i,16628813814077509600,4042195746043349369,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:7064
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Vanish.exe
      "C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Vanish.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Vanish" --app-user-model-id=com.squirrel.vanish.Vanish --app-path="C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2412,i,16628813814077509600,4042195746043349369,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6140
  - - C:\Users\Admin\AppData\Local\vanish\Update.exe
      C:\Users\Admin\AppData\Local\vanish\Update.exe --checkForUpdate https://update.electronjs.org/bhavyakhunt/vanish-releases/win32-x64/1.2.4
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:6708
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:6016
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5628
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:5788
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2784
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:5008
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5320
  - - C:\Windows\System32\whoami.exe
      C:\Windows\System32\whoami.exe /groups
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5140
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3280
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4748
  - - C:\Windows\System32\netsh.exe
      C:\Windows\System32\netsh.exe advfirewall firewall delete rule name=all dir=in program=C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5592
  - - C:\Windows\System32\netsh.exe
      C:\Windows\System32\netsh.exe advfirewall firewall add rule "name=Vanish Connection Helper" dir=in action=allow program=C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5076
  - - C:\Windows\System32\netsh.exe
      C:\Windows\System32\netsh.exe advfirewall firewall add rule "name=Vanish mDNS (iPhone discovery)" dir=in action=allow program=C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe enable=yes profile=any protocol=UDP localport=5353 remoteip=LocalSubnet
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1148
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -c "import pymobiledevice3; print('ok')"
      4⤵
      Executes dropped EXE
      PID:7152
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:4960
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:1316
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:2008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:4412
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:3924
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:1040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:6044
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:7108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2172
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:708
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:1188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:4568
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:1664
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:6452
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:1200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:5124
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:5368
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:716
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:6928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:4444
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:4312
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:6516
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:5704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:3128
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:3964
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:6108
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:7160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.apple.com/itunes/download/win64
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffc1989c188,0x7ffc1989c194,0x7ffc1989c1a0
        5⤵
        
        PID:4112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,15845402954656118434,8244297871096362197,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
        5⤵
        Downloads MZ/PE file
        System Time Discovery
        
        PID:1100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,866765814873234905,8562376995307119732,262144 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
        5⤵
        
        PID:4244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,2934565966935640332,8577330022912034449,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:13
        5⤵
        
        PID:1484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3372,i,12058156206016910493,13490321131304580163,2097152 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
        5⤵
        
        PID:5488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3376,i,13919503076500955029,12158699851534206241,2097152 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
        5⤵
        
        PID:6424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,9992588554986039351,15017817102180508417,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
        5⤵
        
        PID:1576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,5597137164143456554,426557752134236002,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
        5⤵
        
        PID:1236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,5493878654573187796,4918469031365775806,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
        5⤵
        
        PID:3172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5676,i,8906245706853007088,4255953447829067227,2097152 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
        5⤵
        
        PID:2952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,2870740502289221129,1970644980783918027,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
        5⤵
        
        PID:5360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,2870740502289221129,1970644980783918027,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
        5⤵
        
        PID:6268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,4326624333578077758,18041704479155733859,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
        5⤵
        
        PID:5536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4888,i,15618419515195604030,18058639444616717752,2097152 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
        5⤵
        
        PID:5476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,8469952287551235268,9400781870126557086,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:14
        5⤵
        
        PID:5908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7252,i,12010437918621086996,12039787627445148199,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:14
        5⤵
        
        PID:5304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7244,i,8842710781177313393,9713456593636572003,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:14
        5⤵
        
        PID:7052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,3206351155511127982,8210596760631947508,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:14
        5⤵
        
        PID:1400
    - - C:\Users\Admin\Downloads\iTunes64Setup.exe
        
        "C:\Users\Admin\Downloads\iTunes64Setup.exe"
        5⤵
        Executes dropped EXE
        
        PID:7024
    - - C:\Users\Admin\Downloads\iTunes64Setup.exe
        
        "C:\Users\Admin\Downloads\iTunes64Setup.exe"
        5⤵
        Executes dropped EXE
        
        PID:120
    - - C:\Users\Admin\Downloads\iTunes64Setup.exe
        
        "C:\Users\Admin\Downloads\iTunes64Setup.exe"
        5⤵
        Executes dropped EXE
        
        PID:1272
      - C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\IXP440.TMP\iTunes64.msi" INSTALL_SUPPORT_PACKAGES=1
        6⤵
        Badlisted process makes network request
        Enumerates connected drives
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:6340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7308,i,3877891119419347781,17106017528937923614,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:14
        5⤵
        
        PID:924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5764,i,788071547969658654,10951798966889451262,262144 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,7949309414171019973,7543103221705942526,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
        5⤵
        
        PID:7024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,846141758380704750,8345249467397211222,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:14
        5⤵
        
        PID:1292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3200,i,5966779220076850915,199585895558712129,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
        5⤵
        
        PID:1560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2812,i,10705108021781613608,13952771768676488178,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:14
        5⤵
        
        PID:3316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,7826295094124787337,17671472326265508901,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
        5⤵
        
        PID:5288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,14460087875747814632,2178597977488524078,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14
        5⤵
        
        PID:264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,14240465306418459456,15902549929822462079,524288 --field-trial-handle=2216,i,6780330467880718577,8962125030942183715,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
        5⤵
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:1500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2220
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:3272
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:3216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:2580
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:4688
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:4592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:5456
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4204
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:2980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6124
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:5472
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:1316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6712
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:3552
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3272
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:2844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:2220
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:2404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6792
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:5784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5472
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:6692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6720
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:5904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:2272
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:4740
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3928
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:1520
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:4444
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Vanish.exe
      "C:\Users\Admin\AppData\Local\vanish\app-1.2.4\Vanish.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Vanish" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2632,i,16628813814077509600,4042195746043349369,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1596 /prefetch:10
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4516
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:2012
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4204
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6648
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:4312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:7152
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:5988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4600
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:6428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1788
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:1692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5852
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:1096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:5192
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:6996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:6544
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3928
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:1768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1572
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:3744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4776
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:4800
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:2676
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:2644
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:5588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6976
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      Executes dropped EXE
      PID:6932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4348
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4580
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5380
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1696
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:2832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:4884
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2744
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5280
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4840
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3872
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2212
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5564
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6228
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1996
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5400
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5012
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2668
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7120
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:708
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5492
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:3024
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3264
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2196
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7048
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4280
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2136
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5740
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4516
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1996
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:876
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3244
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2644
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:2832
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:3864
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3484
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1652
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5304
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2724
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5852
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2528
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5640
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1680
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2576
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2668
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1996
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:3296
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:3568
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5776
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5780
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2988
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3788
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5224
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6740
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1072
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5748
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4272
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3748
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5656
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:4648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:5240
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2348
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2756
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2120
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6780
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2600
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6176
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1812
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1832
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5256
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5536
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5540
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:572
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6504
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2836
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6616
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6416
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6552
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:6068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:1228
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1428
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6888
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2632
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5712
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:708
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5640
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6708
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1764
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5488
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3568
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5504
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:120
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6776
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5568
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:7008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:6448
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4560
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3440
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2336
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:696
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5852
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4672
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5376
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2840
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:592
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2212
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2972
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2876
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1832
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7140
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5936
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1680
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:2368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:1152
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4160
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3296
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1416
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3724
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1996
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3864
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5876
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5224
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5772
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2744
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6464
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5692
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3872
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7112
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:696
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6888
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6684
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:3392
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6640
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:5896
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4724
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6236
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5156
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:876
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3436
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2808
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6712
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3748
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:256
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:8
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:5768
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3872
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4844
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6840
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3024
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5980
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2828
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6808
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6216
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5616
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:5488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:1056
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4564
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5380
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1232
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3972
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6412
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6464
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:572
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2576
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1260
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:472
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7040
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2784
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:264
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:3988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:3012
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1712
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6128
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6468
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6192
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2336
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5748
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4232
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3284
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:848
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2840
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3776
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2944
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7116
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5028
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:552
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3856
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:5780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:3860
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:556
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6712
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2364
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3972
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2748
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2036
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2840
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1396
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3272
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4952
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4148
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4300
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1340
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3928
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3012
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2864
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6808
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:4136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:5580
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:7020
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2696
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6888
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5184
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3036
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6972
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5136
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3748
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2400
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4264
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4528
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6096
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:5500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:2168
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2396
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4196
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6364
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:876
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6308
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4148
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3288
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6936
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6800
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2336
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2816
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1212
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3692
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:5192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:1416
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5156
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:716
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6168
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2700
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5628
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6688
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5580
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1652
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4452
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2336
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7140
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1196
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2840
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5408
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2908
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6664
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:4776
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:4260
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6420
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6704
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3360
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4460
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:464
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4296
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2336
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4600
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3724
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6448
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2892
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6288
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5656
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5352
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5184
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:4772
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:5016
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5132
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6716
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4544
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3944
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1652
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1792
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:472
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:464
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5224
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1568
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3848
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4972
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6980
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:716
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4772
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5248
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4260
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4300
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:1452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:2968
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6684
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4148
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6160
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5756
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5488
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3172
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7012
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6824
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5240
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3864
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1084
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1560
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6152
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4712
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5512
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6664
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3048
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7008
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2136
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2368
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5248
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:5780
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:3056
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2308
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5876
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:7116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3548
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:240
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1456
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6072
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6412
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:256
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4660
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4116
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:3512
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:2308
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3548
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1196
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2552
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6364
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3212
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1260
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2816
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2828
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5816
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5284
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:552
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3048
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5544
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2556
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6412
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1072
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:6176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:6480
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4376
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2852
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6148
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6808
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5408
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2772
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:876
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5612
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6500
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2828
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5704
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1260
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1224
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2316
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1660
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5848
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2268
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:3568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:6412
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3396
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1416
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6604
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2036
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1132
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6480
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2308
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2580
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1196
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5400
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4868
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:5460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:2612
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3216
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2504
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1524
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5816
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4396
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1560
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5848
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2140
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3236
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3916
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6972
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1056
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4544
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5628
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1468
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1764
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3928
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1132
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5772
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6404
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:2484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:2552
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3944
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5704
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3252
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1456
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5576
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4396
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:120
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4556
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2136
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6596
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5800
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5512
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6412
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1452
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6300
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2896
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:2196
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:2068
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6168
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3828
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4148
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3740
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2852
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5868
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1240
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2156
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2772
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2336
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6008
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2132
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:256
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3748
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6084
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:5276
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3692
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:4872
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5080
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5764
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6520
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5856
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2336
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5004
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5284
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2968
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7060
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3916
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:4148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:6300
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:7164
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:7140
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6808
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4732
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5188
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2140
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2864
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6844
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6288
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5096
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3048
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:256
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5284
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5840
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5880
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:6420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:6636
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1352
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7144
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3360
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1816
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2336
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6176
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5592
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:552
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4384
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6212
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4560
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7124
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5016
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:1240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:464
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5092
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1156
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2140
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1352
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6988
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3776
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5100
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5636
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6688
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:3520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:5244
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3432
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6300
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1572
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6336
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4160
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3788
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4672
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5248
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5380
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5148
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:7008
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1412
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6176
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4664
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6420
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4484
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5544
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1456
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3452
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:2308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:6688
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5528
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:568
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6024
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:256
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6784
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3444
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3512
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4084
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:264
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5248
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5980
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5572
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7104
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5860
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2284
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3972
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:4872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:6636
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4792
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5852
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4340
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1764
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2832
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1664
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5712
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3212
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7104
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3908
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:1820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:2036
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3340
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6024
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1152
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3424
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2552
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5640
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3436
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7024
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:696
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6516
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1120
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4660
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:5572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:5860
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6236
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5916
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7056
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5896
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1872
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1408
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:7004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:6356
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5768
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3244
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1924
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1120
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4552
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1228
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3380
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:592
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:240
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6104
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2580
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2504
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:256
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6332
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4908
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:4484
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:2488
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:572
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1580
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4748
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:200
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6344
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:1664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:6680
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6480
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2600
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3616
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2444
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4288
  - - C:\Windows\system32\sc.exe
      sc query "Apple Mobile Device Service"
      4⤵
      Launches sc.exe
      PID:3028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "\"$(($null -ne (Get-AppxPackage -Name AppleInc.AppleDevices -ErrorAction SilentlyContinue)))|$(($null -ne (Get-AppxPackage -Name AppleInc.iTunes -ErrorAction SilentlyContinue)))\""
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:4892
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:4560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4092
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:2748
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:7144
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:5420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
      C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe -m pymobiledevice3 usbmux list
      4⤵
      PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2700

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:5124
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 945762A1FC6E4034B72BBED0D6626AAE C
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6172

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.RulesEngine.AppXgphnekvm0vv49drvfehh4b6kyf6ckafp.mca
1⤵
PID:7112

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:OobeHost.AppXdcwkjpb46w3zw4hbmx5jfxajhymjka0d.mca
1⤵
PID:5304

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:4376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2892

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f60cd2d9231e56b0a0784a59fb17664fa333e06aac5ee1d5692effc5152b5c30
MD5 cce4d9b2c5f5fb7c3bfaaab4af8f0448
SHA1 17b40c534fd35eb849f575565dee407cf6215d92
SHA512 5e1cbca923a813696df373e5b185a1b3fc4f73a39029b41c0ce02bf3dea25ad383c02c9763a6d8965f882055fcabaceefe0852b44c19af280ddaf74994edc4e6
TLSH
T119D080357B46EC53C41630715C3743B46256825A6967D5177450801EC88659577D214B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff07219f3594693f0fac57895f6888104d17957d039d3530d82987134771108b
MD5 26fba9d3c09d715a1b951844cadd62c5
SHA1 9e4dc8d0a08f2feba8c030b217c14a6a5c1e4827
SHA512 fc2fc417004bf59d775f5e0fafa0e6d4883632e585e21934aba3d8697554f979efd3a818d1e74c7713d51b1993f1678a707621ebef66bdf01536cd7793ff1e31
TLSH
T184D080357B46EC53C0163071583743A4625682166567D5177850D01EC846595B7D2147
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 6bbfceb48562cb9ce4e07ebc5aa28c95556f31e6578064954846088678269d00
MD5 fc65455095baa02fd4a63d16d8e5df9c
SHA1 d7750ca239a99e083fa208b8496918ff32d76951
SHA512 7795d5164db2b405514fcabd4440d4e7ccbcdd98d81b42c2671c0276f757807aa50b3a1544dcb2e0c7a19ac67ac0b2410e7dcdfd9bdb7198d9962c60f4a4463b
TLSH
T10FE02077D3C0D7E8A26196CBCA67979D1541F20F91CE68DD320CF04C145770877991B8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 465fcd8573900a6d4e167b6d6186468fe7b5a4948390798749e4b087fea2bfe4
MD5 185fca0d471c37bf7442a181dd93ab66
SHA1 8925c0ff8f37d54f48ddc5cf09b5f2c85eeae24e
SHA512 bddee1ef0adde4921e524d854f370f3927fa23d07b299e5c1426a8c86be9a58094bcee3570871d851eda4de323de397289b893763ba76590bf0bffb1d863f257
TLSH
T188E026E886C8C35FE21464C78278630E9681360ED6C86D9E2F00CA843486A84FAE76D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d23d9359264840da303a1506a3bf856f97493f552f65f20ff6a59664bd72147e
MD5 a1146183e455704bb35cd836a36b8a37
SHA1 c08c82aad38ed417dea31715d113709af93b26c8
SHA512 aa601bc54fee45b61d21aa3ec12c2ce3be2e7f283a4d18749242fda44f0a0883447ebab9856b557168d3a5842fa60c43ab94591e5e42d8cc0f7067221e8d34e5
TLSH
T18AE07DA4C8DAC35EB200F55B836CBB0D8280370FE6C8AD8E3F48CD843442A81F6C2596
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 41d73f104d368552710032103cc9983a2bddb7a69854c21d8fdda110ced06b8a
MD5 aa30e95934e270af4f66f1156487d5a0
SHA1 0ab0355833156f9877075879b1521baf81de35c9
SHA512 326225c155e76f33ed5b3a2e0cc8cb6672cf2dddc19adb4e99a6f2876caedf79e596cc9b7843bd4d415ee8c47d42c891e70163edb65a84c2a9ee99e7f506452b
TLSH
T1FBD05B9BF9EC9E9ED7E45ABE57A5B4000A880392941B9B1310357EC13595AF41E65430
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3348302b30716259c07e06a47933ed49ce6d1f39bc4c72531c3ac99f8123108b
MD5 734a9ff25b2fb8d84a56d0ec24f2ebbd
SHA1 f7f07b0d2a503e78cdaedf011ae19694a2cc7912
SHA512 164306bf96d75d165e482ea0d8eb9179574727e88c794dab03ddeac343bbec68d8380a5fc684efcb70e9d038a09df81d41b35278d508b5ee315999d902608a2d
TLSH
T166E02B9ECC31E8370EFD171C6054074AF75413576782954B3A3C920C8FF69BA458596C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e5a845412b9dd22c7fa69b8c5bfea226d24a41668383de3eac2c0b8119e874f0
MD5 d72991baa544316bfff75f74bbe74e9a
SHA1 0f8a01a88e7e6e2415a9df83130358ce189b8170
SHA512 0adbbf313449ab0f941f2ee2a4c70c1c3e04a337cc60f1b66f29c63dd034275b1cf3bd975e9d2e233991f2ee7e4058b677cf1e9ac2c8a5041966cf65a5694304
TLSH
T15741BEF7C7E4856EC91156F0BA187E2BCE1D0514432C3D5A89E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 08f2fcdd5905d0a12bf58c87a9efa66e69787349dabacda578695be671d1432b
MD5 c4dfa27e5d339c9fa36a2219ae3420de
SHA1 70a90df743e63644c7b770a70235c67172bc6192
SHA512 c2a23bf3121fba5adba9b09d535389b4e258a288221261a695c0dc41edadecc4fd880fc28e741472e80e9b8e178a62c03237c0684fc5a9399a0447a27df37b51
TLSH
T149419DF787F4856E891156F0BA187E2BCE2D0514832C3D9AC9E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9b2f04d9b9c3f4530f82518455ccd4c7ff34805c1ed3f9c1a12060fe16a4a508
MD5 52c1edfa892422104d77e0db8160eed3
SHA1 94948766f4763517892bfd001e8200abe4ff46d0
SHA512 96c8f3255d21e00d20c99370bf94fc87bfc01fa6afd2ba050e74b7d5d41175f67347dbbad90c7a6b3c35ffb7e28ac40d6492977688c68ee6395bec2ea4a5eed1
TLSH
T1D941AFF7C7F4856E891156F0BA187E2BCE2D0514832C3D9AC9E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 a9b62c54d19c7bcaf9de8d99b5f231aba93a290bcdf7f05299fdadad665abfab
MD5 8791bb2ac7558e179bc92edf64d0e24c
SHA1 dbdeb7d75ea8e515d218b4e65235cf38b5d6634e
SHA512 8d83993ca4c1ed82a76bfd469c46602936a1d86a48b7830f2d004cb5d19c24f393b2f2fe9cba99da9680c85dc1e9fef05bd1ef185488a9d10baa14dd048fd373
TLSH
T196C0126680BAE4B6106A55BA1994B9C16679D435214094E5D9D6C33EE0D00B76B2602E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0903a32e2454fd3ef231acc895e2a6a8afccf44ba25ad1aa79ec8de1221848fb
MD5 28b70f4b22a96e44b912e492fc0af6ed
SHA1 61b4d4ffaa52f2a4106d944ef9e2392c9e8129a9
SHA512 b4995f4e3d7d1e18c0506d47b2b98a69d5b6fd74df78d1888ff2be68e20afd2afc1a0bf37b1c79366c8a97e77fe777f76afc1a70efaf00649a0bce24615a289c
SSDEEP 192:sxR6R0yMqZjK1Ml8wlk/fvs9vMpPZ5NtBWlFzoA8pw/g6+WNIY0X94K6nGvIgjxJ:sxR6PTk/fvs9sRLWew/5Il4K60j7
TLSH
T16962FA056A64597BCCDBE219FA457F53D6F81523F2805E44AAFC9B0C04E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2bd7078017c98616d9597db7addf6f0adc3f9626d7db55dda7049da17ed51b24
MD5 c1cc8fd1cfbc04c26489a2aecaa126f2
SHA1 a867faca907dba919c933595b7163d4b1cd10786
SHA512 1b9120d1b6c25f0a6927632074f1b2c2f2fb821dc058577de2aa8df99c1b54768932ee24c5b23fa0b72c64825a567d2948887de0b46b46653423176cbc3dc24a
SSDEEP 192:sxR6R0yMqZjK1Ml8wlk/fvsbg7dMpPZ5NtBWlFzoA8pw/g6+WNIY0Q94K6nGvIgH:sxR6PTk/fvsbg7SRLWew/5Im4K60+g
TLSH
T1B272EA05AA285A7BCCDBE219FA557F53D6F81523B1805E449AFCDB0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 24291402bfe5e9e818e2e80a8a8a35f147d6b7531c0ea023f88008deaaf3b38e
MD5 d04ebe958761f1b610012a95da247798
SHA1 0cbb923747982d9bbb239a2673833aa371298b93
SHA512 633da97e13e0b8c39458eafb632668b9aa6d7824a402f2dbfdac14f9f047b80e319054ac744da72f91f970b6571aa62f18f59511eca6ddb2af9d71bf1eb2495b
SSDEEP 192:sxR6R0yMqZjK1Ml8UQZlk/fvsbg7dMpPZ5NtBWlFzoA8pw/g6+WNIY0Q94K6nGvH:sxR6PqPk/fvsbg7SRLWew/5Im4K60+g
TLSH
T12572DA15A9284A7BCCDBE219FA557F53D6F81523B1805E44AAFCDB0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 81ba3119c30a8c64c65131dbfd1f4d4bf1aae9b5d672296fea1c7ac78cb272d3
MD5 5cdfef31c9bf6c9ddf459f5ea0f92aba
SHA1 3cbdbc27285543ec2a64175be6af807659c8de8d
SHA512 05759311fb30f033736f133b48185f4e6007f345da0a051323e8615ef405ea6eeaa2e5d893956ca3b07a31489c6c13774f27dc5761c3a2142403f9dae9cf0d32
SSDEEP 768:PXoDFl7pLuL7jGWgoqfjs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsP9RiW5oroVcAX:PXoDFzE7jGWgoqfjsu1jafP9QW5TVcAX
TLSH
T1D8E2FC3B680CCB7E4F84499CED2ABD9B6DE801CB96D88D5447EA840C03C6AEB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 ddae444c4c1c4870f2879161d324fa93fba10fcd580172f69b654b961296d8a1
MD5 5a71857d04e9227bb9ec1f3f7ab1121c
SHA1 d208d73526ae5d944a7ccd849f8a79a066c84f66
SHA512 3b26396b72943ae87312b8c8bde7609373d8a2d2e446677584aa3586723c1c2805d7079a10f9c2ad09c90669158393f635559d7b5d92055bf5d2e64f91edee76
SSDEEP 96:KsGsKXq6SsAKNue68Knqmi8AKpGuJGKK8SurqKEsL0YKxCiOVCKG4psAKRKKOn2n:6H76D7ElhDfFJfpdBJ9XvC79TzZHz7y
TLSH
T1F6C25851797E220138BE2918D1A5896F674230B3301AA63B7BBC60E51EA7E005FFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b8b86d83d05a7a207f205ec7c7c809e95d37be6cd958d06195a4ad862da8fd41
MD5 e724bfc5911e2379ee09a56e83f1200a
SHA1 fdbf4a51fc2b4e72fe5d160b90e64717e0182cc7
SHA512 75d6023df8159b97d85ed271cba66d4b27f1623d502f63b4ee2d18568f478b307836f93a42ac3a3416bda9d84263e1679cb555eab918982fbb56700019113417
SSDEEP 768:mcF1j+96SwgxF7GiyuQW1m1LdHGlfc3Nva:y96uVy8g1LBGpcdva
TLSH
T1CAC24B32E855CE679DEB4FD9B3493647AEF001A388CCAAC8D9D95D0C00972DE174BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1af06268e9d0061c57e7c74105080d343e9e4b0b587e73c4dcefbed362707b7d
MD5 384c3dcd219b7b858ad513276171a5fb
SHA1 a7d161e392d1d8f3311bdb68778466a1c9bdc9f6
SHA512 85dab68acf60790362ab6c0f4c814cb79ec44265b0c1481f6d9671471fa2e199fbbd4792c8af9a5c4cc97736cc7ff8d9bb11589b01781fca93ce1b37412533e6
SSDEEP 768:AcFKj+9VSwgMC7GiyuQW1m1LyHGlfc3Nva:59V3Oy8g1LEGpcdva
TLSH
T1D9C24A32E855CE679DEB4FD9B34A3647AEF001A388C89AC8D9D95D0C00972DE174BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e56efee98a9d78458f513bae42272f7fed2775adf6c78d2b173cce25945f7761
MD5 89baaabe1676e692525487a94369049f
SHA1 ea12fd165382c2d6c80a09d102107fb41aea71d6
SHA512 81652ff0951cc2907addd2c6591a8cb5850ee658118861dc1cf7c3226fe7ee7f2fe9cf7e01679185444bc99e1d36884e123250e68ed778da9b6b0695ee8c39a5
SSDEEP 768:AcFCj+9VSwgMC7GiyuQW1m1LyHGlfc3Nva:B9VTOy8g1LEGpcdva
TLSH
T1BAD24A32E855CE679DEB4FD9B349364BAEF001A388C89EC8D9D95D0C00972DE174BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e5d681badfa502dddf7adc975c3d78c69b492b6ec93d82fb0f803bcfab7e90fb
MD5 b7a47f574624b70bc6d396ea581e1826
SHA1 8e3332eef1ef8f90c60ae547de58fbe5fe0405ee
SHA512 dc15453b0ac346846f3d79c02bb182c6731a1908030992c11e9e0b4f4490dbe9a0a4aa449caa204da8326e4299c29e63ea5118574af9bab5133c675275d9bd33
SSDEEP 384:neiF1tNn/s3n9S/8Nt8TUNTUlIRUUGhn07kQfoFGiyuQnWv9yZlLZyFhBITGT0I+:1F1j+96EwgZ7QGiyuQW1m1Sfi+03vf
TLSH
T17AC24A32DC64DE67DDEA4FD9B309764AAEF001A784C86AC8D9D95D0C00D32ED134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 49ee90a74b1fdb4c9eced77fe079fa689104207a9da1799d6ef2fb6703666e67
MD5 1bac4fe3a0bbc5d5b31453effd0ec49c
SHA1 d7b502e02ddc1606299867b1d926e171fe4c7cd3
SHA512 ea9c424e3de46a2c2a6f1700fa26fcccd62512f665af3655b2815d65e24882fce679af465cc559438020525e739248f2cce3661e3dfc42c0d5eeaa5f9178c821
SSDEEP 768:AeFCj+9VSwgMC7GiyuQW1m1LyHGlfc3Nva:b9VTOy8g1LEGpcdva
TLSH
T16CD24A32E855CE679DEB4FD9B349364BAEF001A388C89EC8D9D95D0C00972DE174BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e5878cf9219f33c260e61df3628ce86137be8bbba76210796b1af1010edd49b2
MD5 68a845f669036abda104ccba8c28dc36
SHA1 0e0d569bddb9e25e1d63ec3a60a0e89d8190f0bc
SHA512 3cc5c171838ef6596c3e56f0aa0274d78216f13b582d97f10f0338c2eae8c863d9d81286cc172525d8204fb2bea156f80d19c10a5246ff81fff0006f74f713a5
TLSH
T1183162E19D3D1AD1C4BE0DAF709B35FC94E8D326F4A070782884EE68463964D254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d5e1dc43a6cde8d8032953194736289ddc9ff566446f913d146e6a0f57fe3a9e
MD5 a7b2f6c3f64c93ca505e6dddc71fb94e
SHA1 a1f80fa04d892114dddfc75c79c8d4e940080f7e
SHA512 bebcc53b23d52c4a41358dbafc7263e1cf6fb9b01587430bd693e2bd60002d8bf6a3b63a8d017fb22fc3b512e397f23f961dabd68b507717ebf9de53f8d2ded1
TLSH
T1314121E19D3C1AD1D4BE09AF749B35FC94E8D736F0A070792C98EE98467964D254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 89817bb10e2cb1e17ed7fd643934981d49618778933e64694132e4806ff028b5
MD5 b42ea831ab46b68c5b73287fa693f2d8
SHA1 87a986d5efbc8b1f66ca6ab75e68bdd0dd9cea4a
SHA512 efeb237aec8cbb98159f43dfc8689ba4c0dde616e19469dc0485d2a7da179fdd892792e8759fb442fae878eb52bebe91a7900bbff700637894d6a3fe57d240a5
TLSH
T1E74142E19C3D19D1C4BE0DAF709B35FC94E8D726F0A030782C98ED58867960D254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a40d3ee22834d1a0460e6930d48410819c07274994c713b68a344704199f9f9f
MD5 9eba15d4ce56044493ad6906c5bda2b1
SHA1 6573403e82de5de614ff103210ff2eb657ee0fca
SHA512 3535378d93ceed0bf425638264db64055c73959465a4a9d16a4704a9f716f29e3b810d82d0112938104bd7ab79675b13ea89fe15256c6acaf0a866c83b58bc0f
TLSH
T1673141E19C3D1AD1C4BE0DAFB09B35FC84E8D326F5A470782898ED68563965E264087F
MD5 SHA1 SHA512 TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 77B
SHA256 bc506b1df37a1af813e5cfba183504fa5fbc08e3ee97851e15c783e5a28c2678
MD5 f544814fe969560811d14a0efa0f92b4
SHA1 95e5cea3a7baa74aaf5511738a81377cfff971f6
SHA512 e193524af46104a371ce8d2a0c8daf37d504e2930ed97b96d26e2aac81afb01931bbdd1563c1fcf58c9ccf079bfb95e4f4f7c39177bb554b6bfd8da0f121ebe9
TLSH
T135A022280028F8BCE08820038C800E2B8C000F0C8B00CFCA0C2EBBACF02FACB0000CAC
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 76359cd4b0349a83337b941332ad042c90351c2bb0a4628307740324c97984cc
MD5 a560bad9e373ea5223792d60bede2b13
SHA1 82a0da9b52741d8994f28ad9ed6cbd3e6d3538fa
SHA512 58a1b4e1580273e1e5021dd2309b1841767d2a4be76ab4a7d4ff11b53fa9de068f6da67bf0dccfb19b4c91351387c0e6e200a2a864ec3fa737a1cb0970c8242c
SSDEEP 24576:pWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2:0t3UCiag6CKM2zCyZuOjJaxSS5qh
TLSH
T15A956C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 1.6MB
SHA256 b6c5cae16842ee494708785256284379ff275558eae0876ba0e06dced2565dc0
MD5 05b806c4c79b05a7d70f0a97f7a9cfcb
SHA1 1548f28e3412f31d8139606c1b274dff3b3e97f5
SHA512 85eaf630868b7edd72590c5e8c9478e2c8b131f49b72b44e0a96663e0c140c3b675781f0eeb15fdfd1073a104f8c47cce2eccaf9a74a46e802814dad8b2eae4e
SSDEEP 24576:uQLuPP4gR6lNR+J34RZd4RqMOYEuphYeT6LMuJp91zIs8om+v5JC8OEzU:uQLuPP41PhRT4AMOYNVRurjIl+yZEzU
TLSH
T133753389C952CB2CC90F57EB8A35F05FA52994EF27612AE2B849EC08C51B56D3C4C1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 196KB
SHA256 6701b16f852f6628a428fe5bd50612dd67bcb37dc6832ae369e02cd9776e7ca2
MD5 2283abbe5b07734ace976b12f7c22690
SHA1 61f3588ef93dd7ccc9a5dcab3e1a5dbf15d196e4
SHA512 d6233f496188d197b9b4d6845ac4216e9bb585eb1a25286f2e3093a69c23cd07055bed50f82c4d0fd7a8815ed654b466a23412212077fe811b039092d2e8f537
SSDEEP 1536:uqV6i3uYy7/qapipOIa1XbzH7KiIfntbCQadBHY+VxJIKLTBU:zeDipOIsvH7KJftPVKxJdu
TLSH
T13014DB6A5E3DAC8EE279C8F577131D81B4FA4C70294A7930E5F26CBD84F99D73182284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9B59.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9B59.tmp
Size 206KB
SHA256 0b04c9424c68304fc9ddff408119c3107eb961850c8247c6bc91c95d54dc94d2
MD5 0dff1c4ea98feb5c6ae0c2f52f30312b
SHA1 ef750041c8fb2d9baa94a27c4512012e343c2f3e
SHA512 2ae383a5dcca25810a76ce0c09e2d08b19362781d786055aa2da93f743ec02ede61333131f1f9f00962b615a1b584cd4e40944041f92cdd31f5e7b5ed1bd797a
SSDEEP 3072:JaoiAjTGzelK8Fxws9LaQcSgMNn8hCQ/Qc04v+ip21UvtdSbL8h:JXiq2oBFOGbhNpPio1Unh
TLSH
T116247C55B7E500B9EC73963489A35606EA727C051B70DAEF0360437ADF2B7D0A93EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cal03sfq.p0o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cal03sfq.p0o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\D3DCompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\chrome_100_percent.pak
Size 148KB
SHA256 7dd5485def22a53c0635efdf8ae900f147ec8c8a22b9ed71c24668075dd605d3
MD5 cb4f128469cd84711ed1c9c02212c7a8
SHA1 8ae60303be80b74163d5c4132de4a465a1eafc52
SHA512 0f0febe4ee321eb09d6a841fe3460d1f5b657b449058653111e7d0f7a9f36620b3d30369e367235948529409a6ce0ce625aede0c61b60926dec4d2c308306277
SSDEEP 3072:iz8JCGIdkwTPaNkx0auKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:iz81Idk8aqT5K18Gb0OV8ld0GecQ3Er2
TLSH
T1ADE3D0E773F4ED7DCAA756F7621600B1EDF3462D0691024A168ED8363A66B48DCC8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\chrome_200_percent.pak
Size 223KB
SHA256 2408969599d3953aae2fb36008e4d0711e30d0bc86fb4d03f8b0577d43c649fa
MD5 e9c1423fe5d139a4c88ba8b107573536
SHA1 46d3efe892044761f19844c4c4b8f9576f9ca43e
SHA512 abf8d4341c6de9c722168d0a9cf7d9bac5f491e1c9bedfe10b69096dcc2ef2cd08ff4d0e7c9b499c9d1f45fdb053eafc31add39d13c8287760f9304af0727bf4
SSDEEP 6144:3DQYajN6svyABnI86fTugx5GMRejnbdZnVE6YoppO4:cfjN6svyABOa6edhVELoXO4
TLSH
T1F124F1DB63F89D7DC9634AB3662601F1ECB2113955B6420B03DFEC357A95B8988C9383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\ffmpeg.dll
Size 2.6MB
SHA256 113ccc8e701157d0d59283baa5dc1fd3b0eae2571fd825084d7a4d58697a5ec2
MD5 64f3f2ae25b14f5d2d168ba6aae49ab6
SHA1 f43554aeb7a1b20b6e9dcbe5408cc004eb7db27a
SHA512 3ffb531da6ef1955f7b71c5f6e9e3322dafce78735aaf9b245c46bd5ccfa8a6a4b282b31b3aacb4e3b423412b9ab89f792ce37f3a9e6eb83983adfe7df38bfcf
SSDEEP 49152:R1nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYF:RJsf83Sn6Ox+tP5F
TLSH
T1F6C5AE12F6D640DDD02DC074879F9623F63038468B24AAEF16909A243F6BFD42E7E765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\libegl.dll
Size 470KB
SHA256 01b8a8c2875ecb9979de339500ce0e0b7ecc3c5387053ce27bea51e6a09e2d72
MD5 b12e3c1e72935273492da1daee50eef1
SHA1 3f93237b71ee1328cf25f8223e685de97d01d773
SHA512 12346000331cde78ea08e9c0fef4635c77f6e85fb0e46706bbec1f23b0d7a7ef99e3930475324306ab4a46587d382ee3beb18d703e2765a8c1b7ece144c57983
SSDEEP 6144:Omi12qlTgeUDsnkcM2nDl83BgENhYCqNSfY24M:Omk2qxgeUDsNnDcgENhYRNSfU
TLSH
T1F4A48E1577E444A9E02BD134CA574642EA76B4820F65FBDF02A493392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\libglesv2.dll
Size 7.7MB
SHA256 fb6ea924fbb9417e4695ce414cdcbc299f13451dbedd2d9adb55479bf1cbf57f
MD5 5082e41d7a57506fe6b4bd58f87276b4
SHA1 2842372c18f49c0e1fd8123891be8587cbf13146
SHA512 9e10d0d3269939f9a497f0b0937f0aeb9ec44627d5349cee589b676aaf95dde11c996e2eda158cf8e79778cfd948b10cb61538c9cc056f7b899a057e7e959f76
SSDEEP 98304:DPqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O:DP4m8TDyluKGugmO
TLSH
T1E5868B03F69680D9C04DD2B5975B9227FA35B8840B34B6CF265423253F77BE0AB7AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\locales\en-US.pak
Size 454KB
SHA256 41123d72bd8e289e85bd35227aabb4cc61fe1de02b5cd7a7834e5ec200bc2078
MD5 5c52a86b21633b55b383c20f16859b2f
SHA1 126585e68cb17f241351004e21c1d30e65de1cf6
SHA512 2a1b6a4becfb97d470cd7de74857edf2cc9cd4a77f377ccd9bf60c30539862ff1ac3ed6cc849632a3ed4ea0e5b92679f3cc5b4cb26cc7eaaa2bb2f4ae9974a6a
SSDEEP 6144:4U0NFUyUGhhA/4miMP9e2qDWfaYe1Vcg5xdxOng5H/thTwB:4jIy1hhYiM9qDvn5zxZTwB
TLSH
T152A44C1FF7441229069352A27F09A5A2FF32D06CA35112567CBD812C33B6B66C37B6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources.pak
Size 5.3MB
SHA256 a5908171bfbb738ac015e7c9903c838d93359ed12c3b7d86545514dc1f0e9d62
MD5 84df318c3fd9ab693dff15582132fc65
SHA1 6b436939d3dd3d5300af46c238c085276bbf1b55
SHA512 189fd83f008c29d9b38e5024975050c8e3dfd5e99a0c5eccec06fce54e865f0d8bef03a4bf3dc3564f2bb640f38259957f8f38e0d39599aec6ecba95eb21f848
SSDEEP 98304:5N9bNj3xZRkPe04srtXK5EmXJfnimTgK5M/AyrwreSjujBrTAVD:tbNTxTk1rlK9gKckreSjuxTK
TLSH
T1B346330677E1913EC82ED33C42494F76169CBA730665712B718C6269FF391AA4E4E0BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\app.asar
Size 6.2MB
SHA256 5df1560047ef41957dd3e3150f80c0de0523c8b8a6282ec9193a0198a3bdbd5b
MD5 3e799270798f128b8bf577bf9d40aa1a
SHA1 0a780a208766bdad6372432dbc59c71071ca4c2b
SHA512 15bc62b4319ec63818bd3f52678479a13912b2882d13534f1f981399b993bab19041897e591c0403f9bfd37e8a685560dabb37d06cf6a592e89ec66bd533b323
SSDEEP 49152:U35zVHjuSB7+gSV3e3EmTpYWUl8or8qxQDNavb7QTuAsxdKTdCpwsiDXJ7jJQfzH:UWAMayQDNavPQ+KTdocCEIRcE16so9hU
TLSH
T1CA667D56B6AA393353B3A1B4552F0007F235851B210CD828F6FC96EC1F68566A1F7FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\_distutils_hack\__init__.py
Size 6KB
SHA256 df81e6bcba34ee3e3952f776551fb669143b9490fdd6c4caeb32609f97e985b4
MD5 e2e3608b836805d400aa2e133c18bf27
SHA1 82006d59dbfd9f8c35b758440e76825e977601e7
SHA512 49b0d63976100d5a808d7a083f2f2f0bfee52f49b5a6d4f21eca2bad6f83c1b6549a25b6bd635fbf5186f2e7acb64d5ea11ba99d78d246d3cae5869de9ab0c98
SSDEEP 96:cnuPveem/bGmdx9pJHPrGXwiLfXsfnCUy01LOq6LIrqCWPANPuqlTl7Frw:cuPGJ/ymdnppaEk0CNsrqoWel7lw
TLSH
T142D16333C8635CC247C7C0F45A86E431FBE558930AB06938BDAD81A82F995E0C9FB1E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\arrow-1.4.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

coloredlogs.pth

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\coloredlogs.pth
Size 147B
SHA256 dda83a855986efa5cd87f0248b0199c0086eb0e8e7fece7d6741959c5ce39536
MD5 d134d790be0a27af05d6d2fb600a7967
SHA1 c19c6c70715b2a9f93ec52b32d9704dd9a67d8bd
SHA512 1c69928c027d6825e508b96a5a0714158bc577e110af1f08d5424165f1b4888d167ecbce0d5915acf870ef8f7475cd88c0ebd89176c53024cb20a6732b612bd0
TLSH
T1D5C08CB04E091C171A16EB3C50268154026B90109FA0424058F0ABB1232232AC592A5A
MD5 SHA1 SHA512 TLSH

Submit Download

distutils-precedence.pth

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\distutils-precedence.pth
Size 151B
SHA256 2638ce9e2500e572a5e0de7faed6661eb569d1b696fcba07b0dd223da5f5d224
MD5 18d27e199b0d26ef9b718ce7ff5a8927
SHA1 ea9c9bfc82ad47e828f508742d7296e69d2226e4
SHA512 b8504949f3ddf0089164b0296e8371d7dcdd4c3761fb17478994f5e6943966528a45a226eba2d5286b9c799f0eb8c99bd20cbd8603a362532b3a65dd058fa42e
TLSH
T1B1C08CF28A022D104091A565CD19261BEDB88F203A567310C66046FE636261C2AD24B0
MD5 SHA1 SHA512 TLSH

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\ipsw_parser-1.7.3.dist-info\WHEEL
Size 91B
SHA256 69e6228a0d35958183cc1812f07c565ce837b95eb51bd8a33acba9fa4f68d6c9
MD5 0be2025a54a57ff313e1e195f0f36c31
SHA1 56fe5f173d8fd4262ef44b9dd48b1d5f49d84c35
SHA512 954357134d02734c367490733ee2cf2135e69bdfabb633f37dee965359bb115f2ede7feafaed3ab5266c21aca86f41023b36e1ffd527fe13cedf584e9a81ea20
TLSH
T1E7B01215454014F814E0EE138074A4202B6085455996507DB04512446559D4446CDD5E
MD5 SHA1 SHA512 TLSH

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\markdown_it_py-4.2.0.dist-info\WHEEL
Size 82B
SHA256 1b68144734c4b66791f27add5d425f3620775585718a03d0f9b110ba3a4d88db
MD5 eca1d2e32987c5c9fd85f21a0c92d672
SHA1 918c96cf4b87d846161401284f9bf811c56b5fcf
SHA512 c4256b480eefa97b455e5e0f716884b554edb99c7a3e4b116a46590c63acf14ea14ff52c5814f5c8bfca2b4a309bda65de07b72fe8731a235478eb7e5e7e2d7c
TLSH
T170A01218014004F80090FE034239A1281A308509646500B5948101445545D0802C8DBA
MD5 SHA1 SHA512 TLSH

Submit Download

__main__.py

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\pymobiledevice3\__main__.py
Size 16KB
SHA256 b4be3b458e5656d854152d5aeac98880cd4568a377ccbaee0de155e752f5f071
MD5 da75e7da0f406785f7b490ec5dae4d24
SHA1 a8779f3502196f329f0d58387b50796dd830fd64
SHA512 e1e830d96e02246b8960121c287157f20b74d6be118cc406ef098ed39d3ca6f1e3506870409ef197e3f79c2300aa23e93a4fc598b2b0e99919a7625727739259
SSDEEP 192:U3/WwmxnqR++TNIXx1/uHp3fAblYpf1rbvFm04jbigjyfN0iqCGByoWthuLi:U+wWnqRNI3/uJ3fAb+ptL+bi8kuByo9m
TLSH
T13B72B522C66A28675793C8A52C16E501633246431F147879B5FCA37C2F8E379C2FB79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\python_pcapng-2.1.1.dist-info\LICENSE
Size 11KB
SHA256 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30
MD5 3b83ef96387f14655fc854ddc3c6bd57
SHA1 2b8b815229aa8a61e483fb4ba0588b8b6c491890
SHA512 98f6b79b778f7b0a15415bd750c3a8a097d650511cb4ec8115188e115c47053fe700f578895c097051c9bc3dfb6197c2b13a15de203273e1a3218884f86e90e8
SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
TLSH
T11632623FBA48037706C20162BB9764CBF21E903F3B552568354CC1681F6BA6543FB6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywin32.pth

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\pywin32.pth
Size 185B
SHA256 e7cd73df98b91c407dfd96d1f4dd18b7f9a60f29902b92cf5ece79b6eb637b81
MD5 d62755632241f6066d0fbb8b12bae1c5
SHA1 21fd0f62a1019a8c3c78f219f7f6bbb9a9ddc05e
SHA512 baecfff5f0092cee697bb9936cd69af6cc369ef9a5a03c65dc895c336e307ee95d7f5dc23b3ccb7268e0213568818d7a4a44139cd0130a8b5f6fff13895bc7e1
TLSH
T101C0C0634E64D391733B1D5CC07C50B2D075638E04E3300E40C9C6280F067121381400
MD5 SHA1 SHA512 TLSH

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\WHEEL
Size 91B
SHA256 ff309ddcdd65ebd02bc724dbf2bcc4a0ff53a5b61792a44548d383e4ebb19d3b
MD5 08dd01ac2afdbb287cc668d51c7056c8
SHA1 e7224da97ededfb9d0239cf7cade76ebe3997743
SHA512 917f7621e0d457d149964de3cddf50fe49be13388879f60ed818eaecdf5080864386c9cf2474dc2e514907935983d73dee1967b404f2941edced73856a1d6d1e
TLSH
T1B7B012150A4115F814A0EE134068A1201A70854799956079B14A03446549D1406CDC5E
MD5 SHA1 SHA512 TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\setuptools\_vendor\jaraco_context-6.1.0.dist-info\INSTALLER
Size 2B
SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
MD5 45210da832f9626829457a65e9e7c4d0
SHA1 ad5dd33dfa81a91517182f453879cc056a9f1230
SHA512 00a0bdd98e82b3077db4b7cf7746140c204af743c208484934d7cb46b1c55bd31c8a29bd756d3c1eab8737df20f565c0b2a1c4e19b7c9a2785ca091696761cbc
MD5 SHA1 SHA512

Submit Download

Conakry

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\Africa\Conakry
Size 130B
SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
MD5 796a57137d718e4fa3db8ef611f18e61
SHA1 23f0868c618aee82234605f5a0002356042e9349
SHA512 64a8de7d9e2e612a6e9438f2de598b11fecc5252052d92278c96dd6019abe7465e11c995e009dfbc76362080217e9df9091114bdbd1431828842348390cb997b
TLSH
T15FC00289B7080942C45063B90D8723A8DF15C009D53153B338187208CCAA9D42E145C5
MD5 SHA1 SHA512 TLSH

Submit Download

Djibouti

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\Africa\Djibouti
Size 191B
SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
MD5 fe54394a3dcf951bad3c293980109dd2
SHA1 4650b524081009959e8487ed97c07a331c13fd2d
SHA512 fe4cf1dd66ae0739f1051be91d729efebde5459967bbe41adbdd3330d84d167a7f8db6d4974225cb75e3b2d207480dfb3862f2b1dda717f33b9c11d33dcac418
TLSH
T105C02B886B10D0B0F08148348EF30606DE51C3B8032200F37C0C281003740602A460E0
MD5 SHA1 SHA512 TLSH

Submit Download

Kigali

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\Africa\Kigali
Size 131B
SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
MD5 9c92339423e915befec45cc4752a75ce
SHA1 d336e337b0cafc1205ba041fac447b8ae3074dbe
SHA512 e5a3a1ab74a2620743964583ab960be126448ed013b57393eca6b397ac020de0be5763b6d40443b1976e0d3e6a533e8c46123fcb0428e5e233b076cf9ba69667
TLSH
T1D5C02200F30C882AC00003FA0BAF0300AC0BC200CB0022B328203008CCCA0802E003C0
MD5 SHA1 SHA512 TLSH

Submit Download

Lagos

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\Africa\Lagos
Size 180B
SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
MD5 89de77d185e9a76612bd5f9fb043a9c2
SHA1 0c58600cb28c94c8642dedb01ac1c3ce84ee9acf
SHA512 e2fb974fa770639d56edc5f267306be7ee9b00b9b214a06739c0dad0403903d8432e1c7b9d4322a8c9c31bd1faa8083e262f9d851c29562883ca3933e01d018c
TLSH
T14FC012C073B00497CA50773C0FA32AD3DE018914CAAA37EB2954158C09790D07AAB9E8
MD5 SHA1 SHA512 TLSH

Submit Download

Curacao

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\America\Curacao
Size 177B
SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
MD5 92d3b867243120ea811c24c038e5b053
SHA1 ade39dfb24b20a67d3ac8cc7f59d364904934174
SHA512 1eee8298dffa70049439884f269f90c0babcc8e94c5ccb595f12c8cfe3ad12d52b2d82a5853d0ff4a0e4d6069458cc1517b7535278b2fdef145e024e3531daad
TLSH
T15AC01205BB415584E2E177B503F703D7CE1C80048C00DEABF907369508B88503FB0C80
MD5 SHA1 SHA512 TLSH

Submit Download

Toronto

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\America\Toronto
Size 1KB
SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
MD5 3fa8a9428d799763fa7ea205c02deb93
SHA1 222b74b3605024b3d9ed133a3a7419986adcc977
SHA512 107a4dbb64107f781e3ed17b505baea28d4ca6683c2b49d146dda41c28ca3f9c307809ed938e4152011e199a7be6913de6f7b78cafe8ef300dc3034397945238
TLSH
T1143183969418B8DFDF0145B90560C03CCB6431C30B2B91C6C74D67402578F5D89A5DF6
MD5 SHA1 SHA512 TLSH

Submit Download

EST

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\EST
Size 149B
SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
MD5 595e67b4c97fda031a90e5ef80813e7d
SHA1 7194eb1a70c1acc1749c19617601595d910b9744
SHA512 27925a87379552403a0960c2ec191994610bc05b2d67fb1fbbeeb6086a16091bdc69449bce3426b31a2775f3845ed8cc07d1882f8b3b4e63f437775a2eea5d76
TLSH
T1C3C01214B7480A16C55132BA2A410100CC044300A12202B36C4C231804585C26630182
MD5 SHA1 SHA512 TLSH

Submit Download

Greenwich

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\Etc\Greenwich
Size 111B
SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
MD5 e7577ad74319a942781e7153a97d7690
SHA1 91d9c2bf1cbb44214a808e923469d2153b3f9a3f
SHA512 b4bc0ddba238fcab00c99987ea7bd5d5fa15967eceba6a2455ecd1d81679b4c76182b5a9e10c004b55dc98abc68ce0912d4f42547b24a22b0f5f0f90117e2b55
MD5 SHA1 SHA512

Submit Download

London

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\Europe\London
Size 1KB
SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
MD5 d111147703d04769072d1b824d0ddc0c
SHA1 0c99c01cad245400194d78f9023bd92ee511fbb1
SHA512 21502d194dfd89ac66f3df6610cb7725936f69faafb6597d4c22cec9d5e40965d05dd7111de9089bc119ec2b701fea664d3cb291b20ae04d59bcbd79e681d07a
TLSH
T17631710B85868B0AD0FC277A3AF3A3056D584588D3AE8161F4ECC3E896FA3095D6D8C0
MD5 SHA1 SHA512 TLSH

Submit Download

Oslo

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\Europe\Oslo
Size 705B
SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
MD5 2577d6d2ba90616ca47c8ee8d9fbca20
SHA1 e8f7079796d21c70589f90d7682f730ed236afd4
SHA512 f228ca1ef2756f955566513d7480d779b10b74a8780f2c3f1768730a1a9ae54c5ac44890d0690b59df70c4194a414f276f59bb29389f6fa29719cb06cb946ceb
TLSH
T15E0120325142CA46D19C20F5077468D30F45168D4B9C02FF5739D12B77F03901D420D0
MD5 SHA1 SHA512 TLSH

Submit Download

Skopje

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\Europe\Skopje
Size 478B
SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
MD5 a4ac1780d547f4e4c41cab4c6cf1d76d
SHA1 9033138c20102912b7078149abc940ea83268587
SHA512 7fd5c4598f9d61a3888b4831b0c256ac8c07a5ae28123f969549ae3085a77fece562a09805c44eab7973765d850f6c58f9fcf42582bdd7fd0cdba6cd3d432469
TLSH
T175F0267651228F48D11C94BA1718A91B4FA4530ECB8C03B226A9A91E527CBE4EE060E4
MD5 SHA1 SHA512 TLSH

Submit Download

MET

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\MET
Size 1KB
SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
MD5 7a350885dea1ebe1bf630eb4254e9abc
SHA1 5036277ce20a4d75d228cf82a07ed8e56c22e197
SHA512 524ed4fb0c158a1d526dd9071df7111fb78940d468e964bf63ba5418f9b551ec28c38fa1dc2711415aa31f926d8729eac63d6b1e2946b7942ce822f09d00c5ae
TLSH
T18B11001AA1138BFAF86C74B53A605DC24745368C98BF516DD52C53E951B4F5499024F0
MD5 SHA1 SHA512 TLSH

Submit Download

PRC

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\PRC
Size 393B
SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
MD5 dff9cd919f10d25842d1381cdff9f7f7
SHA1 2aa2d896e8dde7bc74cb502cd8bff5a2a19b511f
SHA512 c6f4ef7e4961d9f5ae353a5a54d5263fea784255884f7c18728e05806d7c80247a2af5d9999d805f40b0cc86a580a3e2e81135fdd49d62876a15e1ab50e148b7
TLSH
T1EBE0C20C52681DCAD3ADF3FA265589A68B01E1838F52159B1446AA0DA57FB9618180F0
MD5 SHA1 SHA512 TLSH

Submit Download

Wallis

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\Pacific\Wallis
Size 134B
SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
MD5 ba8d62a6ed66f462087e00ad76f7354d
SHA1 584a5063b3f9c2c1159cebea8ea2813e105f3173
SHA512 9c5dba4f7c71d5c753895cbfdb01e18b9195f7aad971948eb8e8817b7aca9b7531ca250cdce0e01a5b97ba42c1c9049fd93a2f1ed886ef9779a54babd969f761
TLSH
T146C00280F71818D3C455577E058F17949D57D6418D0287B7398A34CDFD983916B288D0
MD5 SHA1 SHA512 TLSH

Submit Download

Yap

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\Pacific\Yap
Size 154B
SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
MD5 bcf8aa818432d7ae244087c7306bcb23
SHA1 5a91d56826d9fc9bc84c408c581a12127690ed11
SHA512 d5721c5bf8e1df68fbe2c83bb5cd1edea331f8be7f2a7ef7a6c45f1c656857f2f981adb2c82d8b380c88b1ddea6abb20d692c45403f9562448908637d70fa221
TLSH
T10AC0120162E70C0AC660023505494793DD48D50180062BDB24041199F47D78136000C2
MD5 SHA1 SHA512 TLSH

Submit Download

UCT

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\UCT
Size 111B
SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
MD5 51d8a0e68892ebf0854a1b4250ffb26b
SHA1 b3ea2db080cd92273d70a8795d1f6378ac1d2b74
SHA512 4d0def0cd33012754835b27078d64141503c8762e7fb0f74ac669b8e2768deeba14900feef6174f65b1c3dd2ea0ce9a73bba499275c1c75bcae91cd266262b78
MD5 SHA1 SHA512

Submit Download

Mountain

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\tzdata\zoneinfo\US\Mountain
Size 1KB
SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
MD5 c1b9655d5b1ce7fbc9ac213e921acc88
SHA1 064be7292142a188c73bf9438d382002c373c342
SHA512 2a188d7bcc48acc17b229e50e136b55dbc59058ae9be6ef217238cd1b6c0a59817954ab98817d2e2ff836a6f7d7461be5850ad73a9096d7a14ce9fd8c2a3c29a
TLSH
T1961120C9AAE1B575E15D543047B3D0800CAC48855F0FC98F20BEB52A8EF6B5936741A9
MD5 SHA1 SHA512 TLSH

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\urllib3-2.7.0.dist-info\WHEEL
Size 87B
SHA256 41c708c5adba6e097513ab8ccb9f1d7865a2fb469e22491a9e01dcc64da459fc
MD5 7412a649a466b9dd567141f836b1e222
SHA1 c0469b77bdc66a90f54f6456522a384c7d92728c
SHA512 49119a9782509253afe7c6db60a607faa432c2aa4302f710f9dda77b713f3b3f627b97efe28bbe334df01a10d7f86bf2f975d539a5be456bfc56a0c384e1553a
TLSH
T125B01228014014F41810FF13402C70341720C105B4A52039D44601407507D1402EDC6A
MD5 SHA1 SHA512 TLSH

Submit Download

pywin32_bootstrap.py

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\win32\lib\pywin32_bootstrap.py
Size 772B
SHA256 fd31f27bc85a6b9c974670838b6eefafb32991be4a9f840f96a4f5524df3b3c3
MD5 918671080b8627410234eaefefc7bd02
SHA1 c2e77a59fc774cb4fabe0e8a1af0cc0ce553afaa
SHA512 4b623c7b70bbcf9da11da64bcd5f029e7b4946ad95d609e07aecdaaf54f3a284738f36f0cb5f007aaa15404c6d4615f37b154466c67483c86c7dfff6a4d2fb88
TLSH
T11F01B1728645509707B19F1A685990B49BA1B2FBD641082873CCC7744F75B720F65D2A
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Lib\site-packages\win32comext\internet\__init__.py
Size 139B
SHA256 dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13
MD5 da92f5ad66e2a4e86379790c619c8732
SHA1 ae0b9ff8629a24c30b9a9444edb9d2c5105ae701
SHA512 03a60f8d8c8b02c508feb8836d2fd37517d75fc3afe02833c3a7279c06ab0401d575a2a234b0da01737d166e16c728c3f3ca8fdd4a76cd0d9c5a7da0075749d2
TLSH
T12BC02B104450224060336D5202320BE30B5EFCEF1067E0D1E31CC7142F1219844D7014
MD5 SHA1 SHA512 TLSH

Submit Download

idna.exe

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\Scripts\idna.exe
Size 105KB
SHA256 60e0dc42730278b3d650e031c3d4a0f79b7a920accaf8f52090855b99931708b
MD5 29d84fa7815d01a723382d08ca57bf50
SHA1 913eed067ba7ee2d69dfe47a79540fc349614e13
SHA512 0649d2809675e166840be08daecce938b8f386efe35e506a42ffedaf285010f419db8014ec4dce5cffe41562bac3466d126c5131bf0b835a1f5a74294eaf1d6f
SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+Gu4:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+l4
TLSH
T1CBB36A0A33D420FDD0675274CDB68A15D3B2BC2A4674934F27A47B6A1F733926D2E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python.exe

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python.exe
Size 101KB
SHA256 62ebc90a2884bb63a0cd67e789cafdd51e771eee043587e2354327b4ccc9bb05
MD5 c6ed974729d66dc7877bde3e966b460d
SHA1 d61806703f7b6d676bdd654e329c2e82348ac86c
SHA512 a865fda1b619674372871ee44a33d233f6025026295f6db896530bc6282dcc8f1f921c117570be7fce4b833a85dc02716d236a8688338e0bb2def256ed127bdb
SSDEEP 1536:Gj1hKbuEYE+9z2wp+FavGmhMn+IhzZtzc/sER47Syf58:GBhKbuAs0FNmhMn+IhNe/sER4L8
TLSH
T193A3E44A6A5F8190D4748471037B87F65B2C2E22A9C3C68DA7C57F16EA7C2C1F909B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python3.DLL
Size 68KB
SHA256 a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
MD5 16855ebef31c5b1ebe767f1c617645b3
SHA1 315521f3a748abfa35cd4d48e8dd09d0556d989b
SHA512 c3957b3bd36b10c7ad6ea1ff3bc7bd65cdceb3e6b4195a25d0649aa0da179276ce170da903d77b50a38fc3d5147a45be32dbcfdbfbf76cc46301199c529adea4
SSDEEP 768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
TLSH
T14B635CD26B57F8A2D6F669FC38DD99CD142B12CC83258DDFA57893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313._pth

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python313._pth
Size 79B
SHA256 6f230f01e18429c383477763de66951745acda9c70aa5885eba4c4f0fb0fbb62
MD5 5388370a1de3a5a5b7997ca749aaa442
SHA1 0819c130b9f2b55bb009aeeb209605aa4ed05d39
SHA512 02046d21bc30af553a7547a6c46edd01a5cbacf4d532ec55b4036a0d0f5377a446fbdb367fa40b40db90f86783090f6bb2369bf625e012bbf76af628f759365e
TLSH
T142A0220208A30080002020A83FC022F88F323308BB002A0E88C22E380B00E30AAE202F
MD5 SHA1 SHA512 TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python313.dll
Size 5.8MB
SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
MD5 b9de917b925dd246b709bb4233777efd
SHA1 775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
SHA512 f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33
SSDEEP 49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
TLSH
T1E9568D16729D40ADC97B8078CA038A4BF7B27C417F60534B61A6BB5E2F733624B6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.zip

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\resources\python\python313.zip
Size 3.6MB
SHA256 4141b13fe0ce35edfc1c819f1f3366e1476f99221ef042b270bd6f8ca6aaf35a
MD5 9f582bef4036eedd2cc9784bd4777f90
SHA1 705b523441ec740d231736f382ea1f0eab27880d
SHA512 ae072670a2831da80bd10c82fb972f584e881923db0b7e880499da63409ddce43e285146a749ac87356986194afb6255257ad97c4b90bf3b08f30b8895d998e7
SSDEEP 98304:LPOjM+CF0ivYa0SqUHaUdjarR6NWc7xhvvzckxh6FD7qqlc1:F/0ilf6VrR6NFhvvQkxhWHVO
TLSH
T1AD063321DD3D8106DDD3B7BCB231DD0A962C0F81B2149ABE1C4DDBA26D6E5A11F4F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\squirrel.exe
Size 2.0MB
SHA256 06e8deb39630711baac76cf4aa0f5b57ede938d5ed2868633414adc0f3db9f5e
MD5 76fb8f654ab5bf56bc9048d0ce4f4a16
SHA1 82ee3019e269dd5065c091f5509b14460f8b731c
SHA512 72e9e2bb94507ba129335cb3cd605f7358e3d6a4c8fc9aee4a945c7fe6c968dd39c0b426fe4dc34b3eedc8c0488afeed643330567cc3d6214fef85850a8fb7c9
SSDEEP 24576:6WltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9mhR:Lt3UCiag6CKM2zCyZuOjJaxSS5qhK
TLSH
T1A8A58D05EBEC9F1BE16F9AB6A031094423F3E8917366F78BA688747D6AD37405D01393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\v8_context_snapshot.bin
Size 646KB
SHA256 a8bd22478c4f85afa836c89d3a7f52c606b17872fbbefce268b499bedede10ae
MD5 a62fbbb671bf975ed46b42d9cf437bcd
SHA1 408b595b1dc6658533e0db1d35f509ab9ee70525
SHA512 87c934670df70afcced0ea5c73449a17ad27d5b6a25cedad9eb61634aaff8a42b713f578e861c2efbc77593793bba240a1495822b69c99a8ecaef64b07b6a62c
SSDEEP 12288:f97k1vtORkeGWFDjesZeLEY4QUH7zRpA8W:f97k1v42eGWFDjZ427/RpAB
TLSH
T1A0E4B5A2B784EF56E1DA6EB0DDFAEB923234F5D99E0B419B7149036E323D7242D0450C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\vk_swiftshader.dll
Size 5.2MB
SHA256 7005598f9bb8559101458ddaac77e3a23f9876c0a1aaf7136a11f2d1d5173448
MD5 15d9ca6f1d87f15f5c67740df2bfa874
SHA1 6d84c52d33249b216223e02cb445b886bea6b45c
SHA512 24796d3aded0a49713489b285b9d38fd041a7376e900684053c1df106a509a315db9e646c7286fd59c79c664557e6d4e6843a55828abf04fc04d8b307829fc6f
SSDEEP 49152:IgQpJ5yZBtfCp00oSO8hCsDsbJQk/tJ4q0nLhII1ytiT45z+WEjNHsRLf7OFJOMZ:4n5yZBXLxkf5FJIaye
TLSH
T15D463903B2858099F05DD1B9474BA623F632F8801B72B6DF52A41F192E77FE06B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\vanish\app-1.2.4\vulkan-1.dll
Size 938KB
SHA256 45adc3dac19684ed3af159ae3914fbbf2426a879e5a4c1e678e3c9b451fab01a
MD5 8bd643a9f7ef2619b792cf2544f27a8c
SHA1 8d5aba34d852c9b9f62a4dca5ca138dbc458c931
SHA512 8a81c4edde9d20ee24d3390338915f096a27956bf57815c443a37f15bdb4072a0c959376721d2354fd565045efb3340922a9a22f3293bb3784cc6df6a0ac353b
SSDEEP 24576:gawxZ1onv5Sp+D9R6StDWb36Z5W1DYsHq6g3P0zAk7Mh:dSSApY90IDWb36Z5W1DYsHq6g3P0zAkw
TLSH
T163155B23AA94456AD476D034D9828603CAB178911726B9CF03B81708BF6FFF4777DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Vanish\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Vanish\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Vanish\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Vanish\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Vanish\Network\Network Persistent State
Size 840B
SHA256 9603f7ebc2196f620497d0819cba666b233172ebc41d6eed5dfe9a67677aac0e
MD5 f9419cfd3ded2bd68265933bef5f900d
SHA1 0a18cd3fb6a17b6eff2f611e6982fadb5298ff84
SHA512 b78127f397825c8b62636b62872568f6009db6f49b07caf8fb389d8ee67388ab0c93c9136b304583097bafb8ee883a41e7c2cb40b672062f4365fc4ea85e7dcf
TLSH
T1E10148EBC3B4097E8751D2FA2A112E93C5FE0028135C6CA389D45B8D47B5972A54108E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59d0e3.TMP

Path C:\Users\Admin\AppData\Roaming\Vanish\Network\Network Persistent State~RFe59d0e3.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2168-5394-0x000002AEF4240000-0x000002AEF42F2000-memory.dmp

Download

memory/2220-4980-0x000001CA4C4B0000-0x000001CA4C562000-memory.dmp

Download

memory/2308-5533-0x00000192F3BF0000-0x00000192F3CA2000-memory.dmp

Download

memory/2580-4889-0x000002C9A6AA0000-0x000002C9A6B52000-memory.dmp

Download

memory/2664-4430-0x0000000001080000-0x00000000010A0000-memory.dmp

Download

memory/2968-5496-0x00000137F6590000-0x00000137F6642000-memory.dmp

Download

memory/3012-5310-0x000001A072850000-0x000001A072902000-memory.dmp

Download

memory/3128-4710-0x00000231F2500000-0x00000231F25B2000-memory.dmp

Download

memory/4260-5465-0x0000021CC2500000-0x0000021CC25B2000-memory.dmp

Download

memory/4412-4637-0x0000027764D00000-0x0000027764DB2000-memory.dmp

Download

memory/4516-4988-0x0000016826AA0000-0x0000016826AA1000-memory.dmp

Download

memory/4516-4992-0x0000016826AA0000-0x0000016826AA1000-memory.dmp

Download

memory/4516-4991-0x0000016826AA0000-0x0000016826AA1000-memory.dmp

Download

memory/4516-4990-0x0000016826AA0000-0x0000016826AA1000-memory.dmp

Download

memory/4516-4989-0x0000016826AA0000-0x0000016826AA1000-memory.dmp

Download

memory/4516-4983-0x0000016826AA0000-0x0000016826AA1000-memory.dmp

Download

memory/4516-4987-0x0000016826AA0000-0x0000016826AA1000-memory.dmp

Download

memory/4516-4981-0x0000016826AA0000-0x0000016826AA1000-memory.dmp

Download

memory/4568-4666-0x0000029DEB7E0000-0x0000029DEB892000-memory.dmp

Download

memory/4872-5642-0x0000025361CF0000-0x0000025361DA2000-memory.dmp

Download

memory/4884-5057-0x000001AB568E0000-0x000001AB56992000-memory.dmp

Download

memory/5320-4608-0x000001B44D660000-0x000001B44D68A000-memory.dmp

Download

memory/5320-4604-0x000001B44D260000-0x000001B44D27E000-memory.dmp

Download

memory/5320-4606-0x000001B44D870000-0x000001B44DA74000-memory.dmp

Download

memory/5320-4607-0x000001B44D360000-0x000001B44D37A000-memory.dmp

Download

memory/5320-4609-0x000001B44D260000-0x000001B44D268000-memory.dmp

Download

memory/5320-4595-0x000001B44CF90000-0x000001B44CFB2000-memory.dmp

Download

memory/5320-4605-0x000001B44D280000-0x000001B44D332000-memory.dmp

Download

memory/5320-4610-0x000001B44D270000-0x000001B44D276000-memory.dmp

Download

memory/5320-4611-0x000001B44D340000-0x000001B44D34A000-memory.dmp

Download

memory/5320-4613-0x000001B44D3B0000-0x000001B44D3D6000-memory.dmp

Download

memory/5320-4612-0x000001B44D350000-0x000001B44D358000-memory.dmp

Download

memory/5600-10-0x0000000000F80000-0x0000000001156000-memory.dmp

Download

memory/5600-4034-0x0000000021C70000-0x0000000021C7E000-memory.dmp

Download

memory/5600-4030-0x0000000021CA0000-0x0000000021CDE000-memory.dmp

Download

memory/6044-4651-0x000001B2A8140000-0x000001B2A81F2000-memory.dmp

Download

memory/6140-4619-0x00000243BF6F0000-0x00000243BF7A2000-memory.dmp

Download

memory/6140-4486-0x00007FFC3A890000-0x00007FFC3A891000-memory.dmp

Download

memory/6140-5348-0x00000243BF6F0000-0x00000243BF7A2000-memory.dmp

Download

memory/6140-4487-0x00007FFC3AE20000-0x00007FFC3AE21000-memory.dmp

Download

memory/6300-5673-0x00000209BCD10000-0x00000209BCDC2000-memory.dmp

Download

memory/6412-5581-0x000002231EB80000-0x000002231EC32000-memory.dmp

Download

memory/6448-5211-0x000002A17A5A0000-0x000002A17A652000-memory.dmp

Download

memory/6600-4416-0x0000000000CB0000-0x0000000000EB6000-memory.dmp

Download

memory/6708-4557-0x000000001C2A0000-0x000000001C7C8000-memory.dmp

Download