Analysis
- max time kernel
1049s - max time network
1050s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
02/08/2024, 16:50
General
- Target Ransomware-master.zip
- Size 12.9MB
- Sample240802-vcrybswgrg
- SHA256 2e156957ffdc73801662b89b1f6773434c4d13bb4b9bc1670827e399ad64aa7e
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 13 IoCs
- Loads dropped DLL 62 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Blocklisted process makes network request 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 3 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 13 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 38 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 17 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Ransomware-master.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3884.0.1649827403\883840514" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1708 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {840de085-a0f8-44bf-860f-6a98a5f7706c} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" 1796 1cf5a2d7058 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3884.1.524219705\353407836" -parentBuildID 20221007134813 -prefsHandle 2152 -prefMapHandle 2148 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bd6e8b1-2bfc-4c2f-98a4-d0da2506574a} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" 2180 1cf4f3f4758 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3884.2.1398195295\1781425395" -childID 1 -isForBrowser -prefsHandle 2952 -prefMapHandle 2948 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5217102c-a61b-427c-81e5-e37d64de46ab} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" 2964 1cf5a25ec58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3884.3.1495781229\809250991" -childID 2 -isForBrowser -prefsHandle 3516 -prefMapHandle 3512 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d11f3f3-4e7f-468c-adf8-b0e622433458} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" 3528 1cf4f371358 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3884.4.2050761281\139345904" -childID 3 -isForBrowser -prefsHandle 4124 -prefMapHandle 4120 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f337a74-2290-4078-b301-defe27adba7b} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" 4132 1cf603ac658 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3884.5.1733866104\329077652" -childID 4 -isForBrowser -prefsHandle 1504 -prefMapHandle 2564 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8941695-1156-48f3-a04f-543374ba9ceb} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" 1544 1cf4f36a258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3884.6.1642658786\1168659291" -childID 5 -isForBrowser -prefsHandle 5028 -prefMapHandle 5032 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be4e6774-f869-497e-b80a-e9728bc331f4} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" 5020 1cf609ef758 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3884.7.2015356800\1269122162" -childID 6 -isForBrowser -prefsHandle 5204 -prefMapHandle 5208 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {683140a0-d9a7-44e7-8549-6d28aecfef78} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" 5196 1cf60c4b258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3884.8.1890518223\1815631029" -childID 7 -isForBrowser -prefsHandle 5664 -prefMapHandle 5660 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {263ff198-1b8e-421a-aef6-19d3191bcda4} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" 5680 1cf62519f58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3884.9.1230329853\649390847" -parentBuildID 20221007134813 -prefsHandle 2660 -prefMapHandle 4240 -prefsLen 26768 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd31bbea-0de8-4cc3-8861-67b33344787c} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" 4432 1cf60726558 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3884.10.644612200\151726568" -childID 8 -isForBrowser -prefsHandle 5476 -prefMapHandle 5488 -prefsLen 27468 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0a5e986-68a5-4c77-8610-fa7ae3441db8} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" 5484 1cf4f35ca58 tab3⤵
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffebb3d9758,0x7ffebb3d9768,0x7ffebb3d97782⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1888,i,3315564377210981570,3720259640993643874,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1852 --field-trial-handle=1888,i,3315564377210981570,3720259640993643874,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2140 --field-trial-handle=1888,i,3315564377210981570,3720259640993643874,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1888,i,3315564377210981570,3720259640993643874,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1888,i,3315564377210981570,3720259640993643874,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4484 --field-trial-handle=1888,i,3315564377210981570,3720259640993643874,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1888,i,3315564377210981570,3720259640993643874,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 --field-trial-handle=1888,i,3315564377210981570,3720259640993643874,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level2⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x24c,0x250,0x254,0x6c,0x258,0x7ff7b5bb7688,0x7ff7b5bb7698,0x7ff7b5bb76a83⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4932 --field-trial-handle=1888,i,3315564377210981570,3720259640993643874,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 --field-trial-handle=1888,i,3315564377210981570,3720259640993643874,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3680 --field-trial-handle=1888,i,3315564377210981570,3720259640993643874,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3388 --field-trial-handle=1888,i,3315564377210981570,3720259640993643874,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5312 --field-trial-handle=1888,i,3315564377210981570,3720259640993643874,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.0.1260658132\1804895241" -parentBuildID 20221007134813 -prefsHandle 1688 -prefMapHandle 1676 -prefsLen 21560 -prefMapSize 233823 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67ceb205-6caa-4317-bf8b-33021bd70fd3} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 1780 28251cd2358 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.1.1173506240\6376241" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 21641 -prefMapSize 233823 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a341ecf-fb4e-4d26-9e14-4683e34093a3} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 2136 28251833358 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.2.964727229\463644902" -childID 1 -isForBrowser -prefsHandle 2928 -prefMapHandle 2840 -prefsLen 21744 -prefMapSize 233823 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5111274-0568-4bb5-a16a-1b2aebe98fbb} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 2924 28255e33258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.3.616883989\1955935908" -childID 2 -isForBrowser -prefsHandle 3168 -prefMapHandle 3164 -prefsLen 26922 -prefMapSize 233823 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {979a9031-320f-4f4b-8e49-d61560882570} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 1196 28246c62558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.4.1272402934\1749389008" -childID 3 -isForBrowser -prefsHandle 3600 -prefMapHandle 3596 -prefsLen 26922 -prefMapSize 233823 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {240e119d-693a-457c-a1a0-b3f124b676a7} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 3612 282564e2658 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.5.1586853609\1672020950" -childID 4 -isForBrowser -prefsHandle 4432 -prefMapHandle 4428 -prefsLen 26922 -prefMapSize 233823 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21493e7a-e235-40b0-8ce3-cc6e2fc1afab} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 4444 282564e0258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.6.49963555\276628705" -childID 5 -isForBrowser -prefsHandle 4580 -prefMapHandle 4584 -prefsLen 26922 -prefMapSize 233823 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eeb9dd0f-7e52-49cf-bcdb-157323dd63e8} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 4572 28257d8ec58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.7.1284599986\1026097902" -childID 6 -isForBrowser -prefsHandle 4772 -prefMapHandle 4776 -prefsLen 26922 -prefMapSize 233823 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92e48b09-cce5-46d4-af76-342a3e01fc8b} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 4856 28257d8f558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.8.440536164\1967134488" -childID 7 -isForBrowser -prefsHandle 5344 -prefMapHandle 5336 -prefsLen 26922 -prefMapSize 233823 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {65382b9f-a62d-4c36-9415-d4061fb1616d} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 5252 28259987758 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.9.2112234522\951304850" -childID 8 -isForBrowser -prefsHandle 3648 -prefMapHandle 3728 -prefsLen 26922 -prefMapSize 233823 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91a388e1-cc4a-4762-91c9-f7d01d472263} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 5336 2825a4d7c58 tab3⤵
-
-
C:\Users\Admin\Downloads\python-3.12.4-amd64.exe"C:\Users\Admin\Downloads\python-3.12.4-amd64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{39D05645-1DBB-44CF-968F-615B850F9264}\.cr\python-3.12.4-amd64.exe"C:\Windows\Temp\{39D05645-1DBB-44CF-968F-615B850F9264}\.cr\python-3.12.4-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.4-amd64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=5324⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\Temp\{4AE6FC56-5B95-494F-ACEB-1D0E5EF6BB06}\.be\python-3.12.4-amd64.exe"C:\Windows\Temp\{4AE6FC56-5B95-494F-ACEB-1D0E5EF6BB06}\.be\python-3.12.4-amd64.exe" -q -burn.elevated BurnPipe.{0ED03670-77E1-4A76-B3F7-F646026DF688} {7690E081-AAC0-4E5D-803C-6B643B676DB0} 55965⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.10.343706908\1758174409" -childID 9 -isForBrowser -prefsHandle 5164 -prefMapHandle 3888 -prefsLen 27085 -prefMapSize 233823 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0989d7ca-e28d-4835-9ede-38014b296d46} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 5528 28246c5e558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.11.678570225\790040295" -childID 10 -isForBrowser -prefsHandle 4928 -prefMapHandle 4924 -prefsLen 27094 -prefMapSize 233823 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37ad2d90-8234-4077-bb52-2074963328e9} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 4936 28254286458 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.12.1705304828\1365514618" -childID 11 -isForBrowser -prefsHandle 4924 -prefMapHandle 4944 -prefsLen 27094 -prefMapSize 233823 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a206248-6046-40a0-9627-2b40293866b6} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 4660 2825c0de458 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.13.151990462\1113113342" -childID 12 -isForBrowser -prefsHandle 4480 -prefMapHandle 3684 -prefsLen 27094 -prefMapSize 233823 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fef4254-384c-414e-b0be-9f7d9abba729} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 4892 2825a476f58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.14.923356388\44538396" -childID 13 -isForBrowser -prefsHandle 4008 -prefMapHandle 5248 -prefsLen 27094 -prefMapSize 233823 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59a8cee8-2166-43c5-972a-31a33011f93b} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 5832 2825ce93858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.15.1534891345\170127374" -parentBuildID 20221007134813 -prefsHandle 3688 -prefMapHandle 4496 -prefsLen 27094 -prefMapSize 233823 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e9882a8-f85b-4644-ae17-619c6d8b07c4} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 4876 2825d0f5e58 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3836.16.1105039784\1813795343" -childID 14 -isForBrowser -prefsHandle 6584 -prefMapHandle 4948 -prefsLen 27094 -prefMapSize 233823 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {17343520-b9f4-4278-876e-888fa37dd721} 3836 "\\.\pipe\gecko-crash-server-pipe.3836" 3888 2825ce4af58 tab3⤵
-
-
C:\Users\Admin\Downloads\BonziBuddy432.exe"C:\Users\Admin\Downloads\BonziBuddy432.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "4⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXEMSAGENT.EXE5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentCtl.dll"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDPv.dll"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\mslwvtts.dll"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDP2.dll"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentMPx.dll"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentSR.dll"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentPsh.dll"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\msagent\AgentSvr.exe"C:\Windows\msagent\AgentSvr.exe" /regserver6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exetv_enua.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o6⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CA363EB56C523762C8F1F2BE0982DBF92⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpq2bb_nmm\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpq2bb_nmm', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exepython test1.py2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exepython test.py2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exepython warna.py2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exepython test2.py2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x41c1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5e884b.rbs
e5e8850.rbs
e5e8855.rbs
e5e885a.rbs
e5e885f.rbs
e5e8864.rbs
e5e8869.rbs
e5e886e.rbs
e5e8873.rbs
e5e8878.rbs
ActiveSkin.ocx
BonziBDY_2.EXE
BonziBDY_35.EXE
BonziBDY_4.EXE
BonziCheckers.ocx
page17.jpg
page18.jpg
MSCOMCTL.OCX
MSINET.OCX
MSWINSCK.OCX
Regicon.ocx
CheckRuntimes.bat
SSCALA32.OCX
SSCALB32.OCX
Uninstall.exe
ssa3d30.ocx
sstabs2.ocx
20240802165737.pma
f_000001
f_000002
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Local State
Local State
Local State
Local State
Local State
Local State
data_1
persisted_first_party_sets.json
iconcache_idx.db
edgecompatviewlist[1].xml
14703
17828
18193
28268
31255
4906
6235
9236
075B8FCF1E4761117058C2EFF149858F93A6A354
21816B0DB510050B0FACA059FFBCA789FAFF93A3
27D779A1BA7663DAC01163103B356B7D3AFB1DC2
338BBB7ADD378B871C5B7D950FA71E91B4AAC2F2
38BE11E05E5BFC3CECC1D8386ABCD5523AF9D4EA
38BE11E05E5BFC3CECC1D8386ABCD5523AF9D4EA
3A2A2B038AE4360EFAF63C688232B9CBC7C9279D
4E5AF361F65B1CB7B0C51A993C6D07CB3547855B
5B23235D54208C34AFF88FC6F18585FD8A8F8FAD
5B23235D54208C34AFF88FC6F18585FD8A8F8FAD
6D89348819C8881868053197CA0754F36784BF5F
842A09BB00FA95724B0F6A72A1BB98F1728D9154
842A09BB00FA95724B0F6A72A1BB98F1728D9154
8540EC873F08CBAD5DF5121BD3BABF95624B4A14
90FDF7BDA570E06ED79190172CB7476CB4ECA5E3
B47C2290387CA81094036091C984E8DF3E89AE1C
B6666573B462283A3403C0599718DD1394C86D7C
C01A5A91B3215B34E7411A2001698454305F7026
C01A5A91B3215B34E7411A2001698454305F7026
C38828A589826967E45869A06026E590014D271E
D220F10BE3733A6F0925ABA487206ABC8442688C
D220F10BE3733A6F0925ABA487206ABC8442688C
E5FE0FD82E9F99773A440F234630A68ADB8F958D
E5FE0FD82E9F99773A440F234630A68ADB8F958D
EA87465A6B977981215042B94E7AB9FECDDEE708
EA87465A6B977981215042B94E7AB9FECDDEE708
EB25096E01B6106C1EA1B555C5D3513ED57894EE
EB25096E01B6106C1EA1B555C5D3513ED57894EE
F18D85F52EBBBA2AB081EF739ED0D6E8A76D497C
F8D2E540484662F96C508D774D38A9CC0519306D
FF3F210B1A739636818C710689AE1609E00572A2
7AXYMo_b+A3n7EVMiwKbow==.ico
CQLyu3FnEfevu2zuBXN_VA==.ico
scriptCache.bin
urlCache.bin
doc_JustForMe
lib_JustForMe
tcltk_JustForMe
suggestions[1].en-US
INSTALLER
__init__.py
__main__.py
__pip-runner__.py
__init__.py
build_env.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
metadata_legacy.py
wheel.py
wheel_editable.py
wheel_legacy.py
check.py
freeze.py
__init__.py
editable_legacy.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
encoding.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
models.py
packaging.py
setuptools_build.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
core.py
__init__.py
big5freq.py
big5prober.py
chardistribution.py
charsetgroupprober.py
charsetprober.py
chardetect.py
codingstatemachine.py
codingstatemachinedict.py
cp949prober.py
enums.py
escprober.py
escsm.py
eucjpprober.py
euckrfreq.py
euckrprober.py
euctwfreq.py
euctwprober.py
gb2312freq.py
gb2312prober.py
hebrewprober.py
jisfreq.py
johabfreq.py
johabprober.py
jpcntx.py
langbulgarianmodel.py
langgreekmodel.py
langhebrewmodel.py
langhungarianmodel.py
langrussianmodel.py
langthaimodel.py
langturkishmodel.py
latin1prober.py
macromanprober.py
mbcharsetprober.py
mbcsgroupprober.py
mbcssm.py
languages.py
resultdict.py
sbcharsetprober.py
sbcsgroupprober.py
sjisprober.py
universaldetector.py
utf1632prober.py
utf8prober.py
version.py
__init__.py
ansi.py
ansitowin32.py
initialise.py
__init__.py
ansi_test.py
ansitowin32_test.py
initialise_test.py
isatty_test.py
utils.py
winterm_test.py
win32.py
winterm.py
__init__.py
compat.py
database.py
index.py
locators.py
manifest.py
markers.py
metadata.py
resources.py
scripts.py
util.py
version.py
wheel.py
__init__.py
__main__.py
distro.py
__init__.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
__about__.py
__init__.py
_manylinux.py
_musllinux.py
_structures.py
markers.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
cmdline.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
bbcode.py
groff.py
html.py
img.py
irc.py
latex.py
other.py
pangomarkup.py
rtf.py
svg.py
terminal.py
terminal256.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
token.py
unistring.py
util.py
__init__.py
actions.py
common.py
core.py
__init__.py
exceptions.py
helpers.py
results.py
testing.py
unicode.py
util.py
__init__.py
_compat.py
_impl.py
__init__.py
_in_process.py
__init__.py
__version__.py
_internal_utils.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
collections_abc.py
providers.py
reporters.py
resolvers.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
six.py
__init__.py
_asyncio.py
_utils.py
after.py
before.py
before_sleep.py
nap.py
retry.py
stop.py
tornadoweb.py
wait.py
__init__.py
_parser.py
_re.py
_types.py
__init__.py
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
typing_extensions.py
__init__.py
_collections.py
_version.py
connection.py
connectionpool.py
_appengine_environ.py
bindings.py
low_level.py
appengine.py
ntlmpool.py
pyopenssl.py
securetransport.py
socks.py
exceptions.py
fields.py
filepost.py
makefile.py
weakref_finalize.py
six.py
poolmanager.py
request.py
response.py
__init__.py
connection.py
proxy.py
queue.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
wait.py
__init__.py
labels.py
mklabels.py
tests.py
x_user_defined.py
__init__.py
__main__.py
pip3.12.exe
python.exe
0001.tmp
0002.tmp
0003.tmp
0004.tmp
0005.tmp
0006.tmp
ADVPACK.DLL
AGENTANM.DLL
AGENTCTL.DLL
AGENTDP2.DLL
AGENTDPV.DLL
AGENTMPX.DLL
AGENTPSH.DLL
AGENTSR.DLL
AGENTSVR.EXE
AGT0409.DLL
AGT0409.HLP
AGT20.INF
AGTCTL15.TLB
AGTINST.INF
MSLWVTTS.DLL
Msvcirt.dll
Msvcp50.dll
W95INF16.DLL
W95INF32.DLL
andmoipa.ttf
tv_enua.dll
tv_enua.hlp
tv_enua.inf
tvenuax.dll
tmpaddon
tmpaddon-1
40371339ad31a7e6.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
AlternateServices.txt
SiteSecurityServiceState.txt
addonStartup.json.lz4
broadcast-listeners.json.tmp
cert9.db
cookies.sqlite
store.json.mozlz4.tmp
data.safe.bin
data.safe.bin
events
2c0255a2-5235-47c5-a5d8-ffd005831831
5e65f846-50c8-4bf5-a649-1a58a93852ed
8684b18c-0cda-4e9b-898f-262c2c4106f0
d8ca0e20-526e-4d14-bf94-34290bae0168
dab75c81-9e7e-4303-8291-e6dc40bb8d82
e24f3dd2-e240-40f3-9510-da6eddef9c3c
favicons.sqlite
formhistory.sqlite
gmpopenh264.dll
gmpopenh264.info
LICENSE.txt
manifest.json
widevinecdm.dll
widevinecdm.dll.lib
widevinecdm.dll.sig
permissions.sqlite
places.sqlite
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
protections.sqlite
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json.tmp
sessionCheckpoints.json.tmp
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
sessionstore.jsonlz4
storage.sqlite
.metadata-v2
data.sqlite
usage
1657114595AmcateirvtiSty.sqlite
3870112724rsegmnoittet-es.sqlite
xulstore.json
BonziBuddy432.nOA9JiQx.exe.part
python-3.12.4-amd64.exe
python-3.DMd1Al_n.12.4-amd64.exe.part
python-3.12.4-amd64.exe
SideBar.png
pip_JustForMe
Bonzi.acs
Peedy.acs
memory/968-12805-0x000001E2D4440000-0x000001E2D4442000-memory.dmp
memory/968-12885-0x000001E2E4CE0000-0x000001E2E4CE2000-memory.dmp
memory/968-12808-0x000001E2D4470000-0x000001E2D4472000-memory.dmp
memory/968-12804-0x000001E2D4700000-0x000001E2D4800000-memory.dmp
memory/968-12826-0x000001E2E4DB0000-0x000001E2E4DB2000-memory.dmp
memory/968-12861-0x000001E2E5ED0000-0x000001E2E5ED2000-memory.dmp
memory/968-12859-0x000001E2E5EB0000-0x000001E2E5EB2000-memory.dmp
memory/968-12865-0x000001E2E6000000-0x000001E2E6002000-memory.dmp
memory/968-12867-0x000001E2E6010000-0x000001E2E6012000-memory.dmp
memory/968-12863-0x000001E2E5EF0000-0x000001E2E5EF2000-memory.dmp
memory/968-12875-0x000001E2E60D0000-0x000001E2E60D2000-memory.dmp
memory/968-12873-0x000001E2E60B0000-0x000001E2E60B2000-memory.dmp
memory/968-12891-0x000001E2E4D30000-0x000001E2E4D32000-memory.dmp
memory/968-12889-0x000001E2E4D10000-0x000001E2E4D12000-memory.dmp
memory/968-12887-0x000001E2E4D00000-0x000001E2E4D02000-memory.dmp
memory/968-12810-0x000001E2D44D0000-0x000001E2D44D2000-memory.dmp
memory/968-12893-0x000001E2E4BC0000-0x000001E2E4BC2000-memory.dmp
memory/968-12983-0x000001E2E4A60000-0x000001E2E4A62000-memory.dmp
memory/968-12911-0x000001E2E4D60000-0x000001E2E4D62000-memory.dmp
memory/968-12944-0x000001E2E5100000-0x000001E2E5200000-memory.dmp
memory/5256-12790-0x0000026ACB080000-0x0000026ACB180000-memory.dmp
memory/5256-12789-0x0000026ACB080000-0x0000026ACB180000-memory.dmp
memory/6092-12992-0x00000242D2700000-0x00000242D35C2000-memory.dmp
memory/6092-12781-0x00000242C8B30000-0x00000242C8B32000-memory.dmp
memory/6092-12747-0x00000242CB530000-0x00000242CB540000-memory.dmp
memory/6092-12762-0x00000242CB620000-0x00000242CB630000-memory.dmp
memory/6972-12782-0x0000000000400000-0x0000000000424000-memory.dmp
memory/6972-12745-0x0000000000400000-0x0000000000424000-memory.dmp
memory/6972-11735-0x0000000000400000-0x0000000000424000-memory.dmp