Analysis
- user interaction
yes - max time kernel
360s - max time network
359s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
12/07/2026, 15:01
General
- Target https://gofile.io/d/98uddT
- Sample260712-sd17aad18z
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 15 IoCs
- Loads dropped DLL 46 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 56 IoCs
- Suspicious use of SendNotifyMessage 18 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/98uddT1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2b4,0x7ffdd5bbc188,0x7ffdd5bbc194,0x7ffdd5bbc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,11087972852552269784,13331652709857409390,262144 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,16938846798594358143,1847131438685150951,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,18120003753565320694,11520102294053930543,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,612918910803056310,5785819582963929144,2097152 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,12587306603071832590,13147484581832816396,2097152 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,6467844573462338569,7834887491513694524,2097152 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,2615814494587528057,8851699429028088735,2097152 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3820,i,7941202724455327858,8962360275170230809,2097152 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,5949790739027001010,5628616138598586130,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,4876209927446691973,12654956401203765707,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,15032936754787638208,518355083932216097,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,15032936754787638208,518355083932216097,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6012,i,754250988451382600,6454404847152003090,2097152 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4600,i,850589235385757963,3215664329323598657,2097152 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6592,i,15415274657463567739,3299477447072260481,2097152 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,11825974540049244753,11748074629488000443,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5352,i,15144677451085515132,3769564278007471897,2097152 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7360,i,5803114593234617755,7930949469060340508,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6044,i,9706669331112078140,17413744688565892070,2097152 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4592,i,6828351391629383930,15257317595004273831,2097152 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6628,i,763754579167886820,10515885201798583622,2097152 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7924,i,13541825492529563545,6249096525294484391,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7864,i,6806676094472247937,5421142032715257784,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7844,i,13126928912713079362,13360841629125752632,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5592,i,5825563973776569189,16430552174906767169,2097152 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,11975223663355256236,10685194654682885078,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7220,i,11269365092416216891,12629631308371984537,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\python-3.11.0-amd64.exe"C:\Users\Admin\Downloads\python-3.11.0-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{BDDBDFCF-FBB0-40BD-9F83-F1108E5AAA26}\.cr\python-3.11.0-amd64.exe"C:\Windows\Temp\{BDDBDFCF-FBB0-40BD-9F83-F1108E5AAA26}\.cr\python-3.11.0-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.11.0-amd64.exe" -burn.filehandle.attached=596 -burn.filehandle.self=7363⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\Temp\{3F1AF1CD-7BF7-4C52-9A0C-E62F802D87AD}\.be\python-3.11.0-amd64.exe"C:\Windows\Temp\{3F1AF1CD-7BF7-4C52-9A0C-E62F802D87AD}\.be\python-3.11.0-amd64.exe" -q -burn.elevated BurnPipe.{62B5F405-7494-4EDE-83B9-8AECD1DA1296} {B0E2322F-CED4-41A1-BE4C-B97316578C00} 57164⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\pythonw.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\pythonw.exe" -c "import winreg; winreg.SetValueEx(winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\FileSystem'), 'LongPathsEnabled', None, winreg.REG_DWORD, 1)"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7900,i,15860250675575153516,6033593820705864247,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7748,i,14354789610022829342,812766541401185423,262144 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,1602395052578722488,12741614077818004728,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,7862965340729909581,14254304460288281712,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,4198945108025862388,7146152784820339599,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\python-3.11.0-amd64.exe"C:\Users\Admin\Downloads\python-3.11.0-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{8B5E3B37-ABE9-4C28-BF18-CA57755D6860}\.cr\python-3.11.0-amd64.exe"C:\Windows\Temp\{8B5E3B37-ABE9-4C28-BF18-CA57755D6860}\.cr\python-3.11.0-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.11.0-amd64.exe" -burn.filehandle.attached=576 -burn.filehandle.self=5843⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\pythonw.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\pythonw.exe" -c "import winreg; winreg.SetValueEx(winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\FileSystem'), 'LongPathsEnabled', None, winreg.REG_DWORD, 1)"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,16952049032352044603,12077859289271041843,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,2316134606257719649,17596912944392042805,524288 --field-trial-handle=2332,i,159220572397525213,7267298058574365839,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5722A047EAF8B3E9FA5DFED12248C7F82⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" -E -s -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.11.0 (64-bit)_20260712160223.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.11.0 (64-bit)_20260712160223.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe" -q -burn.elevated BurnPipe.{663D8FBA-E65E-4D2F-83BC-F02B6BD8D768} {D892003B-F76F-4597-B595-EB892CF58A10} 13604⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\bwc wuqz balls\bwc wuqz balls\Install.bat"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\bwc wuqz balls\bwc wuqz balls\Install.bat"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\bwc wuqz balls\bwc wuqz balls\Install.bat" "1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\bwc wuqz balls\bwc wuqz balls\Install.bat" "1⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\bwc wuqz balls\bwc wuqz balls\Install.bat" "1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exepython2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\bwc wuqz balls\bwc wuqz balls\Install.bat"1⤵
-
C:\Users\Admin\Downloads\bwc wuqz balls\bwc wuqz balls\bwc.exe"C:\Users\Admin\Downloads\bwc wuqz balls\bwc wuqz balls\bwc.exe"1⤵
-
C:\Users\Admin\Downloads\bwc wuqz balls\bwc wuqz balls\bwc.exe"C:\Users\Admin\Downloads\bwc wuqz balls\bwc wuqz balls\bwc.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title bwc wuqz balls3⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exepython --version2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\bwc wuqz balls\bwc wuqz balls\Install.bat"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\bwc wuqz balls\bwc wuqz balls\Install.bat" "1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\bwc wuqz balls\bwc wuqz balls\Install.bat" "1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5a7e7b.rbs
e5a7e80.rbs
e5a7e85.rbs
e5a7e8a.rbs
e5a7e8e.rbs
e5a7e8f.rbf
e5a7e90.rbf
e5a7e91.rbf
e5a7e92.rbf
e5a7e93.rbf
e5a7e94.rbf
e5a7e95.rbf
e5a7e96.rbf
e5a7e97.rbf
e5a7e98.rbf
e5a7e99.rbf
e5a7e9a.rbf
e5a7e9b.rbf
e5a7e9c.rbf
e5a7e9d.rbf
e5a7e9e.rbf
e5a7e9f.rbf
e5a7ea0.rbf
e5a7ea1.rbf
e5a7ea2.rbf
e5a7ea3.rbf
e5a7ea4.rbf
e5a7ea5.rbf
e5a7ea6.rbf
e5a7ea7.rbf
e5a7ea8.rbf
e5a7ea9.rbf
e5a7eaa.rbf
e5a7eab.rbf
e5a7eac.rbf
e5a7ead.rbf
e5a7eae.rbf
e5a7eaf.rbf
e5a7eb0.rbf
e5a7eb1.rbf
e5a7eb2.rbf
e5a7eb3.rbf
e5a7eb4.rbf
e5a7eb5.rbf
e5a7eb6.rbf
e5a7eb7.rbf
e5a7eb8.rbf
e5a7eb9.rbf
e5a7eba.rbf
e5a7ebb.rbf
e5a7ebc.rbf
e5a7ebd.rbf
e5a7ebe.rbf
e5a7ebf.rbf
e5a7ec0.rbf
e5a7ec1.rbf
e5a7ec2.rbf
e5a7ec3.rbf
e5a7ec4.rbf
e5a7ec5.rbf
e5a7ec6.rbf
e5a7ec7.rbf
e5a7ec8.rbf
e5a7ec9.rbf
e5a7eca.rbf
e5a7ecb.rbf
e5a7ecc.rbf
e5a7ecd.rbf
e5a7ece.rbf
e5a7ecf.rbf
e5a7ed0.rbf
e5a7ed1.rbf
e5a7ed2.rbf
e5a7ed3.rbf
e5a7ed4.rbf
e5a7ed5.rbf
e5a7ed6.rbf
e5a7ed7.rbf
e5a7ed8.rbf
e5a7ed9.rbf
e5a7eda.rbf
e5a7edb.rbf
e5a7edc.rbf
e5a7edd.rbf
e5a7ede.rbf
e5a7edf.rbf
e5a7ee0.rbf
e5a7ee1.rbf
e5a7ee2.rbf
e5a7ee3.rbf
e5a7ee4.rbf
e5a7ee5.rbf
e5a7ee6.rbf
e5a7ee7.rbf
e5a7ee8.rbf
e5a7ee9.rbf
e5a7eea.rbf
e5a7eeb.rbf
e5a7eec.rbf
e5a7eed.rbf
e5a7eee.rbf
e5a7eef.rbf
e5a7ef0.rbf
e5a7ef1.rbf
e5a7ef2.rbf
e5a7ef3.rbf
e5a7ef4.rbf
e5a7ef5.rbf
e5a7ef6.rbf
e5a7ef7.rbf
e5a7ef8.rbf
e5a7ef9.rbf
e5a7efa.rbf
e5a7efb.rbf
e5a7efc.rbf
e5a7efd.rbf
e5a7efe.rbf
e5a7eff.rbf
e5a7f00.rbf
e5a7f01.rbf
e5a7f02.rbf
e5a7f03.rbf
e5a7f04.rbf
e5a7f05.rbf
e5a7f06.rbf
e5a7f07.rbf
e5a7f08.rbf
e5a7f09.rbf
e5a7f0a.rbf
e5a7f0b.rbf
e5a7f0c.rbf
e5a7f0d.rbf
e5a7f0e.rbf
e5a7f0f.rbf
e5a7f10.rbf
e5a7f11.rbf
e5a7f12.rbf
e5a7f13.rbf
e5a7f14.rbf
e5a7f15.rbf
e5a7f16.rbf
e5a7f17.rbf
e5a7f18.rbf
e5a7f19.rbf
e5a7f1a.rbf
e5a7f1b.rbf
e5a7f1c.rbf
e5a7f1d.rbf
e5a7f1e.rbf
e5a7f1f.rbf
e5a7f20.rbf
e5a7f21.rbf
e5a7f22.rbf
e5a7f23.rbf
e5a7f24.rbf
e5a7f25.rbf
e5a7f26.rbf
e5a7f27.rbf
e5a7f28.rbf
e5a7f29.rbf
e5a7f2a.rbf
e5a7f2b.rbf
e5a7f2c.rbf
e5a7f2d.rbf
e5a7f2e.rbf
e5a7f2f.rbf
e5a7f30.rbf
e5a7f31.rbf
e5a7f32.rbf
e5a7f33.rbf
e5a7f34.rbf
e5a7f35.rbf
e5a7f36.rbf
e5a7f37.rbf
e5a7f38.rbf
e5a7f39.rbf
e5a7f3a.rbf
e5a7f3b.rbf
e5a7f3c.rbf
e5a7f3d.rbf
e5a7f3e.rbf
e5a7f3f.rbf
e5a7f40.rbf
e5a7f41.rbf
e5a7f42.rbf
e5a7f43.rbf
e5a7f44.rbf
e5a7f45.rbf
e5a7f46.rbf
e5a7f47.rbf
e5a7f48.rbf
e5a7f49.rbf
e5a7f4a.rbf
e5a7f4b.rbf
e5a7f4c.rbf
e5a7f4d.rbf
e5a7f4e.rbf
e5a7f4f.rbf
e5a7f50.rbf
e5a7f51.rbf
e5a7f52.rbf
e5a7f53.rbf
e5a7f54.rbf
e5a7f55.rbf
e5a7f56.rbf
e5a7f57.rbf
e5a7f58.rbf
e5a7f59.rbf
e5a7f5a.rbf
e5a7f5b.rbf
e5a7f5c.rbf
e5a7f5d.rbf
e5a7f5e.rbf
e5a7f5f.rbf
e5a7f60.rbf
e5a7f61.rbf
e5a7f62.rbf
e5a7f63.rbf
e5a7f64.rbf
e5a7f65.rbf
e5a7f66.rbf
e5a7f67.rbf
e5a7f68.rbf
e5a7f69.rbf
e5a7f6a.rbf
e5a7f6b.rbf
e5a7f6c.rbf
e5a7f6d.rbf
e5a7f6e.rbf
e5a7f6f.rbf
e5a7f70.rbf
e5a7f71.rbf
e5a7f72.rbf
e5a7f73.rbf
e5a7f74.rbf
e5a7f75.rbf
e5a7f76.rbf
e5a7f77.rbf
e5a7f78.rbf
e5a7f79.rbf
e5a7f7a.rbf
e5a7f7b.rbf
e5a7f7c.rbf
e5a7f7d.rbf
e5a7f7e.rbf
e5a7f7f.rbf
e5a7f80.rbf
e5a7f81.rbf
e5a7f82.rbf
e5a7f83.rbf
e5a7f84.rbf
e5a7f85.rbf
e5a7f86.rbf
e5a7f87.rbf
e5a7f88.rbf
e5a7f89.rbf
e5a7f8a.rbf
e5a7f8b.rbf
e5a7f8c.rbf
e5a7f8d.rbf
e5a7f8e.rbf
e5a7f8f.rbf
e5a7f90.rbf
e5a7f91.rbf
e5a7f92.rbf
e5a7f93.rbf
e5a7f94.rbf
e5a7f95.rbf
e5a7f96.rbf
e5a7f98.rbf
e5a7f99.rbf
e5a7f9a.rbf
e5a7f9b.rbf
e5a7f9c.rbf
e5a7f9d.rbf
e5a7f9e.rbf
e5a7f9f.rbf
e5a7fa0.rbf
e5a7fa1.rbf
e5a7fa2.rbf
e5a7fa3.rbf
e5a7fa4.rbf
e5a7fa5.rbf
e5a7fa6.rbf
e5a7fa7.rbf
e5a7fa8.rbf
e5a7fa9.rbf
e5a7faa.rbf
e5a7fab.rbf
e5a7fac.rbf
e5a7fad.rbf
e5a7fae.rbf
e5a7faf.rbf
e5a7fb0.rbf
e5a7fb1.rbf
e5a7fb2.rbf
e5a7fb3.rbf
e5a7fb4.rbf
e5a7fb5.rbf
e5a7fb6.rbf
e5a7fb7.rbf
e5a7fb8.rbf
e5a7fb9.rbf
e5a7fba.rbf
e5a7fbb.rbf
e5a7fbc.rbf
e5a7fbd.rbf
e5a7fbe.rbf
e5a7fbf.rbf
e5a7fc0.rbf
e5a7fc1.rbf
e5a7fc2.rbf
e5a7fc3.rbf
e5a7fc4.rbf
e5a7fc5.rbf
e5a7fc6.rbf
e5a7fc7.rbf
e5a7fc8.rbf
e5a7fc9.rbf
e5a7fca.rbf
e5a7fcb.rbf
e5a7fcc.rbf
e5a7fcd.rbf
e5a7fce.rbf
e5a7fcf.rbf
e5a7fd0.rbf
e5a7fd1.rbf
e5a7fd2.rbf
e5a7fd3.rbf
e5a7fd4.rbf
e5a7fd5.rbf
e5a7fd6.rbf
e5a7fd7.rbf
e5a7fd8.rbf
e5a7fd9.rbf
e5a7fda.rbf
e5a7fdb.rbf
e5a7fdc.rbf
e5a7fdd.rbf
e5a7fde.rbf
e5a7fdf.rbf
e5a7fe0.rbf
e5a7fe1.rbf
e5a7fe2.rbf
e5a7fe3.rbf
e5a7fe4.rbf
e5a7fe5.rbf
e5a7fe6.rbf
e5a7fe7.rbf
e5a7fe8.rbf
e5a7fe9.rbf
e5a7fea.rbf
e5a7feb.rbf
e5a7fec.rbf
e5a7fed.rbf
e5a7fee.rbf
e5a7fef.rbf
e5a7ff0.rbf
e5a7ff1.rbf
e5a7ff2.rbf
e5a7ff3.rbf
e5a7ff4.rbf
e5a7ff5.rbf
e5a7ff6.rbf
e5a7ff7.rbf
e5a7ff8.rbf
e5a7ff9.rbf
e5a7ffa.rbf
e5a7ffb.rbf
e5a7ffc.rbf
e5a7ffd.rbf
e5a7ffe.rbf
e5a7fff.rbf
e5a8000.rbf
e5a8001.rbf
e5a8002.rbf
e5a8003.rbf
e5a8004.rbf
e5a8005.rbf
e5a8006.rbf
e5a8007.rbf
e5a8008.rbf
e5a8009.rbf
e5a800a.rbf
e5a800b.rbf
e5a800c.rbf
e5a800d.rbf
e5a800e.rbf
e5a800f.rbf
e5a8010.rbf
e5a8011.rbf
e5a8012.rbf
e5a8013.rbf
e5a8014.rbf
e5a8015.rbf
e5a8016.rbf
e5a8017.rbf
e5a8018.rbf
e5a8019.rbf
e5a801a.rbf
e5a801b.rbf
e5a801c.rbf
e5a801d.rbf
e5a801e.rbf
e5a801f.rbf
e5a8020.rbf
e5a8021.rbf
e5a8022.rbf
e5a8023.rbf
e5a8024.rbf
e5a8025.rbf
e5a8026.rbf
e5a8027.rbf
e5a8028.rbf
e5a8029.rbf
e5a802a.rbf
e5a802b.rbf
e5a802c.rbf
e5a802d.rbf
e5a802e.rbf
e5a802f.rbf
e5a8030.rbf
e5a8031.rbf
e5a8032.rbf
e5a8033.rbf
e5a8034.rbf
e5a8035.rbf
e5a8036.rbf
e5a8037.rbf
e5a8038.rbf
e5a8039.rbf
e5a803a.rbf
e5a803b.rbf
e5a803c.rbf
e5a803d.rbf
e5a803e.rbf
e5a803f.rbf
e5a8040.rbf
e5a8041.rbf
e5a8042.rbf
e5a8043.rbf
e5a8044.rbf
e5a8045.rbf
e5a8046.rbf
e5a8047.rbf
e5a8048.rbf
e5a8049.rbf
e5a804a.rbf
e5a804b.rbf
e5a804c.rbf
e5a804d.rbf
e5a804e.rbf
e5a804f.rbf
e5a8050.rbf
e5a8051.rbf
e5a8052.rbf
e5a8053.rbf
e5a8054.rbf
e5a8055.rbf
e5a8056.rbf
e5a8057.rbf
e5a8058.rbf
e5a8059.rbf
e5a805a.rbf
e5a805b.rbf
e5a805c.rbf
e5a805d.rbf
e5a805e.rbf
e5a805f.rbf
e5a8060.rbf
e5a8061.rbf
e5a8062.rbf
e5a8063.rbf
e5a8064.rbf
e5a8065.rbf
e5a8066.rbf
e5a8067.rbf
e5a8068.rbf
e5a8069.rbf
e5a806a.rbf
e5a806b.rbf
e5a806c.rbf
e5a806d.rbf
e5a806e.rbf
e5a806f.rbf
e5a8070.rbf
e5a8071.rbf
e5a8072.rbf
e5a8073.rbf
e5a8074.rbf
e5a8075.rbf
e5a8076.rbf
e5a8077.rbf
e5a8078.rbf
e5a8079.rbf
e5a807a.rbf
e5a807b.rbf
e5a807c.rbf
e5a807d.rbf
e5a807e.rbf
e5a807f.rbf
e5a8080.rbf
e5a8081.rbf
e5a8082.rbf
e5a8083.rbf
e5a8084.rbf
e5a8085.rbf
e5a8086.rbf
e5a8087.rbf
e5a8088.rbf
e5a8089.rbf
e5a808a.rbf
e5a808b.rbf
e5a808c.rbf
e5a808d.rbf
e5a808e.rbf
e5a808f.rbf
e5a8090.rbf
e5a8091.rbf
e5a8092.rbf
e5a8093.rbf
e5a8094.rbf
e5a8095.rbf
e5a8096.rbf
e5a8097.rbf
e5a8098.rbf
e5a8099.rbf
e5a809a.rbf
e5a809b.rbf
e5a809c.rbf
e5a809d.rbf
e5a809e.rbf
e5a809f.rbf
e5a80a0.rbf
e5a80a1.rbf
e5a80a2.rbf
e5a80a3.rbf
e5a80a4.rbf
e5a80a5.rbf
e5a80a6.rbf
e5a80a7.rbf
e5a80a8.rbf
e5a80a9.rbf
e5a80aa.rbf
e5a80ab.rbf
e5a80ac.rbf
e5a80ad.rbf
e5a80ae.rbf
e5a80af.rbf
e5a80b1.rbf
e5a80b2.rbf
e5a80b3.rbf
e5a80b4.rbf
e5a80b5.rbf
e5a80b6.rbf
e5a80b7.rbf
e5a80b8.rbf
e5a80b9.rbf
e5a80ba.rbf
e5a80bb.rbf
e5a80bc.rbf
e5a80bd.rbf
e5a80be.rbf
e5a80bf.rbf
e5a80c0.rbf
e5a80c1.rbf
e5a80c2.rbf
e5a80c3.rbf
e5a80c4.rbf
e5a80c5.rbf
e5a80c6.rbf
e5a80c7.rbf
e5a80c8.rbf
e5a80c9.rbf
e5a80ca.rbf
e5a80cb.rbf
e5a80cc.rbf
e5a80cd.rbf
e5a80ce.rbf
e5a80cf.rbf
e5a80d0.rbf
e5a80d1.rbf
e5a80d2.rbf
e5a80d3.rbf
e5a80d4.rbf
e5a80d5.rbf
e5a80d6.rbf
e5a80d7.rbf
e5a80d8.rbf
e5a80d9.rbf
e5a80da.rbf
e5a80db.rbf
e5a80dc.rbf
e5a80dd.rbf
e5a80de.rbf
e5a80df.rbf
e5a80e0.rbf
e5a80e1.rbf
e5a80e2.rbf
e5a80e3.rbf
e5a80e4.rbf
e5a80e5.rbf
e5a80e6.rbf
e5a80e7.rbf
e5a80e8.rbf
e5a80e9.rbf
e5a80ea.rbf
e5a80eb.rbf
e5a80ec.rbf
e5a80ed.rbf
e5a80ee.rbf
e5a80ef.rbf
e5a80f0.rbf
e5a80f1.rbf
e5a80f2.rbf
e5a80f3.rbf
e5a80f4.rbf
e5a80f5.rbf
e5a80f6.rbf
e5a80f7.rbf
e5a80f8.rbf
e5a80f9.rbf
e5a80fa.rbf
e5a80fb.rbf
e5a80fc.rbf
e5a80fd.rbf
e5a80fe.rbf
e5a80ff.rbf
e5a8100.rbf
e5a8101.rbf
e5a8102.rbf
e5a8103.rbf
e5a8105.rbf
e5a8106.rbf
e5a8107.rbf
e5a8108.rbf
e5a8109.rbf
e5a810a.rbf
e5a810b.rbf
e5a810c.rbf
e5a810d.rbf
e5a810e.rbf
e5a810f.rbf
e5a8110.rbf
e5a8111.rbf
e5a8112.rbf
e5a8113.rbf
e5a8114.rbf
e5a8115.rbf
e5a8116.rbf
e5a8117.rbf
e5a8118.rbf
e5a8119.rbf
e5a811a.rbf
e5a811b.rbf
e5a811c.rbf
e5a811d.rbf
e5a811e.rbf
e5a811f.rbf
e5a8120.rbf
e5a8121.rbf
e5a8122.rbf
e5a8123.rbf
e5a8124.rbf
e5a8125.rbf
e5a8126.rbf
e5a8127.rbf
e5a8128.rbf
e5a8129.rbf
e5a812a.rbf
e5a812b.rbf
e5a812c.rbf
e5a812d.rbf
e5a812e.rbf
e5a812f.rbf
e5a8130.rbf
e5a8131.rbf
e5a8132.rbf
e5a8133.rbf
e5a8134.rbf
e5a8135.rbf
e5a8136.rbf
e5a8137.rbf
e5a8138.rbf
e5a8139.rbf
e5a813a.rbf
e5a813b.rbf
e5a813c.rbf
e5a813d.rbf
e5a813e.rbf
e5a813f.rbf
e5a8140.rbf
e5a8141.rbf
e5a8142.rbf
e5a8143.rbf
e5a8144.rbf
e5a8145.rbf
e5a8146.rbf
e5a8147.rbf
e5a8148.rbf
e5a8149.rbf
e5a814a.rbf
e5a814b.rbf
e5a814c.rbf
e5a814d.rbf
e5a814e.rbf
e5a814f.rbf
e5a8150.rbf
e5a8151.rbf
e5a8152.rbf
e5a8153.rbf
e5a8154.rbf
e5a8155.rbf
e5a8156.rbf
e5a8157.rbf
e5a8158.rbf
e5a8159.rbf
e5a815a.rbf
e5a815b.rbf
e5a815c.rbf
e5a815d.rbf
e5a815e.rbf
e5a815f.rbf
e5a8160.rbf
e5a8161.rbf
e5a8162.rbf
e5a8163.rbf
e5a8164.rbf
e5a8165.rbf
e5a8166.rbf
e5a8167.rbf
e5a8168.rbf
e5a8169.rbf
e5a816a.rbf
e5a816b.rbf
e5a816c.rbf
e5a816d.rbf
e5a816e.rbf
e5a816f.rbf
e5a8170.rbf
e5a8171.rbf
e5a8172.rbf
e5a8173.rbf
e5a8175.rbf
e5a8176.rbf
e5a8177.rbf
e5a8178.rbf
e5a8179.rbf
e5a817a.rbf
e5a817b.rbf
e5a817c.rbf
e5a817d.rbf
e5a817e.rbf
e5a817f.rbf
e5a8180.rbf
e5a8181.rbf
e5a8182.rbf
e5a8183.rbf
e5a8184.rbf
e5a8185.rbf
e5a8186.rbf
e5a8187.rbf
e5a8188.rbf
e5a8189.rbf
e5a818a.rbf
e5a818b.rbf
e5a818c.rbf
e5a818e.rbf
e5a818f.rbf
e5a8190.rbf
e5a8191.rbf
e5a8192.rbf
e5a8193.rbf
e5a8194.rbf
e5a8195.rbf
e5a8196.rbf
e5a8197.rbf
e5a8198.rbf
e5a8199.rbf
e5a819a.rbf
e5a819b.rbf
e5a819c.rbf
e5a819d.rbf
e5a819e.rbf
e5a819f.rbf
e5a81a0.rbf
e5a81a1.rbf
e5a81a2.rbf
e5a81a3.rbf
e5a81a4.rbf
e5a81a5.rbf
e5a81a6.rbf
e5a81a7.rbf
e5a81a8.rbf
e5a81a9.rbf
e5a81aa.rbf
e5a81ab.rbf
e5a81ac.rbf
e5a81ad.rbf
e5a81ae.rbf
e5a81af.rbf
e5a81b0.rbf
e5a81b1.rbf
e5a81b2.rbf
e5a81b3.rbf
e5a81b4.rbf
e5a81b5.rbf
e5a81b6.rbf
e5a81b7.rbf
e5a81b8.rbf
e5a81b9.rbf
e5a81ba.rbf
e5a81bd.rbf
e5a81bf.rbf
e5a81c0.rbf
e5a81c1.rbf
e5a81c2.rbf
e5a81c3.rbf
e5a81c4.rbf
e5a81c5.rbf
e5a81c6.rbf
e5a81c7.rbf
e5a81c8.rbf
e5a81c9.rbf
e5a81ca.rbf
e5a81cb.rbf
e5a81cc.rbf
e5a81cd.rbf
e5a81ce.rbf
e5a81cf.rbf
e5a81d0.rbf
e5a81d1.rbf
e5a81d2.rbf
e5a81d3.rbf
e5a81d4.rbf
e5a81d5.rbf
e5a81d6.rbf
e5a81d7.rbf
e5a81d8.rbf
e5a81d9.rbf
e5a81dd.rbs
e5a81e2.rbs
e5a81e7.rbs
e5a81ec.rbs
e5a81f1.rbs
e5a81f6.rbs
e5a81fb.rbs
e5a8200.rbs
settings.dat
settings.dat
LOG.old
f_000087
f_00008d
the-real-index
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index~RFe598b4e.TMP
index.txt
index.txt
the-real-index
the-real-index~RFe59fc58.TMP
CURRENT
MANIFEST-000001
2246d5c6-bde9-4ce6-8c61-b85da0222ea8.tmp
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe59b925.TMP
7bb4ff12-89a0-4742-9efc-46bb088e7bb6.tmp
doc_JustForMe
lib_JustForMe
tcltk_JustForMe
pip.msi
core.msi
dev.msi
state.rsm
path.msi
exe.msi
test.msi
__init__.py
python.exe
Python 3.11.0 (64-bit)_20260712160223_000_core_JustForMe.log
Python 3.11.0 (64-bit)_20260712160223_001_exe_JustForMe.log
Python 3.11.0 (64-bit)_20260712160223_002_dev_JustForMe.log
Python 3.11.0 (64-bit)_20260712160223_003_lib_JustForMe.log
Python 3.11.0 (64-bit)_20260712160223_004_test_JustForMe.log
Python 3.11.0 (64-bit)_20260712160223_005_doc_JustForMe.log
Python 3.11.0 (64-bit)_20260712160223_006_tools_JustForMe.log
Python 3.11.0 (64-bit)_20260712160223_007_tcltk_JustForMe.log
Python 3.11.0 (64-bit)_20260712160223_008_launcher_AllUsers.log
Python 3.11.0 (64-bit)_20260712160223_009_pip_JustForMe.log
bwc wuqz balls.zip.crdownload
python-3.11.0-amd64.exe.crdownload
MSI6F5B.tmp
PythonBA.dll
SideBar.png
launcher_AllUsers
tools_JustForMe
BootstrapperApplicationData.xml
Default.thm
Default.wxl
python-3.11.0-amd64.exe
memory/1360-10562-0x00000000009F0000-0x0000000000A79000-memory.dmp
memory/1360-9249-0x00000000009F0000-0x0000000000A79000-memory.dmp
memory/2352-9250-0x00000000009F0000-0x0000000000A79000-memory.dmp
memory/2352-10561-0x00000000009F0000-0x0000000000A79000-memory.dmp
memory/4444-13920-0x00007FFDCDDB0000-0x00007FFDCE0F0000-memory.dmp
memory/4444-13919-0x00007FFDC8A80000-0x00007FFDC9E01000-memory.dmp
memory/4868-9248-0x00000000009F0000-0x0000000000A79000-memory.dmp
memory/4868-10563-0x00000000009F0000-0x0000000000A79000-memory.dmp