Resubmissions
27/12/2025, 16:30
251227-tz9k8atkhp14/11/2025, 18:24
251114-w2fr2avqfv312/04/2025, 14:57
250412-sbk3aawry5912/04/2025, 14:56
250412-sbdyzawrx9112/04/2025, 14:53
250412-r9mhbswrv88Analysis
- max time kernel
1508s - max time network
1800s - platform
windows11-21h2_x64 - resource
win11-20250410-en - resource tags
- submitted
12/04/2025, 14:57
General
- Target guns.lol-view-bot-main/proxies.txt
- Size 2KB
- Sample250412-sbk3aawry5
- SHA256 089bcf2033cfae289591e42def8dd18e90ed9eac165c5c593cdc7afd2c670fd4
Score
9/10
Malware Config
Signatures
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Downloads MZ/PE file 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Kills process with taskkill 1 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 22 IoCs
- Modifies system certificate store 2 TTPs 10 IoCs
- NTFS ADS 3 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 26 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\guns.lol-view-bot-main\proxies.txt1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\guns.lol-view-bot-main\proxies.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab5fddcf8,0x7ffab5fddd04,0x7ffab5fddd102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1968,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=1964 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2196,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2272 /prefetch:112⤵
- Downloads MZ/PE file
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2388,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2300 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3204,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3292 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3280,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4188,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4208 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4628,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4644 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4844,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4800 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3456,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3304 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3668,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5472,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5432 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5972,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=6004 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4612,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3500 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4720,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3564 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4724,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=212 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4648,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4688 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4712,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4604 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4616,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4800 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5660,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4608,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3496 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6432,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6044,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=6084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5860,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=6516 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6492,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=872 /prefetch:142⤵
- NTFS ADS
-
-
C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.99.2.exe"C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.99.2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-LK8RA.tmp\VSCodeUserSetup-x64-1.99.2.tmp"C:\Users\Admin\AppData\Local\Temp\is-LK8RA.tmp\VSCodeUserSetup-x64-1.99.2.tmp" /SL5="$7022E,106178340,841216,C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.99.2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Get-WmiObject Win32_Process | Where-Object { $_.ExecutablePath -eq 'C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe' } | Select @{Name='Id'; Expression={$_.ProcessId}} | Stop-Process -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code" /inheritancelevel:r /grant:r "*S-1-5-18:(OI)(CI)F" /grant:r "*S-1-5-32-544:(OI)(CI)F" /grant:r "*S-1-5-11:(OI)(CI)RX" /grant:r "*S-1-5-32-545:(OI)(CI)RX" /grant:r "*S-1-3-0:(OI)(CI)F" /grant:r "Admin:(OI)(CI)F"4⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1848,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1860,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:115⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3176,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3136 --vscode-window-config=vscode:63862b6e-dd52-4005-a5ba-52acac0ce73b /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3664,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:145⤵
- Executes dropped EXE
- Loads dropped DLL
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe" tunnel status6⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-python.python-2025.4.0-win32-x64 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-python.python-2025.4.0-win32-x64.sigzip6⤵
- Executes dropped EXE
- Modifies system certificate store
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-python.debugpy-2025.6.0-win32-x64 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-python.debugpy-2025.6.0-win32-x64.sigzip6⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-python.vscode-pylance-2025.4.1 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-python.vscode-pylance-2025.4.1.sigzip6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3696,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:145⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3756,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:145⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"5⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q6⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4144,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4140 --vscode-window-config=vscode:63862b6e-dd52-4005-a5ba-52acac0ce73b /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\wsl.exeC:\Windows\System32\wsl.exe --status5⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3472,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4128 --vscode-window-config=vscode:63862b6e-dd52-4005-a5ba-52acac0ce73b /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4408,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4172 --vscode-window-config=vscode:63862b6e-dd52-4005-a5ba-52acac0ce73b /prefetch:15⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4400,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2628 --vscode-window-config=vscode:63862b6e-dd52-4005-a5ba-52acac0ce73b /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3768,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:145⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=4416,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:145⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\SOFTWARE\Python /reg:646⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python /reg:646⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "pyenv which python"6⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\SOFTWARE\Python /reg:326⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python /reg:326⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "python -c "import sys;print(sys.executable)""6⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c "import sys;print(sys.executable)"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "pyenv which python"6⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\server.bundle.js --cancellationReceive=file:0974429469426669c7c31d96421f76484ef4dc76ad --node-ipc --clientProcessId=9126⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -I -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(tuple(sys.version_info), sys.stdout)"7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -I -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(tuple(sys.version_info), sys.stdout)"7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "python -c "import sys;print(sys.executable)""6⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c "import sys;print(sys.executable)"7⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"5⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q6⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=6476,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=6480 --vscode-window-config=vscode:63862b6e-dd52-4005-a5ba-52acac0ce73b /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"5⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q6⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=6040,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:105⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=6500,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4544 --vscode-window-config=vscode:63862b6e-dd52-4005-a5ba-52acac0ce73b /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=6380,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=6448 --vscode-window-config=vscode:63862b6e-dd52-4005-a5ba-52acac0ce73b /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"5⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q6⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=6568,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3728 --vscode-window-config=vscode:63862b6e-dd52-4005-a5ba-52acac0ce73b /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=5036,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:145⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\conhost.exe\\?\C:\Windows\system32\conhost.exe --headless --width 80 --height 30 --signal 0x3d0 --server 0x3c86⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -command "try { . \"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\workbench\contrib\terminal\common\scripts\shellIntegration.ps1\" } catch {}"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\node-pty\lib\conpty_console_list_agent" 88046⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\conhost.exe\\?\C:\Windows\system32\conhost.exe --headless --width 80 --height 30 --signal 0x3d4 --server 0x3fc6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -command "try { . \"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\workbench\contrib\terminal\common\scripts\shellIntegration.ps1\" } catch {}"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"5⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q6⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5012,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4296 --vscode-window-config=vscode:63862b6e-dd52-4005-a5ba-52acac0ce73b /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=5832,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:145⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\SOFTWARE\Python /reg:646⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "pyenv which python"6⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python /reg:646⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\SOFTWARE\Python /reg:326⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python /reg:326⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "python -c "import sys;print(sys.executable)""6⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c "import sys;print(sys.executable)"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "pyenv which python"6⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\server.bundle.js --cancellationReceive=file:d8234a2ee268042aa9194563ff5eec4d555dd43f66 --node-ipc --clientProcessId=167966⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -I -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(tuple(sys.version_info), sys.stdout)"7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -I -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(tuple(sys.version_info), sys.stdout)"7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py7⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "python -c "import sys;print(sys.executable)""6⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c "import sys;print(sys.executable)"7⤵
-
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g !**/.git -g !**/.svn -g !**/.hg -g !**/.DS_Store -g !**/Thumbs.db -g !**/node_modules -g !**/bower_components -g !**/*.code-search --no-ignore-parent --follow --no-config --no-ignore-global6⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g !**/.git -g !**/.svn -g !**/.hg -g !**/.DS_Store -g !**/Thumbs.db -g !**/node_modules -g !**/bower_components -g !**/*.code-search --no-ignore-parent --follow --no-config --no-ignore-global6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=6656,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:145⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"5⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"5⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q6⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4364,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=6576 --vscode-window-config=vscode:63862b6e-dd52-4005-a5ba-52acac0ce73b /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5792,i,13058666098966975903,13424929291928023370,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4880 --vscode-window-config=vscode:63862b6e-dd52-4005-a5ba-52acac0ce73b /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1172,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=872 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4668,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=6784 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=1552,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=7016 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6020,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=6808 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6712,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=6880 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=7064,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=7080 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=7372,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=7356 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=7384,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=7496 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=7656,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=7668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=7524,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=7596 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=7768,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=6908 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=5656,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=6032 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=7252,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=7236 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=7072,i,3251097667534138602,7380214606087375978,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5036 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\python-3.13.3-amd64.exe"C:\Users\Admin\Downloads\python-3.13.3-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{FCF7FF05-06DC-4B3D-A32A-0A78F9C95D22}\.cr\python-3.13.3-amd64.exe"C:\Windows\Temp\{FCF7FF05-06DC-4B3D-A32A-0A78F9C95D22}\.cr\python-3.13.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.13.3-amd64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=7603⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\pythonw.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python313\pythonw.exe" -c "import winreg; winreg.SetValueEx(winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\FileSystem'), 'LongPathsEnabled', None, winreg.REG_DWORD, 1)"4⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004E41⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\guns.lol-view-bot-main\instal.bat" "1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Package Cache\{08e71e50-ef1b-4db1-82a2-622d72b5fee9}\python-3.13.3-amd64.exe" /burn.runonce1⤵
-
C:\Users\Admin\AppData\Local\Package Cache\{08e71e50-ef1b-4db1-82a2-622d72b5fee9}\python-3.13.3-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{08e71e50-ef1b-4db1-82a2-622d72b5fee9}\python-3.13.3-amd64.exe" /burn.runonce2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{08e71e50-ef1b-4db1-82a2-622d72b5fee9}\python-3.13.3-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{08e71e50-ef1b-4db1-82a2-622d72b5fee9}\python-3.13.3-amd64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.13.3 (64-bit)_20250412150408.log"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{08e71e50-ef1b-4db1-82a2-622d72b5fee9}\python-3.13.3-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{08e71e50-ef1b-4db1-82a2-622d72b5fee9}\python-3.13.3-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{08e71e50-ef1b-4db1-82a2-622d72b5fee9}\python-3.13.3-amd64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.13.3 (64-bit)_20250412150408.log"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DCFC7A35F676C018DA79F22B830D2FF22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe" -I -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp09_pd50c\\pip-25.0.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp09_pd50c', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Code /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Code\Crashpad --url=appcenter://code?aid=a4e3233c-699c-46ec-b4f4-9c2a77254662&uid=cc2f856d-1ab4-439b-80e4-6733876bc153&iid=cc2f856d-1ab4-439b-80e4-6733876bc153&sid=cc2f856d-1ab4-439b-80e4-6733876bc153 --annotation=_companyName=Microsoft --annotation=_productName=VSCode --annotation=_version=1.99.2 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=34.3.2 --initial-client-data=0x480,0x484,0x488,0x47c,0x48c,0x7ff6d6924534,0x7ff6d6924540,0x7ff6d69245502⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1736,i,18230746364772978519,1330874939095695954,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:22⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=2000,i,18230746364772978519,1330874939095695954,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:112⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3092,i,18230746364772978519,1330874939095695954,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3088 --vscode-window-config=vscode:7b6fb771-635a-402d-98b1-bf9024fc633d /prefetch:12⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3640,i,18230746364772978519,1330874939095695954,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:142⤵
- Executes dropped EXE
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\SOFTWARE\Python /reg:643⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python /reg:643⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "pyenv which python"3⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python\PyLauncher /reg:643⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python\PythonCore /reg:643⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python\PythonCore\3.13 /reg:643⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python\PythonCore\3.13 /reg:643⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python\PythonCore\3.13\InstallPath /reg:643⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\SOFTWARE\Python /reg:323⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python /reg:323⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python\PyLauncher /reg:323⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python\PythonCore /reg:323⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python\PythonCore\3.13 /reg:323⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python\PythonCore\3.13 /reg:323⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\SOFTWARE\Python\PythonCore\3.13\InstallPath /reg:323⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -I c:\Users\Admin\.vscode\extensions\ms-python.python-2025.4.0-win32-x64\python_files\get_output_via_markers.py c:\Users\Admin\.vscode\extensions\ms-python.python-2025.4.0-win32-x64\python_files\interpreterInfo.py"3⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -I c:\Users\Admin\.vscode\extensions\ms-python.python-2025.4.0-win32-x64\python_files\get_output_via_markers.py c:\Users\Admin\.vscode\extensions\ms-python.python-2025.4.0-win32-x64\python_files\interpreterInfo.py4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\server.bundle.js --cancellationReceive=file:adaa77f5329364d4e8e31e994b1dc47c48a7010fb5 --node-ipc --clientProcessId=133843⤵
- Executes dropped EXE
-
\??\c:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -I -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(tuple(sys.version_info), sys.stdout)"4⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"4⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py4⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -I -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(tuple(sys.version_info), sys.stdout)"4⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"4⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"4⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py4⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py4⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py4⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"4⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py4⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"4⤵
-
-
\??\c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -I -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(tuple(sys.version_info), sys.stdout)"4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -I -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(tuple(sys.version_info), sys.stdout)"5⤵
-
-
-
\??\c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"5⤵
-
-
-
\??\c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"5⤵
-
-
-
\??\c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py5⤵
-
-
-
\??\c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -I c:\Users\Admin\.vscode\extensions\ms-python.vscode-pylance-2025.4.1\dist\bundled\files\get_pytest_options.py5⤵
-
-
-
\??\c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -c "import os, os.path, sys; normalize = lambda p: os.path.normcase(os.path.normpath(p)); cwd = normalize(os.getcwd()); orig_sys_path = [p for p in sys.path if p != \"\"]; sys.path[:] = [p for p in sys.path if p != \"\" and normalize(p) != cwd]; import sys, json; json.dump(dict(path=orig_sys_path, prefix=sys.prefix), sys.stdout)"5⤵
-
-
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*requirement*.txt -g !**/.git -g !**/.svn -g !**/.hg -g !**/.DS_Store -g !**/Thumbs.db -g !**/{.venv*,.git,.nox,.tox,.conda,site-packages,__pypackages__}/** --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/requirements/*.txt -g !**/.git -g !**/.svn -g !**/.hg -g !**/.DS_Store -g !**/Thumbs.db -g !**/{.venv*,.git,.nox,.tox,.conda,site-packages,__pypackages__}/** --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*requirement*.txt -g !**/.git -g !**/.svn -g !**/.hg -g !**/.DS_Store -g !**/Thumbs.db -g !**/{.venv*,.git,.nox,.tox,.conda,site-packages,__pypackages__}/** --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/requirements/*.txt -g !**/.git -g !**/.svn -g !**/.hg -g !**/.DS_Store -g !**/Thumbs.db -g !**/{.venv*,.git,.nox,.tox,.conda,site-packages,__pypackages__}/** --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe c:\Users\Admin\.vscode\extensions\ms-python.python-2025.4.0-win32-x64\python_files\create_venv.py --git-ignore --requirements c:\Users\Admin\Downloads\guns.lol-view-bot-main\requirements.txt3⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -m venv .venv4⤵
-
\??\c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -m ensurepip --upgrade --default-pip5⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -m ensurepip --upgrade --default-pip6⤵
-
\??\c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpkesxt_qe\\pip-25.0.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpkesxt_qe', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "7⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpkesxt_qe\\pip-25.0.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpkesxt_qe', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "8⤵
-
-
-
-
-
-
\??\c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -m pip install --upgrade pip4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -m pip install --upgrade pip5⤵
- Modifies system certificate store
-
-
-
\??\c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -m pip install -r c:\Users\Admin\Downloads\guns.lol-view-bot-main\requirements.txt4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -m pip install -r c:\Users\Admin\Downloads\guns.lol-view-bot-main\requirements.txt5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -I c:\Users\Admin\.vscode\extensions\ms-python.python-2025.4.0-win32-x64\python_files\get_output_via_markers.py c:\Users\Admin\.vscode\extensions\ms-python.python-2025.4.0-win32-x64\python_files\interpreterInfo.py"3⤵
-
\??\c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -I c:\Users\Admin\.vscode\extensions\ms-python.python-2025.4.0-win32-x64\python_files\get_output_via_markers.py c:\Users\Admin\.vscode\extensions\ms-python.python-2025.4.0-win32-x64\python_files\interpreterInfo.py4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -I c:\Users\Admin\.vscode\extensions\ms-python.python-2025.4.0-win32-x64\python_files\get_output_via_markers.py c:\Users\Admin\.vscode\extensions\ms-python.python-2025.4.0-win32-x64\python_files\interpreterInfo.py5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -c "& c:/Users/Admin/Downloads/guns.lol-view-bot-main/.venv/Scripts/Activate.ps1 ; echo 'e8b39361-0157-4923-80e1-22d70d46dee6' ; python c:/Users/Admin/.vscode/extensions/ms-python.python-2025.4.0-win32-x64/python_files/printEnvVariables.py"3⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\python.exe" c:/Users/Admin/.vscode/extensions/ms-python.python-2025.4.0-win32-x64/python_files/printEnvVariables.py4⤵
-
-
-
C:\Windows\system32\cmd.execmd /d /s /c "c:/Users/Admin/Downloads/guns.lol-view-bot-main/.venv/Scripts/activate.bat && echo 'e8b39361-0157-4923-80e1-22d70d46dee6' && python c:/Users/Admin/.vscode/extensions/ms-python.python-2025.4.0-win32-x64/python_files/printEnvVariables.py"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\chcp.com"4⤵
-
C:\Windows\System32\chcp.comC:\Windows\System32\chcp.com5⤵
-
-
-
C:\Windows\System32\chcp.com"C:\Windows\System32\chcp.com" 650014⤵
-
-
C:\Windows\System32\chcp.com"C:\Windows\System32\chcp.com" 4374⤵
-
-
\??\c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exepython c:/Users/Admin/.vscode/extensions/ms-python.python-2025.4.0-win32-x64/python_files/printEnvVariables.py4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exepython c:/Users/Admin/.vscode/extensions/ms-python.python-2025.4.0-win32-x64/python_files/printEnvVariables.py5⤵
-
-
-
-
C:\Windows\system32\cmd.execmd /d /s /c "C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe c:/Users/Admin/.vscode/extensions/ms-python.python-2025.4.0-win32-x64/python_files/printEnvVariables.py"3⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe c:/Users/Admin/.vscode/extensions/ms-python.python-2025.4.0-win32-x64/python_files/printEnvVariables.py4⤵
-
-
-
\??\c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe c:\Users\Admin\.vscode\extensions\ms-python.debugpy-2025.6.0-win32-x64\bundled\libs\debugpy\adapter3⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe c:\Users\Admin\.vscode\extensions\ms-python.debugpy-2025.6.0-win32-x64\bundled\libs\debugpy\adapter4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /PID 7252"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /T /PID 72524⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3724,i,18230746364772978519,1330874939095695954,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:142⤵
- Executes dropped EXE
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe" tunnel status3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3788,i,18230746364772978519,1330874939095695954,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:142⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=4000,i,18230746364772978519,1330874939095695954,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:142⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\conhost.exe\\?\C:\Windows\system32\conhost.exe --headless --width 80 --height 30 --signal 0x3cc --server 0x3c43⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -command "try { . \"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\workbench\contrib\terminal\common\scripts\shellIntegration.ps1\" } catch {}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\conhost.exe\\?\C:\Windows\system32\conhost.exe --headless --width 106 --height 11 --signal 0x42c --server 0x4283⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -command "try { . \"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\workbench\contrib\terminal\common\scripts\shellIntegration.ps1\" } catch {}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe" c:/Users/Admin/Downloads/guns.lol-view-bot-main/main.py4⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\node-pty\lib\conpty_console_list_agent" 232163⤵
-
-
C:\Windows\system32\conhost.exe\\?\C:\Windows\system32\conhost.exe --headless --width 80 --height 30 --signal 0x474 --server 0x44c3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -command "try { . \"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\workbench\contrib\terminal\common\scripts\shellIntegration.ps1\" } catch {}"3⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe"C:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe" c:/Users/Admin/Downloads/guns.lol-view-bot-main/main.py4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe"C:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe" c:/Users/Admin/Downloads/guns.lol-view-bot-main/main.py5⤵
-
-
-
-
C:\Windows\system32\conhost.exe\\?\C:\Windows\system32\conhost.exe --headless --width 116 --height 11 --signal 0x470 --server 0x4603⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -command "try { . \"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\workbench\contrib\terminal\common\scripts\shellIntegration.ps1\" } catch {}"3⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe"C:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe" c:/Users/Admin/Downloads/guns.lol-view-bot-main/main.py4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe"C:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe" c:/Users/Admin/Downloads/guns.lol-view-bot-main/main.py5⤵
-
-
-
-
C:\Windows\system32\conhost.exe\\?\C:\Windows\system32\conhost.exe --headless --width 99 --height 11 --signal 0x4d4 --server 0x4d03⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -command "try { . \"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\workbench\contrib\terminal\common\scripts\shellIntegration.ps1\" } catch {}"3⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe"C:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe" c:\Users\Admin\.vscode\extensions\ms-python.debugpy-2025.6.0-win32-x64\bundled\libs\debugpy\launcher 59870 -- c:\Users\Admin\Downloads\guns.lol-view-bot-main\main.py4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe"C:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe" c:\Users\Admin\.vscode\extensions\ms-python.debugpy-2025.6.0-win32-x64\bundled\libs\debugpy\launcher 59870 -- c:\Users\Admin\Downloads\guns.lol-view-bot-main\main.py5⤵
-
\??\c:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -X frozen_modules=off c:\Users\Admin\.vscode\extensions\ms-python.debugpy-2025.6.0-win32-x64\bundled\libs\debugpy\launcher/../..\debugpy --connect 127.0.0.1:59869 --configure-qt none --adapter-access-token 6b86a8ac212d80b629b3e52b6ba6a67987187b046f0b01a522be07cffbeba644 c:\Users\Admin\Downloads\guns.lol-view-bot-main\main.py6⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exec:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe -X frozen_modules=off c:\Users\Admin\.vscode\extensions\ms-python.debugpy-2025.6.0-win32-x64\bundled\libs\debugpy\launcher/../..\debugpy --connect 127.0.0.1:59869 --configure-qt none --adapter-access-token 6b86a8ac212d80b629b3e52b6ba6a67987187b046f0b01a522be07cffbeba644 c:\Users\Admin\Downloads\guns.lol-view-bot-main\main.py7⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\node-pty\lib\conpty_console_list_agent" 50363⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\node-pty\lib\conpty_console_list_agent" 15363⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\node-pty\lib\conpty_console_list_agent" 77403⤵
-
-
C:\Windows\system32\conhost.exe\\?\C:\Windows\system32\conhost.exe --headless --width 80 --height 30 --signal 0x4ec --server 0x4c03⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -command "try { . \"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\workbench\contrib\terminal\common\scripts\shellIntegration.ps1\" } catch {}"3⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe"C:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe" c:/Users/Admin/Downloads/guns.lol-view-bot-main/main.py4⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe"C:\Users\Admin\Downloads\guns.lol-view-bot-main\.venv\Scripts\python.exe" c:/Users/Admin/Downloads/guns.lol-view-bot-main/main.py5⤵
-
-
-
-
-
C:\Windows\System32\wsl.exeC:\Windows\System32\wsl.exe --status2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2824,i,18230746364772978519,1330874939095695954,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:102⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab5fddcf8,0x7ffab5fddd04,0x7ffab5fddd102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1820,i,16956461305745527240,13817911685607032975,262144 --variations-seed-version=20250411-130057.255000 --mojo-platform-channel-handle=1808 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2188,i,16956461305745527240,13817911685607032975,262144 --variations-seed-version=20250411-130057.255000 --mojo-platform-channel-handle=2080 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2336,i,16956461305745527240,13817911685607032975,262144 --variations-seed-version=20250411-130057.255000 --mojo-platform-channel-handle=2352 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,16956461305745527240,13817911685607032975,262144 --variations-seed-version=20250411-130057.255000 --mojo-platform-channel-handle=3396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3312,i,16956461305745527240,13817911685607032975,262144 --variations-seed-version=20250411-130057.255000 --mojo-platform-channel-handle=3420 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4392,i,16956461305745527240,13817911685607032975,262144 --variations-seed-version=20250411-130057.255000 --mojo-platform-channel-handle=4428 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4556,i,16956461305745527240,13817911685607032975,262144 --variations-seed-version=20250411-130057.255000 --mojo-platform-channel-handle=4388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3624,i,16956461305745527240,13817911685607032975,262144 --variations-seed-version=20250411-130057.255000 --mojo-platform-channel-handle=3436 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4772,i,16956461305745527240,13817911685607032975,262144 --variations-seed-version=20250411-130057.255000 --mojo-platform-channel-handle=3524 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5336,i,16956461305745527240,13817911685607032975,262144 --variations-seed-version=20250411-130057.255000 --mojo-platform-channel-handle=5348 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5d6bb0.rbs
e5d6bb5.rbs
e5d6bba.rbs
e5d6bbf.rbs
e5d6bc4.rbs
e5d6bc9.rbs
e5d6bce.rbs
e5d6bd3.rbs
e5d6bd8.rbs
argv.json
__init__.pyi
urls.pyi
console.pyi
_typing.pyi
__init__.pyi
setup.pyi
setup.pyi
setup.pyi
cp1250.pyi
cp850.pyi
cp950.pyi
casio.pyi
cmark.pyi
import.pyi
images.pyi
version.pyi
__init__.pyi
luajit20.pyi
__init__.pyi
CGIHTTPServer.pyi
icon.png
package.json
SECURITY.md
__init__.py
package.json
package.json
WHEEL
urls.pyi
clearsessions.pyi
console.pyi
ntpath.pyi
expatbuilder.pyi
posixpath.pyi
nodes.pyi
CGIHTTPServer.pyi
grammar310.txt
LICENSE
INSTALLER
WHEEL
extensions.json
extensions.json
extensions.json
package.nls.json
package.nls.json
package.nls.json
settings.dat
BrowsingTopicsState
f_000001
f_000004
f_000006
f_000014
f_000015
f_000032
f_000034
the-real-index
the-real-index
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe57dc95.TMP
the-real-index
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5c4500.TMP
CURRENT
Local State
Local State
Local State
Local State
Local State
Local State
Local State
doc_JustForMe
lib_JustForMe
tcltk_JustForMe
AILog.txt
AILog.txt
AILog.txt
AILog.txt
AILog.txt
290fe528-24bc-4c22-98ee-9d12a24af8dd.down_data
~earchHoverUnifiedTileModelCache.tmp
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
en-US.pak
resources.pak
is-CABQ5.tmp
is-NG9NR.tmp
is-HDJOE.tmp
is-3Q1PV.tmp
is-NT8OQ.tmp
is-G7441.tmp
is-QADS9.tmp
is-B7EI4.tmp
vscode-policy-watcher.node
index.js
package.json
bindings.js
package.json
index.js
package.json
is-B6TKO.tmp
is-DPETR.tmp
is-KS6EK.tmp
is-NEQSD.tmp
is-9N097.tmp
is-532NU.tmp
is-2KH7R.tmp
is-8PO71.tmp
is-TLUVN.tmp
is-VMAUT.tmp
is-IK17R.tmp
is-BHGSO.tmp
is-UTPTC.tmp
is-OBTKL.tmp
is-CU032.tmp
main.js
nls.messages.json
package.json
product.json
v8_context_snapshot.bin
__init__.py
__main__.py
__pip-runner__.py
__init__.py
build_env.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
index_command.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
metadata_legacy.py
wheel.py
wheel_editable.py
wheel_legacy.py
check.py
freeze.py
__init__.py
editable_legacy.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
packaging.py
retry.py
setuptools_build.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
cacert.pem
core.py
__init__.py
compat.py
database.py
index.py
locators.py
manifest.py
markers.py
metadata.py
resources.py
scripts.py
util.py
version.py
wheel.py
__init__.py
__main__.py
distro.py
__init__.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
__init__.py
_spdx.py
markers.py
metadata.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
cmdline.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
bbcode.py
groff.py
html.py
img.py
irc.py
latex.py
other.py
pangomarkup.py
rtf.py
svg.py
terminal.py
terminal256.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
_mapping.py
token.py
unistring.py
util.py
__init__.py
_impl.py
__init__.py
_in_process.py
__init__.py
__version__.py
_internal_utils.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
collections_abc.py
providers.py
reporters.py
resolvers.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
__init__.py
_parser.py
_re.py
_types.py
__init__.py
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
typing_extensions.py
__init__.py
_collections.py
_version.py
connection.py
connectionpool.py
_appengine_environ.py
bindings.py
low_level.py
appengine.py
ntlmpool.py
pyopenssl.py
securetransport.py
socks.py
exceptions.py
fields.py
filepost.py
makefile.py
weakref_finalize.py
six.py
poolmanager.py
request.py
response.py
__init__.py
connection.py
proxy.py
queue.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
wait.py
__init__.py
__main__.py
pip3.13.exe
python.exe
B3W7M7gK
__PSScriptPolicyTest_lkm0fej4.0ze.ps1
gxr96p0h
VSCodeUserSetup-x64-1.99.2.tmp
certifi-2025.1.31-py3-none-any.whl.metadata
charset_normalizer-3.4.1-cp313-cp313-win_amd64.whl.metadata
certifi-2025.1.31-py3-none-any.whl
charset_normalizer-3.4.1-cp313-cp313-win_amd64.whl
cloudscraper-1.2.71-py2.py3-none-any.whl
colorama-0.4.6-py2.py3-none-any.whl
idna-3.10-py3-none-any.whl
pyparsing-3.2.3-py3-none-any.whl
requests-2.32.3-py3-none-any.whl
requests_toolbelt-1.0.0-py2.py3-none-any.whl
urllib3-2.4.0-py3-none-any.whl
urllib3-2.4.0-py3-none-any.whl.metadata
idna-3.10-py3-none-any.whl.metadata
pyparsing-3.2.3-py3-none-any.whl.metadata
colorama-0.4.6-py2.py3-none-any.whl.metadata
requests-2.32.3-py3-none-any.whl.metadata
cloudscraper-1.2.71-py2.py3-none-any.whl.metadata
requests_toolbelt-1.0.0-py2.py3-none-any.whl.metadata
a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9a
a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9a.body
6ee910f0-4e80-43fc-9577-a0768df893cb.tmp
f_000002
f_000003
f_000004
f_000005
f_000007
configuration.json
27839f23dd96ec7e_0
ec1ff12c308d6d27_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
temp-index
extensions.builtin.cache
extensions.builtin.cache
extensions.user.cache
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe5a35b7.TMP
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5a1c92.TMP
index
state.vscdb.backup
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
state.vscdb.backup
state.vscdb
languagepacks.json
default.dic
1ced32d74a95c7bc.customDestinations-ms
1ced32d74a95c7bc.customDestinations-ms
1ced32d74a95c7bc.customDestinations-ms
1ced32d74a95c7bc.customDestinations-ms
VSCodeUserSetup-x64-1.99.2.exe:Zone.Identifier
guns.lol-view-bot-main.zip:Zone.Identifier
WHEEL
__init__.py
__main__.py
core.py
__init__.py
__main__.py
api.py
cd.py
__init__.py
__main__.py
constant.py
legacy.py
md.py
models.py
utils.py
version.py
__init__.py
2captcha.py
9kw.py
__init__.py
anticaptcha.py
capmonster.py
capsolver.py
deathbycaptcha.py
cloudflare.py
exceptions.py
help.py
__init__.py
chakracore.py
encapsulated.py
js2py.py
jsunfuck.py
native.py
nodejs.py
v8.py
__init__.py
__init__.py
ansi.py
ansitowin32.py
initialise.py
__init__.py
ansi_test.py
ansitowin32_test.py
initialise_test.py
isatty_test.py
utils.py
winterm_test.py
win32.py
winterm.py
py.typed
__init__.py
actions.py
common.py
core.py
__init__.py
exceptions.py
helpers.py
results.py
testing.py
cvt_pyparsing_pep8_names.py
unicode.py
util.py
__init__.py
adapters.py
certs.py
compat.py
exceptions.py
help.py
models.py
packages.py
utils.py
__init__.py
_compat.py
__init__.py
appengine.py
fingerprint.py
host_header_ssl.py
socket_options.py
source.py
ssl.py
x509.py
_digest_auth_compat.py
guess.py
handler.py
http_proxy_digest.py
forgetful.py
stream.py
tee.py
exceptions.py
__init__.py
decoder.py
encoder.py
sessions.py
streaming_iterator.py
__init__.py
pool.py
thread.py
deprecated.py
dump.py
formdata.py
user_agent.py
__init__.py
_base_connection.py
_collections.py
_request_methods.py
_version.py
connection.py
connectionpool.py
__init__.py
connection.py
fetch.py
request.py
response.py
pyopenssl.py
socks.py
exceptions.py
fields.py
filepost.py
__init__.py
connection.py
probe.py
poolmanager.py
response.py
__init__.py
connection.py
proxy.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
util.py
wait.py
SideBar.png
python-3.13.3-amd64.exe
pip_JustForMe
PythonBA.dll
memory/536-5925-0x00000255AD900000-0x00000255AD901000-memory.dmp
memory/536-5935-0x00000255AD900000-0x00000255AD901000-memory.dmp
memory/536-5932-0x00000255AD900000-0x00000255AD901000-memory.dmp
memory/536-5924-0x00000255AD900000-0x00000255AD901000-memory.dmp
memory/536-5934-0x00000255AD900000-0x00000255AD901000-memory.dmp
memory/536-5938-0x00000255AD900000-0x00000255AD901000-memory.dmp
memory/536-5937-0x00000255AD900000-0x00000255AD901000-memory.dmp
memory/536-5936-0x00000255AD900000-0x00000255AD901000-memory.dmp
memory/536-5933-0x00000255AD900000-0x00000255AD901000-memory.dmp
memory/536-5926-0x00000255AD900000-0x00000255AD901000-memory.dmp
memory/1516-699-0x0000000000340000-0x00000000006A3000-memory.dmp
memory/1516-744-0x0000000000340000-0x00000000006A3000-memory.dmp
memory/1516-5252-0x0000000000340000-0x00000000006A3000-memory.dmp
memory/1516-5358-0x0000000000340000-0x00000000006A3000-memory.dmp
memory/1520-5404-0x00007FFAD5B50000-0x00007FFAD5B51000-memory.dmp
memory/1520-5403-0x00007FFAD4FB0000-0x00007FFAD4FB1000-memory.dmp
memory/1520-5580-0x00000248788D0000-0x0000024878901000-memory.dmp
memory/2244-11603-0x0000021DCB430000-0x0000021DCB461000-memory.dmp
memory/2380-5596-0x00000176488B0000-0x00000176488E1000-memory.dmp
memory/2752-720-0x0000000006490000-0x00000000064DC000-memory.dmp
memory/2752-724-0x0000000007A70000-0x0000000008016000-memory.dmp
memory/2752-709-0x0000000005F30000-0x0000000005F96000-memory.dmp
memory/2752-708-0x0000000005EC0000-0x0000000005F26000-memory.dmp
memory/2752-719-0x0000000006450000-0x000000000646E000-memory.dmp
memory/2752-722-0x0000000006980000-0x000000000699A000-memory.dmp
memory/2752-723-0x00000000069D0000-0x00000000069F2000-memory.dmp
memory/2752-718-0x0000000005FA0000-0x00000000062F7000-memory.dmp
memory/2752-721-0x0000000007420000-0x00000000074B6000-memory.dmp
memory/2752-705-0x0000000002FD0000-0x0000000003006000-memory.dmp
memory/2752-706-0x00000000057E0000-0x0000000005E0A000-memory.dmp
memory/2752-725-0x00000000086A0000-0x0000000008D1A000-memory.dmp
memory/2752-707-0x00000000056D0000-0x00000000056F2000-memory.dmp
memory/3972-5665-0x0000026DE2F80000-0x0000026DE2FB1000-memory.dmp
memory/4064-5609-0x000001C608D70000-0x000001C608DA1000-memory.dmp
memory/5036-5369-0x0000000000790000-0x000000000086C000-memory.dmp
memory/5036-698-0x0000000000790000-0x000000000086C000-memory.dmp
memory/5036-669-0x0000000000790000-0x000000000086C000-memory.dmp
memory/5148-5831-0x000002404C390000-0x000002404C3C1000-memory.dmp
memory/7764-26256-0x00000280BE7E0000-0x00000280BE811000-memory.dmp
memory/8804-26230-0x000002A2EDDD0000-0x000002A2EDDF2000-memory.dmp
memory/8804-26245-0x000002A2EE240000-0x000002A2EE286000-memory.dmp
memory/11868-42414-0x00000240AE800000-0x00000240AE82C000-memory.dmp
memory/11868-42416-0x00000240AED80000-0x00000240AED88000-memory.dmp
memory/11868-42415-0x00000240AED50000-0x00000240AED5A000-memory.dmp
memory/11868-42418-0x00000240CA400000-0x00000240CA4A8000-memory.dmp
memory/11868-42419-0x00000240C8EF0000-0x00000240C8F04000-memory.dmp