Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/10/2026, 12:19

General

  • Target
    Video_recorded_iPhone18.mp4%20%20%20Drive.google.exe
  • Size 34.8MB
  • Sample261030-pg7lpab12z
  • SHA256 281ac51ba67844adaa1288c0691879c291155ff85e3180c10e54d3334bc28a68
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 46 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Video_recorded_iPhone18.mp4%20%20%20Drive.google.exe
    "C:\Users\Admin\AppData\Local\Temp\Video_recorded_iPhone18.mp4%20%20%20Drive.google.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Video_recorded_iPhone18.mp4%20%20%20Drive.google.exe --webview-exe-version=1.2.0.1 --user-data-dir="C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=user-gesture-required --disable-features=BackgroundSync --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2556.5200.6118117032030845948 /pfhostedapp:23d46bb33e296d0589b552763940fd9fb3c6a815
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5028
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView /prefetch:4 /pfhostedapp:23d46bb33e296d0589b552763940fd9fb3c6a815 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffaef905fd8,0x7ffaef905fe4,0x7ffaef905ff0
        3⤵
          PID:6172
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView" --webview-exe-name=Video_recorded_iPhone18.mp4%20%20%20Drive.google.exe --webview-exe-version=1.2.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1704 --field-trial-handle=1708,i,2270969564024744739,4607079213840052863,262144 --enable-features=MojoIpcz --disable-features=BackgroundSync --variations-seed-version /prefetch:2 /pfhostedapp:23d46bb33e296d0589b552763940fd9fb3c6a815
          3⤵
            PID:3784
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView" --webview-exe-name=Video_recorded_iPhone18.mp4%20%20%20Drive.google.exe --webview-exe-version=1.2.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1708,i,2270969564024744739,4607079213840052863,262144 --enable-features=MojoIpcz --disable-features=BackgroundSync --variations-seed-version /prefetch:3 /pfhostedapp:23d46bb33e296d0589b552763940fd9fb3c6a815
            3⤵
              PID:4084
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView" --webview-exe-name=Video_recorded_iPhone18.mp4%20%20%20Drive.google.exe --webview-exe-version=1.2.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2436 --field-trial-handle=1708,i,2270969564024744739,4607079213840052863,262144 --enable-features=MojoIpcz --disable-features=BackgroundSync --variations-seed-version /prefetch:8 /pfhostedapp:23d46bb33e296d0589b552763940fd9fb3c6a815
              3⤵
                PID:4388
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView" --webview-exe-name=Video_recorded_iPhone18.mp4%20%20%20Drive.google.exe --webview-exe-version=1.2.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3324 --field-trial-handle=1708,i,2270969564024744739,4607079213840052863,262144 --enable-features=MojoIpcz --disable-features=BackgroundSync --variations-seed-version /pfhostedapp:23d46bb33e296d0589b552763940fd9fb3c6a815 /prefetch:1
                3⤵
                  PID:4920
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView" --webview-exe-name=Video_recorded_iPhone18.mp4%20%20%20Drive.google.exe --webview-exe-version=1.2.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4368 --field-trial-handle=1708,i,2270969564024744739,4607079213840052863,262144 --enable-features=MojoIpcz --disable-features=BackgroundSync --variations-seed-version /prefetch:8 /pfhostedapp:23d46bb33e296d0589b552763940fd9fb3c6a815
                  3⤵
                    PID:3776
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView" --webview-exe-name=Video_recorded_iPhone18.mp4%20%20%20Drive.google.exe --webview-exe-version=1.2.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4412 --field-trial-handle=1708,i,2270969564024744739,4607079213840052863,262144 --enable-features=MojoIpcz --disable-features=BackgroundSync --variations-seed-version /prefetch:8 /pfhostedapp:23d46bb33e296d0589b552763940fd9fb3c6a815
                    3⤵
                      PID:6400
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView" --webview-exe-name=Video_recorded_iPhone18.mp4%20%20%20Drive.google.exe --webview-exe-version=1.2.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4376 --field-trial-handle=1708,i,2270969564024744739,4607079213840052863,262144 --enable-features=MojoIpcz --disable-features=BackgroundSync --variations-seed-version /prefetch:8 /pfhostedapp:23d46bb33e296d0589b552763940fd9fb3c6a815
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1340
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView" --webview-exe-name=Video_recorded_iPhone18.mp4%20%20%20Drive.google.exe --webview-exe-version=1.2.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1984 --field-trial-handle=1708,i,2270969564024744739,4607079213840052863,262144 --enable-features=MojoIpcz --disable-features=BackgroundSync --variations-seed-version /prefetch:8 /pfhostedapp:23d46bb33e296d0589b552763940fd9fb3c6a815
                      3⤵
                        PID:8104
                  • C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\python.exe
                    "C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\python.exe" "C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\python.txt"
                    1⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Reads the TCP/IP host and domain name from the registry
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2912
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "ver"
                      2⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      PID:4268

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        40d45d5e-d5fb-480b-b604-b9792e054121.tmp

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\40d45d5e-d5fb-480b-b604-b9792e054121.tmp
                        • Size 5KB
                        • SHA256 a23f11dcca9862019fba459846dc9c0dd1d8991c0d736fe6eccf7247d1ff8646
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        563b7bf9-61c2-4eda-a758-22177f30d02b.tmp

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\563b7bf9-61c2-4eda-a758-22177f30d02b.tmp
                        • Size 3KB
                        • SHA256 d20025387a5b328f46fac3de5d0a0e99d1728fa0713a98fb82191fc805c79f27
                        • MD5 SHA1 SHA512 TLSH

                        95f83db3-bd37-4d38-9634-19f76e0a9b45.tmp

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\95f83db3-bd37-4d38-9634-19f76e0a9b45.tmp
                        • Size 15KB
                        • SHA256 e35f3bca673eda22ad235ff18d8ab099d95b74051ebfa91b87a612fd613507f2
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        settings.dat

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\Crashpad\settings.dat
                        • Size 280B
                        • SHA256 60cc6aa322d52cbc6e2e27bb05463511541c5836a183381ec75692ad0a1bbd84
                        • MD5 SHA1 SHA512

                        settings.dat

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\Crashpad\settings.dat
                        • Size 280B
                        • SHA256 1f3fd0df0fa846024741fa54f15649710f3be3e1a4356099888e2e51caa31b8c
                        • MD5 SHA1 SHA512 TLSH

                        throttle_store.dat

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\Crashpad\throttle_store.dat
                        • Size 20B
                        • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                        • MD5 SHA1 SHA512

                        Network Persistent State

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\Default\Network\Network Persistent State
                        • Size 59B
                        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                        • MD5 SHA1 SHA512 TLSH

                        SCT Auditing Pending Reports

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\Default\Network\SCT Auditing Pending Reports
                        • Size 2B
                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                        • MD5 SHA1 SHA512

                        a5e6aed8-805a-45f0-8744-dd1f4d5976f1.tmp

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\Default\Network\a5e6aed8-805a-45f0-8744-dd1f4d5976f1.tmp
                        • Size 374B
                        • SHA256 8661dd7c59dd66aa04b0dc134c79e5ce26b3b97f007c465f6aef35aceb997595
                        • MD5 SHA1 SHA512 TLSH

                        Preferences

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\Default\Preferences
                        • Size 6KB
                        • SHA256 0579924b88002ab28165395d76a2436d5ea509612b6b329bd31f58d113cf4a77
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        CURRENT

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\Default\Site Characteristics Database\CURRENT
                        • Size 16B
                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                        • MD5 SHA1 SHA512

                        MANIFEST-000001

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
                        • Size 41B
                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                        • MD5 SHA1 SHA512

                        a51deef6-94a8-4775-ad25-d899e1b427c0.tmp

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\Default\a51deef6-94a8-4775-ad25-d899e1b427c0.tmp
                        • Size 6KB
                        • SHA256 e1ed29989bac3c6457e840f5248140eb54c566aa872b80a99b5be4bec550da34
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        f6f165e3-2866-48e7-af39-6a4a8bd71657.tmp

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\Default\f6f165e3-2866-48e7-af39-6a4a8bd71657.tmp
                        • Size 6KB
                        • SHA256 cf647e0963bcfef6afc335c28699692c98946bdfc78ccfb358bd8d9330c136f7
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        data_0

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\GrShaderCache\data_0
                        • Size 8KB
                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                        • MD5 SHA1 SHA512 SSDEEP

                        data_1

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\GrShaderCache\data_1
                        • Size 264KB
                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                        • MD5 SHA1 SHA512 SSDEEP

                        data_2

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\GrShaderCache\data_2
                        • Size 8KB
                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                        • MD5 SHA1 SHA512 SSDEEP

                        data_3

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\GrShaderCache\data_3
                        • Size 8KB
                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                        • MD5 SHA1 SHA512 SSDEEP

                        Local State

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\Local State
                        • Size 1KB
                        • SHA256 7248de0aa50d7cc51a5258e549ebf3a07e969e202c6623a3dd1eee46b9b17b82
                        • MD5 SHA1 SHA512 TLSH

                        Local State

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\WebView2Data\EBWebView\Local State
                        • Size 2KB
                        • SHA256 d2fd0dfff070b0ea9a23f7234e6f1070f884314bf568b611d4923e8d94acec01
                        • MD5 SHA1 SHA512 TLSH

                        VCRUNTIME140.dll

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\VCRUNTIME140.dll
                        • Size 74KB
                        • SHA256 9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _collections_abc.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\_collections_abc.cpython-310.pyc
                        • Size 32KB
                        • SHA256 27c26a94f9300f3ceb4b9d761a34b9a1e50f355f052b33ae32a9c2da28e4fdee
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _sitebuiltins.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\_sitebuiltins.cpython-310.pyc
                        • Size 3KB
                        • SHA256 cde47e156a45f0927afb9385a3265da9f5eadf452d7c276899bdb8449e5ea347
                        • MD5 SHA1 SHA512 TLSH

                        abc.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\abc.cpython-310.pyc
                        • Size 6KB
                        • SHA256 03c14aceda5ab84ef0cb4a26839c11455c9c63e37ffd62e973315d2b17fc5f49
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        base64.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\base64.cpython-310.pyc
                        • Size 16KB
                        • SHA256 32cad110ba45f18f521f234c4412fbb4a9ca3e53856e78aa4c086174975c306a
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        codecs.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\codecs.cpython-310.pyc
                        • Size 32KB
                        • SHA256 b033eeea5765626532452f2156fc42407b72789a06e1c11fc10845b1ec99bcb9
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        enum.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\enum.cpython-310.pyc
                        • Size 25KB
                        • SHA256 3a354a12c51016435fef9fa95bee1c4a612681d8c8d9e779b2a6cc69d903aade
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        functools.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\functools.cpython-310.pyc
                        • Size 27KB
                        • SHA256 2bf84674579e3cf44b60b5b3b886a78539eadc6d1679228b81e2df3d9ed020db
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        genericpath.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\genericpath.cpython-310.pyc
                        • Size 3KB
                        • SHA256 54edfe6c6f45341d6d00f2e95709a9d126fc157412d9049eade3d99396898112
                        • MD5 SHA1 SHA512 TLSH

                        io.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\io.cpython-310.pyc
                        • Size 3KB
                        • SHA256 489bbc3379e3b8d8dab4637a1119ca97c63cdc766820427a05a509d869446aa6
                        • MD5 SHA1 SHA512 TLSH

                        ntpath.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\ntpath.cpython-310.pyc
                        • Size 14KB
                        • SHA256 69499c28add6990f812e7117ed6dd1ef8f55adb075bbee50716827f78a166305
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        os.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\os.cpython-310.pyc
                        • Size 30KB
                        • SHA256 849a8ddc925ab6892dd378e0251f7c55368b800052500d25acd2db8f7f9bc828
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        re.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\re.cpython-310.pyc
                        • Size 13KB
                        • SHA256 5b44dce32885cef3c2cb276c2aa93fd0fa5b17d8634e11e0f0e25f584d2fedc5
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        site.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\site.cpython-310.pyc
                        • Size 16KB
                        • SHA256 ed46c8dacab5523220564ad3d24beaed096d7c06bb3af436068123e56c418cd8
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        sre_compile.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\sre_compile.cpython-310.pyc
                        • Size 14KB
                        • SHA256 96b351d9635f187eeaf2fccf379be5bd549b0f5eb36601b972f263f3817efbfc
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        sre_constants.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\sre_constants.cpython-310.pyc
                        • Size 6KB
                        • SHA256 3f82e417317d2e33248069ff9e5a4c927385a409a458ad96d701c0d0f7f9dc38
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        sre_parse.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\sre_parse.cpython-310.pyc
                        • Size 21KB
                        • SHA256 72c6496b0a599b5d4c4aa2d181ea5e9854500fd1e5c4d2fa6d0f3de9206ec391
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        stat.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\stat.cpython-310.pyc
                        • Size 4KB
                        • SHA256 9ed777c95a6afbde44bd07243f31b6ce4cf2f14ba2f15fd22e3935b9952b0ac6
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        types.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\__pycache__\types.cpython-310.pyc
                        • Size 9KB
                        • SHA256 12ef84452a0009f4457480355745c3a12319d08a96ef794c90a34450ff1ea9bf
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _collections_abc.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\_collections_abc.py
                        • Size 32KB
                        • SHA256 266ccceb862ea94e2b74fdda4835f8ef149d95c0fc3aafe12122d0927e686dd3
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _sitebuiltins.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\_sitebuiltins.py
                        • Size 3KB
                        • SHA256 924f95fd516ecaea9c9af540dc0796fb15ec17d8c42b59b90cf57cfe15962e2e
                        • MD5 SHA1 SHA512 TLSH

                        abc.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\abc.py
                        • Size 6KB
                        • SHA256 a63de23d93b7cc096ae5df79032dc2e12778b134bb14f7f40ac9a1f77f102577
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        base64.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\base64.py
                        • Size 20KB
                        • SHA256 2bdcb6d9edfd97c91bc8ab325fcc3226c71527aa444adb0a4ed70b60c18c388d
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        codecs.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\codecs.py
                        • Size 36KB
                        • SHA256 4635485d9d964c57317126894adaca91a027e017aefd8021797b05415e43dbb4
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        __init__.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\encodings\__init__.py
                        • Size 5KB
                        • SHA256 93cfd89699b7f800d6ccfb93266da4db6298bd73887956148d1345d5ca6742a9
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        __init__.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\encodings\__pycache__\__init__.cpython-310.pyc
                        • Size 3KB
                        • SHA256 4dfbac39fe764b0f01ed7bb0f8d84a21fd81dc338342b3803d165cf70c7ec5e8
                        • MD5 SHA1 SHA512 TLSH

                        aliases.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\encodings\__pycache__\aliases.cpython-310.pyc
                        • Size 10KB
                        • SHA256 90904cea8eac40f434f4c34924043ecd10003c61207e2ebce7dc7d66b58ad59d
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        cp1252.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\encodings\__pycache__\cp1252.cpython-310.pyc
                        • Size 2KB
                        • SHA256 8bb1ae047f190941c85de512dfb78e6315e1c9575eb2fe0019d98fd1c4c64f5d
                        • MD5 SHA1 SHA512 TLSH

                        utf_8.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\encodings\__pycache__\utf_8.cpython-310.pyc
                        • Size 1KB
                        • SHA256 36717fc45bd29f73b8e6e9ec3e7a8c267dd7d789224adc1d7793dcbd5f2ca89c
                        • MD5 SHA1 SHA512 TLSH

                        aliases.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\encodings\aliases.py
                        • Size 15KB
                        • SHA256 1893cfb597bc5eafd38ef03ac85d8874620112514eb42660408811929cc0d6f8
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        cp1252.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\encodings\cp1252.py
                        • Size 13KB
                        • SHA256 7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        utf_8.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\encodings\utf_8.py
                        • Size 1KB
                        • SHA256 9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e
                        • MD5 SHA1 SHA512 TLSH

                        enum.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\enum.py
                        • Size 39KB
                        • SHA256 303afea74d4a1675a48c6a8d7c4764da68dbef1092dc440e4bf3c901f8155609
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        functools.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\functools.py
                        • Size 38KB
                        • SHA256 b4698d03b4d366f2b032f5de66b8181ed8e371c0d7d714b7672432e18d80636b
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        genericpath.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\genericpath.py
                        • Size 5KB
                        • SHA256 2e162781cd02127606f3f221fcaa19c183672d1d3e20fdb83fe9950ab5024244
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        io.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\io.py
                        • Size 4KB
                        • SHA256 fe91b067fd544381fcd4f3df53272c8c40885c1811ac2165fd6686623261bc5d
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        ntpath.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\ntpath.py
                        • Size 29KB
                        • SHA256 e34494af36d8b596c98759453262d2778a893daa766f96e1bb1ef89d8b387812
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        os.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\os.py
                        • Size 39KB
                        • SHA256 521f714dc038e0faa53e7de3dbccae0631d96a4d2d655f88b970bd8cf29ec750
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        re.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\re.py
                        • Size 15KB
                        • SHA256 5ae8929f8c0fb9a0f31520d0a909e5637d86c6debb7c0b8cbacc710c721f9f7d
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        __init__.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\site-packages\Cython\Debugger\__init__.py
                        • Size 13B
                        • SHA256 8ceaad98f2c2bcc0aad3154cc067a4b8ba4199582ad31b4f16651e3f249d3a3b
                        • MD5 SHA1 SHA512

                        __init__.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\site-packages\_distutils_hack\__init__.py
                        • Size 5KB
                        • SHA256 4d27a48545b57dd137ae35376fcf326d2064271084a487960686f8704b94de4a
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        __init__.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\site-packages\_distutils_hack\__pycache__\__init__.cpython-310.pyc
                        • Size 7KB
                        • SHA256 531f14118ff49c08f91fc480d20a61f7f0481c3f281369313a735f454ee2e71f
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        distutils-precedence.pth

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\site-packages\distutils-precedence.pth
                        • Size 151B
                        • SHA256 2638ce9e2500e572a5e0de7faed6661eb569d1b696fcba07b0dd223da5f5d224
                        • MD5 SHA1 SHA512 TLSH

                        INSTALLER

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\site-packages\idna-3.10.dist-info\INSTALLER
                        • Size 4B
                        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                        • MD5 SHA1 SHA512

                        LICENSE.APACHE

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\site-packages\pip\_vendor\packaging\LICENSE.APACHE
                        • Size 9KB
                        • SHA256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        LICENSE

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\site-packages\pip\_vendor\tomli_w\LICENSE
                        • Size 1KB
                        • SHA256 b80816b0d530b8accb4c2211783790984a6e3b61922c2b5ee92f3372ab2742fe
                        • MD5 SHA1 SHA512 TLSH

                        __init__.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\site-packages\pyasn1\codec\der\__init__.py
                        • Size 59B
                        • SHA256 1040e52584b5ef6107dfd19489d37ff056e435c598f4e555f1edf4015e7ca67d
                        • MD5 SHA1 SHA512 TLSH

                        pywin32.pth

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\site-packages\pywin32.pth
                        • Size 185B
                        • SHA256 d902584a2a0a5216ce12c712d1378fe07541d32c383d0cc5abcd68412144fe4d
                        • MD5 SHA1 SHA512 TLSH

                        pywin32_bootstrap.cpython-310.pyc

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\site-packages\win32\lib\__pycache__\pywin32_bootstrap.cpython-310.pyc
                        • Size 526B
                        • SHA256 b955f681cacb29a71bfdc68f7d193e3f9662fd0605872e6b0b45ca753c7cf95b
                        • MD5 SHA1 SHA512 TLSH

                        pywin32_bootstrap.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\site-packages\win32\lib\pywin32_bootstrap.py
                        • Size 1KB
                        • SHA256 5b7a20a3b71615e1d08fdd9b91125ca615295457be54a77713705874772ac289
                        • MD5 SHA1 SHA512 TLSH

                        __init__.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\site-packages\win32comext\directsound\__init__.py
                        • Size 139B
                        • SHA256 dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13
                        • MD5 SHA1 SHA512 TLSH

                        site.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\site.py
                        • Size 22KB
                        • SHA256 73607e7b809237d5857b98e2e9d503455b33493cde1a03e3899aa16f00502d36
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        sre_compile.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\sre_compile.py
                        • Size 28KB
                        • SHA256 cdb9bdcab7a6fa98f45ef47d3745ac86725a89c5baf80771f0451d90058a21d6
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        sre_constants.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\sre_constants.py
                        • Size 7KB
                        • SHA256 513373cde5987d794dc429f7c71a550fe49e274bf82d0856bec40dca4079dadc
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        sre_parse.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\sre_parse.py
                        • Size 40KB
                        • SHA256 c029a310e36013abc15610ff09a1e31d9fb1a0e4c60293150722c08fc9e7b090
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        stat.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\stat.py
                        • Size 5KB
                        • SHA256 e514fd41e2933dd1f06be315fb42a62e67b33d04571435a4815a18f490e0f6ce
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        types.py

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\lib\types.py
                        • Size 10KB
                        • SHA256 0d3a1a2f8f0e286ad9eadbb397af0c2dc4bef0c71a7ebe4b51ded9862a301b01
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        python.exe

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\python.exe
                        • Size 97KB
                        • SHA256 ff507b25af4b3e43be7e351ec12b483fe46bdbc5656baae6ad0490c20b56e730
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        python.txt

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\python.txt
                        • Size 118KB
                        • SHA256 ca54a2744a3dfcac6e3b8d4c92396d8767adb1bdd978d4b924cc87f14d1d3d89
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        python310.dll

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\drive\python310.dll
                        • Size 4.0MB
                        • SHA256 b4893ed4890874d0466fca49960d765dd4c2d3948a47d69584f5cc51bbbfa4c9
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        manifest.json

                        • Path C:\Users\Admin\AppData\Local\DrivePdfWindows\staging_patch\manifest.json
                        • Size 593B
                        • SHA256 01ca3b87bb5e7de731fcdf179d24e84b87ea90405cb7b90cf14001c115a9d297
                        • MD5 SHA1 SHA512 TLSH

                        5af5847d-d1dd-43d5-a3df-d569831fd111.tmp

                        • Path C:\Users\Admin\Downloads\5af5847d-d1dd-43d5-a3df-d569831fd111.tmp
                        • Size 464B
                        • SHA256 44ea37f8ec674c8550c50cf5c2bc80c12665c1d61c64a9c5ecbe96f3aa1a93f7
                        • MD5 SHA1 SHA512 TLSH

                        manifest.json

                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5028_1352648355\manifest.json
                        • Size 80B
                        • SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
                        • MD5 SHA1 SHA512 TLSH

                        memory/1340-4761-0x0000014DD5590000-0x0000014DD5591000-memory.dmp

                        memory/1340-4754-0x0000014DD5590000-0x0000014DD5591000-memory.dmp

                        memory/1340-4759-0x0000014DD5590000-0x0000014DD5591000-memory.dmp

                        memory/1340-4758-0x0000014DD5590000-0x0000014DD5591000-memory.dmp

                        memory/1340-4763-0x0000014DD5590000-0x0000014DD5591000-memory.dmp

                        memory/1340-4752-0x0000014DD5590000-0x0000014DD5591000-memory.dmp

                        memory/1340-4762-0x0000014DD5590000-0x0000014DD5591000-memory.dmp

                        memory/1340-4760-0x0000014DD5590000-0x0000014DD5591000-memory.dmp

                        memory/3784-2735-0x00007FFB11630000-0x00007FFB11631000-memory.dmp

                        memory/4920-2467-0x00007FFB11630000-0x00007FFB11631000-memory.dmp

                        memory/8104-4766-0x00007FFB11630000-0x00007FFB11631000-memory.dmp

                        memory/8104-4767-0x00007FFB10390000-0x00007FFB10391000-memory.dmp