Overview

overview

8

Static

static

1

pulse_daw.py

windows10-2004-x64

8

pulse_daw.py

windows11-ltsc_2024-x64

3

run.bat

windows10-2004-x64

3

run.bat

windows11-ltsc_2024-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    133s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 05:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    pulse_daw.py
  • Size 23KB
  • Sample260809-fsn42st1ft
  • SHA256 cde52d94a596f83f98de600771ec98881a4f436a85a8c2bb22f891b29ad982b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 27 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 38 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 51 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\pulse_daw.py
    1⤵
    • Executes a command shell one-liner
    • Modifies registry class
    PID:2496
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:3000
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Downloads MZ/PE file
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • Checks processor information in registry
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {ca8db781-7868-42cc-b8d0-49796558c830} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:3600
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {6b5b91d3-6797-4410-84ea-e729f493d3c0} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
            PID:4308
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3900 -prefsLen 27276 -prefMapHandle 3904 -prefMapSize 270279 -jsInitHandle 3908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3916 -initialChannelId {c3c9e96b-57b3-4e4a-9b79-a93106236afc} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:5116
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4060 -prefsLen 27276 -prefMapHandle 4064 -prefMapSize 270279 -ipcHandle 4168 -initialChannelId {9c6934ec-13d5-45a0-98cc-fbdaa3c35995} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:4048
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3084 -prefsLen 34775 -prefMapHandle 2644 -prefMapSize 270279 -jsInitHandle 2700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4428 -initialChannelId {b8b26432-d879-448b-9438-5cf9fa6e22ee} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:3704
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4940 -prefsLen 35090 -prefMapHandle 5020 -prefMapSize 270279 -ipcHandle 5028 -initialChannelId {a5ccf095-8294-44f8-a75d-65eb35f57a44} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:5348
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5272 -prefsLen 33030 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {1cf7ae8c-7b4c-4a71-acdd-2aee66fc7193} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:5412
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5540 -prefsLen 33030 -prefMapHandle 5544 -prefMapSize 270279 -jsInitHandle 5548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5560 -initialChannelId {b18ec3b6-d097-4b97-b3a2-80c2d5f1410d} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:5420
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5860 -prefsLen 33030 -prefMapHandle 5864 -prefMapSize 270279 -jsInitHandle 5868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5876 -initialChannelId {974ab8b4-2b65-460f-a044-3789c013a3e5} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:5436
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5168 -prefsLen 33070 -prefMapHandle 5728 -prefMapSize 270279 -jsInitHandle 6236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6356 -initialChannelId {b658cc4a-4603-4f54-8c98-0c4af2d2841a} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
              3⤵
              • Checks processor information in registry
              PID:4572
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6236 -prefsLen 33070 -prefMapHandle 5728 -prefMapSize 270279 -jsInitHandle 5168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6420 -initialChannelId {7f762823-13b7-450d-a6a5-29c68db9727c} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
              3⤵
              • Checks processor information in registry
              PID:4124
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6748 -prefsLen 33070 -prefMapHandle 6752 -prefMapSize 270279 -jsInitHandle 6756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6772 -initialChannelId {7308d37e-03e4-442a-bec0-a925f65a17fe} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
              3⤵
              • Checks processor information in registry
              PID:5304
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:1092
          • C:\Users\Admin\Downloads\python-3.13.15-amd64.exe
            "C:\Users\Admin\Downloads\python-3.13.15-amd64.exe"
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1828
            • C:\Windows\Temp\{CD1418F5-F461-4A5D-A889-99F91E25CA2B}\.cr\python-3.13.15-amd64.exe
              "C:\Windows\Temp\{CD1418F5-F461-4A5D-A889-99F91E25CA2B}\.cr\python-3.13.15-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.13.15-amd64.exe" -burn.filehandle.attached=728 -burn.filehandle.self=732
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:3460
          • C:\Windows\system32\msiexec.exe
            C:\Windows\system32\msiexec.exe /V
            1⤵
            • Badlisted process makes network request
            • Enumerates connected drives
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1744
          • C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\python-3.13.15-amd64.exe
            "C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\python-3.13.15-amd64.exe" /burn.runonce
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:6020
            • C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\python-3.13.15-amd64.exe
              "C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\python-3.13.15-amd64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.13.15 (64-bit)_20260809061041.log"
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:6060
              • C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\python-3.13.15-amd64.exe
                "C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\python-3.13.15-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\python-3.13.15-amd64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.13.15 (64-bit)_20260809061041.log"
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:5884

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                e5a12c1.rbs
                • Path C:\Config.Msi\e5a12c1.rbs
                • Size 8KB
                • SHA256 c3ab791e82751262970b92a6a45a0a7fe035989b4053718f6775d968d7d19649
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e5a12c6.rbs
                • Path C:\Config.Msi\e5a12c6.rbs
                • Size 12KB
                • SHA256 f43ff0feded10407c399e0c936de85723980eb0133bd6eaddeedbcdcb6af289d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e5a12cb.rbs
                • Path C:\Config.Msi\e5a12cb.rbs
                • Size 60KB
                • SHA256 f7807cf966813946147e482d51c8b796d5fb83f37763d29d5d42c6eeb6aad816
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e5a12d0.rbs
                • Path C:\Config.Msi\e5a12d0.rbs
                • Size 127KB
                • SHA256 4e5aa1fe41248c4655c78c503ca8ce0c027e9ae6c43b3d2c859a872a2449d2b7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e5a12d5.rbs
                • Path C:\Config.Msi\e5a12d5.rbs
                • Size 354KB
                • SHA256 6366d0b0492f431b56de922c7c12c360a2715fc637d0626aa73951e8cda589e4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e5a12da.rbs
                • Path C:\Config.Msi\e5a12da.rbs
                • Size 139KB
                • SHA256 7ce79d5d31b395d0e67930f459cfcc2cd85bb99cd6dda775ad8291e544201dc3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                15F2BB48DCF5311B791D5FE370A6B16FE2745964
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\15F2BB48DCF5311B791D5FE370A6B16FE2745964
                • Size 23KB
                • SHA256 48a4e39890905c0c8a40f74ead9ce2a119ec617f9831061460c162fb4ad1d810
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                4860CD16A380B5CF35B32B5C1B0D4E4C5F854117
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\4860CD16A380B5CF35B32B5C1B0D4E4C5F854117
                • Size 14KB
                • SHA256 fb41577869a63b60ad78d30d65c5a4000356662c1ee4968040676e5df7afd651
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                • Size 16KB
                • SHA256 51622985c32cb6d9e7fc0aec73b4ee2d76acaf05bb10381beb263dc6f6a81c4a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                573ADCCDDE448764CD7C9D0CDA443FE3A798AAA5
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\573ADCCDDE448764CD7C9D0CDA443FE3A798AAA5
                • Size 941KB
                • SHA256 e94756ee39225d492629a4a4c4ab47c679598c7ef252bebce03e4b6d91d0bb75
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7445F0F1A704791B36159C77EEF62302A4FB39A4
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\7445F0F1A704791B36159C77EEF62302A4FB39A4
                • Size 125KB
                • SHA256 dd9bfd5fd58b80374a3d6a3d014aff5c1b02e68d901936482ee17081d16938e3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                861847558ACF1613C52A3868D5EBEA5F31FE2828
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\861847558ACF1613C52A3868D5EBEA5F31FE2828
                • Size 429KB
                • SHA256 1ad90347ef061b4fb5c9b7d18353087357458f5d24b841d923a5ae7ebd98afe9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                • Size 16KB
                • SHA256 43fe8eece33e13fb10fdb375c64dbbc9496cbdb87f433f61dce6bba14d249689
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                B111691B4D57348085745E4F1020E07DF51B6C53
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\B111691B4D57348085745E4F1020E07DF51B6C53
                • Size 108KB
                • SHA256 960401b7c47918ba7a9ac785f23dd248c182bb954df4ea432c6627c8049bf5e3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                E45D9D88D22A136F37884CCF58B97BBA5C4C5F6E
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\E45D9D88D22A136F37884CCF58B97BBA5C4C5F6E
                • Size 16KB
                • SHA256 43d5ac1ecba770f39b66204d67ac45211a3d63505dbfe60d6f9597a89fb64a22
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                F189984C66C3FD3EEECAB60EF4C0C13FD79B5CF1
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\F189984C66C3FD3EEECAB60EF4C0C13FD79B5CF1
                • Size 119KB
                • SHA256 38979fc49368459c916ea4b3618f80ec02effd085abcb37cf34cd6b42982342b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                doc_JustForMe
                • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\doc_JustForMe
                • Size 7.6MB
                • SHA256 86dd4432a305326d766a618a48b807682ac7a2b0b6e523448737fb1d525d9ef0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                lib_JustForMe
                • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe
                • Size 7.0MB
                • SHA256 6d3130114d7f57eaa33d86e8366a669dfc73cfe8df772bef93ce2d9ea799f751
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tcltk_JustForMe
                • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\tcltk_JustForMe
                • Size 3.1MB
                • SHA256 ec1e0fe1188969a48da63f24536183c95fc0393cf93588c646b253e91dc9b179
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                launcher.msi
                • Path C:\Users\Admin\AppData\Local\Package Cache\{0AE7F899-490C-423C-B3F5-8A520B8BCE14}v3.13.15150.0\launcher.msi
                • Size 552KB
                • SHA256 1114fa7d4b70efc1286795b8544e5d379f3607272897ef7205657e6c2fdf1cdf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                core.msi
                • Path C:\Users\Admin\AppData\Local\Package Cache\{6A138749-F2A9-4B24-B384-DC423B4057AC}v3.13.15150.0\core.msi
                • Size 2.0MB
                • SHA256 eff25b160b54a77c5953cf5803fc147a1ced084513265dfefc227583b1355484
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dev.msi
                • Path C:\Users\Admin\AppData\Local\Package Cache\{6BD0AB95-5A14-418B-9552-0636E3508078}v3.13.15150.0\dev.msi
                • Size 484KB
                • SHA256 d3035f53e51ce28082a8be714e052d39d4f485d7257fa8f9862c4919da4bdd9a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                test.msi
                • Path C:\Users\Admin\AppData\Local\Package Cache\{82EA641D-FA5D-4F76-AF39-619BFC40399D}v3.13.15150.0\test.msi
                • Size 6.1MB
                • SHA256 cd851f113ad3706251b289c7224963513ea63d6d6ff855462f1b028a270f0087
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                exe.msi
                • Path C:\Users\Admin\AppData\Local\Package Cache\{B90F2CB7-E388-48FF-BA03-BE13F5445D45}v3.13.15150.0\exe.msi
                • Size 840KB
                • SHA256 47f02452bde1f05b4d06fb93841ce380624c882ef75caddd1b1207d1a36bb4d2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                state.rsm
                • Path C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\state.rsm
                • Size 1KB
                • SHA256 ee9da3a9b9a54aff67f70f300e759b6f26ef0c372e0d356f40160d138f0b8817
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __init__.py
                • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\test\test_importlib\frozen\__init__.py
                • Size 147B
                • SHA256 6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __main__.py
                • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\test\test_importlib\frozen\__main__.py
                • Size 62B
                • SHA256 b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Python 3.13.15 (64-bit)_20260809061041_000_core_JustForMe.log
                • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.15 (64-bit)_20260809061041_000_core_JustForMe.log
                • Size 3KB
                • SHA256 39e4fb9a9f69c04a860478ca19ecf7c0580cf0476d7469dd996ae0f057d79ab4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Python 3.13.15 (64-bit)_20260809061041_001_exe_JustForMe.log
                • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.15 (64-bit)_20260809061041_001_exe_JustForMe.log
                • Size 1KB
                • SHA256 acce7cd5ee081e3f5747799c84e2771059fea0b4c1a600480083eedaf93e83fc
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Python 3.13.15 (64-bit)_20260809061041_002_dev_JustForMe.log
                • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.15 (64-bit)_20260809061041_002_dev_JustForMe.log
                • Size 1KB
                • SHA256 dd50317c0b6c2bad16229f576bee58981d774c0f28d72b1b4dec61ff31e3a95b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Python 3.13.15 (64-bit)_20260809061041_003_lib_JustForMe.log
                • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.15 (64-bit)_20260809061041_003_lib_JustForMe.log
                • Size 1KB
                • SHA256 a7fd2b338d0fa535f115b3c6eba1ae66d1288534ca279e53d606de742488d869
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Python 3.13.15 (64-bit)_20260809061041_004_test_JustForMe.log
                • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.15 (64-bit)_20260809061041_004_test_JustForMe.log
                • Size 3KB
                • SHA256 d91cea5fa57a90b5c09e8f5da962067e001ed49fae46950b767b8db2753648f6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Python 3.13.15 (64-bit)_20260809061041_005_doc_JustForMe.log
                • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.15 (64-bit)_20260809061041_005_doc_JustForMe.log
                • Size 1KB
                • SHA256 9fc9fe578b07dd480a39f3928904c8519bd7d6fc12d8a55605097058b8e4b969
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Python 3.13.15 (64-bit)_20260809061041_006_tcltk_JustForMe.log
                • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.15 (64-bit)_20260809061041_006_tcltk_JustForMe.log
                • Size 3KB
                • SHA256 aa95423aafe0ad4aee0d4f17cd7bd8068f2547341b78e837a2dd3c887eb3ead6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                tmpaddon
                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 11KB
                • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tmpaddon
                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 502KB
                • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AlternateServices.bin
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\AlternateServices.bin
                • Size 17KB
                • SHA256 e86ae8e54b089ed96197bcd16bae63e08230383f4dc73e6da97eec833f2d9633
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AlternateServices.bin
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\AlternateServices.bin
                • Size 10KB
                • SHA256 36dbf18000206b511895bb06657417c64a0d9cc196af74da2a47f6e1b3ae7635
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
                • Size 6KB
                • SHA256 f1b2aa36a43501cb5ac9e4332a06f6997bb3fe8a0c3f1654b45bc64c9db89e4c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
                • Size 3KB
                • SHA256 58532892577fc4cab64f3702a3b66b48e9461a9657650e1ea69de7354837fa0d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
                • Size 7KB
                • SHA256 4947335a1c706384c4a89c08d2293fb8a62c2c27636ee0eef2315becacb33dbe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                events
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
                • Size 1KB
                • SHA256 527e27febf862bd22071a14d4697a2b03691dd74221370b7c6f4b35c9f84986b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                events
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
                • Size 5KB
                • SHA256 52546d5beb90f51ed9f756420247dbf05a3d22c3d33bd012d9c639002a1f3814
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                258784e7-2562-4fea-bd0e-b242c596589d
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\258784e7-2562-4fea-bd0e-b242c596589d
                • Size 235B
                • SHA256 07d98cd6ffa9dd17769e5abe1367cd5a428b28ff1995ca11fdc73ad27f97c771
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                2d02c2d7-5612-4302-aa86-f8f964e0d795
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\2d02c2d7-5612-4302-aa86-f8f964e0d795
                • Size 886B
                • SHA256 367ccf88cc24988b085387ba4f1b4af64c1053893970218496ddcf4ac76eb36d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                67186e69-cf24-47c4-8689-19373eeaf839
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\67186e69-cf24-47c4-8689-19373eeaf839
                • Size 883B
                • SHA256 a0e26f8a0f6bdeab93edcd153c07e52f542d566d6215a228a56bab0cea737168
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                93bdae91-104e-4aa0-864c-e82d4c00cab9
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\93bdae91-104e-4aa0-864c-e82d4c00cab9
                • Size 2KB
                • SHA256 f487930e3fd227c31268b14b0fcf71cde31dcc9a6098207d8412dea234eb3654
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                c01569b5-74ef-4967-90c1-03450cae652b
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\c01569b5-74ef-4967-90c1-03450cae652b
                • Size 16KB
                • SHA256 f1db62b27f888c90708b7238829775ac664cd7c395f1bacab3a9b93738b2939e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e152a7f8-19af-48f3-87d8-a4127aa3df58
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\e152a7f8-19af-48f3-87d8-a4127aa3df58
                • Size 235B
                • SHA256 55d57b9a78048c30ff77bd4994b392555bd2b72e0101183456ab3c937e567a98
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                extensions.json
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\extensions.json
                • Size 16KB
                • SHA256 f260a28ec6717963723909a8571cbfdbf45678c15cd9608fc81568521394fbf2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                gmpopenh264.dll
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                • Size 1.1MB
                • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                gmpopenh264.info
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                • Size 116B
                • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                manifest.json
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                • Size 1002B
                • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                widevinecdm.dll
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                • Size 21.6MB
                • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs-1.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
                • Size 7KB
                • SHA256 4975d9fb58b80a643549fdf2dacc6d99d8ed42349dc6e0094e9846d35e97e52c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs-1.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
                • Size 8KB
                • SHA256 ac9ea91785e2fa4294ebfce0c6dd7bd24428f388689a0a980b83c1287546772d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
                • Size 6KB
                • SHA256 3b3251a8f3f7e4aee126a27d463dc61668316ce2bf18fa2b278494a3d50f2a84
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
                • Size 7KB
                • SHA256 2916790ad6ecbbcdba5137c806ed598e91478612703712e8419f0e924c41c655
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
                • Size 6KB
                • SHA256 58b28f0f105e796681e2e3cc63e6185a35c709f01ab32d6f24d4b516495bacef
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                recovery.baklz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
                • Size 1KB
                • SHA256 1df2d508773a7aa3fa4c0fe67e3078a89959b8e52c4c67f1c98e3861c81148ee
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                recovery.baklz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
                • Size 13KB
                • SHA256 0a28f9965d26f10e6bdd50f39b74ea074bac680e8880c525c70f8d8b27ba3254
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                recovery.baklz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
                • Size 2KB
                • SHA256 471209e8072d42550007bcad757d54ab191ea07629df1eed970d30e7918b70ae
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                python-3.13.15-amd64.exe
                • Path C:\Users\Admin\Downloads\python-3.13.15-amd64.exe
                • Size 28.1MB
                • SHA256 edec09c4853aeae9ac36efb8c9f95b6b8e2fee65eee56d9767a8b7c69c574403
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PythonBA.dll
                • Path C:\Windows\Temp\{926783D8-E76C-4548-8AF2-74EC7B7B617F}\.ba\PythonBA.dll
                • Size 701KB
                • SHA256 80f5b4a13f994620676034c3f0cd2f64de5d407768d32b79829a75f19f5401d0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SideBar.png
                • Path C:\Windows\Temp\{926783D8-E76C-4548-8AF2-74EC7B7B617F}\.ba\SideBar.png
                • Size 50KB
                • SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pip_JustForMe
                • Path C:\Windows\Temp\{926783D8-E76C-4548-8AF2-74EC7B7B617F}\pip_JustForMe
                • Size 288KB
                • SHA256 1bc9cfa07a92da66335cc7252dfb3d7ca318facd3966fd15574014466cccf37e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python-3.13.15-amd64.exe
                • Path C:\Windows\Temp\{CD1418F5-F461-4A5D-A889-99F91E25CA2B}\.cr\python-3.13.15-amd64.exe
                • Size 881KB
                • SHA256 5a65243b863613cbed904babac80a0e5d2b9803d3523eb8b867a1488619c1073
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1744-2586-0x0000020EACA00000-0x0000020EAD4C1000-memory.dmp
                Download

                memory/1744-4431-0x0000020EACA00000-0x0000020EAD4C1000-memory.dmp
                Download

                memory/1744-1963-0x0000020EACA00000-0x0000020EAD4C1000-memory.dmp
                Download