Analysis
- user interaction
yes - max time kernel
1799s - max time network
1780s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 13:55
General
- Target idrk.txt
- Size 52B
- Sample260421-q77vtabs21
- SHA256 a9d74961062ac735746fc38659d12fe0c16a07748ce7b61b45d6e556c29ec8ab
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 21 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 10 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- NTFS ADS 3 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\idrk.txt1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\idrk.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf7c8c728,0x7ffcf7c8c734,0x7ffcf7c8c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,11594249557600478228,392936224779896530,262144 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1940 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,2992916460936405650,13177517091425047270,524288 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2292 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,15613062822252439150,7279947157617573356,524288 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2392 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,2510242389725777713,12128642707003540706,2097152 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3204 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,14707687476577959795,3165758819919590843,2097152 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4200,i,12523225302228458578,15327963482505752944,2097152 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4224 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4592,i,5685747278126148521,2248576361666568225,2097152 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4608 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4472,i,17465678725985759872,15142693075328504908,2097152 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4484 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3480,i,17474583107186507276,13983725617119443390,2097152 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3452 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3392,i,10252254681993559685,12357808268829965322,2097152 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3836 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,5331426095083560245,5074475363369382527,524288 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5660 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5960,i,2655578769126885784,7136897805545581489,2097152 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5020,i,5588049546820282405,4484048460811219171,2097152 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5896 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3472,i,14297974684357006437,5372709637764188528,524288 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4996 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=1208,i,15067492118159997308,11626900542457410140,524288 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4476 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4936,i,3051971976855708552,7092638504247086852,524288 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3532 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3480,i,9747033443434564010,9668660079388328794,524288 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6092 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4344,i,2557766804711453518,16707322361589304224,524288 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4236 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\python-3.13.7-amd64.exe"C:\Users\Admin\Downloads\python-3.13.7-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{0135A374-2317-4ED0-9AF6-F63B535BC9B5}\.cr\python-3.13.7-amd64.exe"C:\Windows\Temp\{0135A374-2317-4ED0-9AF6-F63B535BC9B5}\.cr\python-3.13.7-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.13.7-amd64.exe" -burn.filehandle.attached=576 -burn.filehandle.self=7323⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6524,i,5506623402914360843,10832291396094592119,262144 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4332 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,1700511935159519319,11987406640941855933,524288 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5932 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3504,i,3509390723864566040,17594718031731995242,524288 --field-trial-handle=1944,i,12314836001988936638,14513943388584389137,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6888 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2E3DB67CD892C2A5E9312969856B8E5E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe" -I -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2amawock\\pip-25.2-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2amawock', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Package Cache\{9a46f6d0-8f11-4f8f-a23d-d617db01bbb6}\python-3.13.7-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{9a46f6d0-8f11-4f8f-a23d-d617db01bbb6}\python-3.13.7-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Package Cache\{9a46f6d0-8f11-4f8f-a23d-d617db01bbb6}\python-3.13.7-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{9a46f6d0-8f11-4f8f-a23d-d617db01bbb6}\python-3.13.7-amd64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.13.7 (64-bit)_20260421145608.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Package Cache\{9a46f6d0-8f11-4f8f-a23d-d617db01bbb6}\python-3.13.7-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{9a46f6d0-8f11-4f8f-a23d-d617db01bbb6}\python-3.13.7-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{9a46f6d0-8f11-4f8f-a23d-d617db01bbb6}\python-3.13.7-amd64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.13.7 (64-bit)_20260421145608.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\Scripts\pip.exepip install pywin32 pillow2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python313\Scripts\pip.exe" install pywin32 pillow3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\t\vnc\server.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe "C:\Users\Admin\Desktop\t\vnc\server.py"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\t\vnc\client.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe "C:\Users\Admin\Desktop\t\vnc\client.py"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\d\vnc\server.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe "C:\Users\Admin\Downloads\d\vnc\server.py"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\d\vnc\client.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe "C:\Users\Admin\Downloads\d\vnc\client.py"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\d\vnc\client.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe "C:\Users\Admin\Downloads\d\vnc\client.py"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x308,0x7ffce79ec188,0x7ffce79ec194,0x7ffce79ec1a04⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,4924829302762654519,12755949038106937450,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,15809161389431920735,16090522910525175368,262144 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,608715889358317017,17125474743608599011,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,5843895360566616967,10253234723000238902,2097152 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,2968994927402476384,3000359638028492805,2097152 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,10979103507325007037,8336751119148332031,2097152 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,2399799721495865244,3981995439812602531,2097152 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4192,i,6746116250501021227,6024380604816344402,2097152 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4176,i,1941780090113941062,135838393566850556,2097152 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,6819468216836420908,13879902924370961782,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,14667887992604067095,14194173829306487184,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,11173060708352038485,7827397108926043944,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,18086174719095416541,9536538151555321739,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,12763409323506202302,2107812338978150210,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,12763409323506202302,2107812338978150210,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,15989807103801742251,7139082020037215901,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:144⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11445⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,7493543109745463782,8000249004109669650,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:144⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=5925⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,7003229656104858723,1555309542775276409,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,18230178078652340577,2620145341841505474,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,10408309364007194771,2636404207341334909,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,11342189773967442612,17706183300654964062,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,104021010034101543,2532322260525440970,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,16945507927289422991,14166893332515698682,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,16199958313588917782,8022018339133752692,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,2603505412909850395,2972496676551254302,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,3973608634427955925,14356885524809600233,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,627268145176100863,12628005310509215387,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,5311140091174317935,15287496709133444989,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=896,i,8340123257346556774,18034709975426118333,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6484,i,16588429333845216023,10552639510526037056,262144 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3356,i,5313541803491585,5630153983657878899,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3356,i,13260878703652336837,10935406769776547874,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=1608 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,14051169687527331781,4259278636214487995,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,11854726547731662522,17140419042663974557,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,12758082282829276530,13742213277806386347,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,11403704220666366315,17779484879251669472,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,13632466879322853383,4873904430697175397,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,9204789348810543638,17083189395344387409,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,5453279190691785276,13137980539047797911,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,17376311720963942972,9484198388815193561,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,13118884283245150881,15793056069187217609,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,9114003500407809951,267799213920346794,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3360,i,9831413428699846517,2530711063271565735,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,15040633010370910999,10986742920819869341,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,96984813065437810,1307013476610936896,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,5501966016783160930,5325130302308418143,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,6548819751188502151,13430126785005126918,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,5108809956830503914,7429261165601290110,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,14743969433870844130,13115698133056286368,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,15072662413228364213,15699865289783060975,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,3372949559771658481,13760292195149085795,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3052,i,18150462418136999391,12711865873223613677,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,281444258099956036,4703293673197562032,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,5657750800736447812,6803717816616370693,524288 --field-trial-handle=2200,i,4608271389439642260,5623262844849690746,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:144⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\d\vnc\server.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe "C:\Users\Admin\Downloads\d\vnc\server.py"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
3Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e58aca9.rbs
e58acae.rbs
e58acb3.rbs
e58acb8.rbs
e58acbd.rbs
e58acc2.rbs
e58acc7.rbs
e58accc.rbs
e58acd1.rbs
e58acd6.rbs
49855FCDFA62840A2838AEF1EFAC3C9B
77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
86844F70250DD8EF225D6B4178798C21_2CDE88B3CC9A35A2EA16DC0201366139
EF7234CDBB1649702229F955C785C39F
49855FCDFA62840A2838AEF1EFAC3C9B
77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
86844F70250DD8EF225D6B4178798C21_2CDE88B3CC9A35A2EA16DC0201366139
EF7234CDBB1649702229F955C785C39F
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_00000c
f_000012
f_000013
the-real-index
the-real-index
data_1
2ecdc243-d8e6-485b-9cd0-5b23939f618f.tmp
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe58630a.TMP
b46197c3-1eac-48d2-a02d-42be0fa23ca9.tmp
Local State
Local State
Local State
Local State
Local State
546bfae5-bf13-4f69-b30e-bd0b79ab4b9d.tmp
blocklist
protocols.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
crl-set
metadata
234357cc-1bd1-4f25-a994-bb67f6ad9cb4.dmp
2c760706-f9c8-44ea-a34f-cfb89de63709.dmp
settings.dat
settings.dat
settings.dat
LOG.old
LOG.old
the-real-index
the-real-index~RFe5f3263.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5f1ae4.TMP
the-real-index
the-real-index~RFe5f2832.TMP
index.txt
the-real-index
the-real-index~RFe5f240b.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
domain_actions.dll
data.txt
5d34fc39-42e3-4dba-b0e4-00ea7c396614.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
safety_tips.pb
typosquatting_list.pb
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
keys.json
typosquatting_list.pb
well_known_domains.dll
nav_config.json
ranked_dicts
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
b2add5b2-c0ac-42e1-93ac-66a0682e8704.tmp
iconcache_idx.db
iconcache_idx.db
doc_JustForMe
lib_JustForMe
tcltk_JustForMe
path.msi
test.msi
launcher.msi
dev.msi
state.rsm
core.msi
exe.msi
AppCache134212540762842091.txt
AvifImagePlugin.py
BdfFontFile.py
BlpImagePlugin.py
BmpImagePlugin.py
BufrStubImagePlugin.py
ContainerIO.py
CurImagePlugin.py
DcxImagePlugin.py
DdsImagePlugin.py
EpsImagePlugin.py
ExifTags.py
FitsImagePlugin.py
FliImagePlugin.py
FontFile.py
FpxImagePlugin.py
FtexImagePlugin.py
GbrImagePlugin.py
GdImageFile.py
GifImagePlugin.py
GimpGradientFile.py
GimpPaletteFile.py
GribStubImagePlugin.py
Hdf5StubImagePlugin.py
IcnsImagePlugin.py
IcoImagePlugin.py
ImImagePlugin.py
Image.py
ImageChops.py
ImageCms.py
ImageColor.py
ImageDraw.py
ImageDraw2.py
ImageEnhance.py
ImageFile.py
ImageFilter.py
ImageFont.py
ImageGrab.py
ImageMath.py
ImageMode.py
ImageMorph.py
ImageOps.py
ImagePalette.py
ImagePath.py
ImageQt.py
ImageSequence.py
ImageShow.py
ImageStat.py
ImageText.py
ImageTk.py
ImageTransform.py
ImageWin.py
ImtImagePlugin.py
IptcImagePlugin.py
Jpeg2KImagePlugin.py
JpegImagePlugin.py
JpegPresets.py
McIdasImagePlugin.py
MicImagePlugin.py
MpegImagePlugin.py
MpoImagePlugin.py
MspImagePlugin.py
PSDraw.py
PaletteFile.py
PalmImagePlugin.py
PcdImagePlugin.py
PcfFontFile.py
PcxImagePlugin.py
PdfImagePlugin.py
PdfParser.py
PixarImagePlugin.py
PngImagePlugin.py
PpmImagePlugin.py
PsdImagePlugin.py
QoiImagePlugin.py
SgiImagePlugin.py
SpiderImagePlugin.py
SunImagePlugin.py
TarIO.py
TgaImagePlugin.py
TiffImagePlugin.py
TiffTags.py
WalImageFile.py
WebPImagePlugin.py
WmfImagePlugin.py
XVThumbImagePlugin.py
XbmImagePlugin.py
XpmImagePlugin.py
__init__.py
__main__.py
_binary.py
_deprecate.py
_tkinter_finder.py
_typing.py
_util.py
_version.py
_webp.pyi
features.py
report.py
__init__.py
ado_consts.py
adodbapi.py
apibase.py
db_print.py
db_table_names.py
xls_read.py
xls_write.py
is64bit.py
process_connect_string.py
schema_table.py
setup.py
adodbapitest.py
adodbapitestconfig.py
dbapi20.py
is64bit.py
setuptestframework.py
test_adodbapi_dbapi20.py
tryconnection.py
__init__.py
install.py
isapicon.py
advanced.py
redirector.py
redirector_asynch.py
redirector_with_filter.py
test.py
simple.py
extension_simple.py
threaded_extension.py
INSTALLER
__init__.py
__main__.py
__pip-runner__.py
__init__.py
build_env.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
index_command.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
lock.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
pylock.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
metadata_legacy.py
wheel.py
wheel_editable.py
wheel_legacy.py
check.py
freeze.py
__init__.py
editable_legacy.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
req_dependency_group.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
packaging.py
retry.py
setuptools_build.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
cacert.pem
core.py
__init__.py
__main__.py
_implementation.py
_lint_dependency_groups.py
_pip_wrapper.py
_toml_compat.py
__init__.py
compat.py
resources.py
scripts.py
util.py
__init__.py
__main__.py
distro.py
__init__.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
__init__.py
_spdx.py
markers.py
metadata.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
_mapping.py
token.py
unistring.py
util.py
__init__.py
_impl.py
__init__.py
_in_process.py
__init__.py
__version__.py
_internal_utils.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
providers.py
reporters.py
__init__.py
abstract.py
criterion.py
exceptions.py
resolution.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
__init__.py
_parser.py
_re.py
_types.py
__init__.py
_writer.py
__init__.py
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
__init__.py
_collections.py
_version.py
connection.py
connectionpool.py
_appengine_environ.py
bindings.py
low_level.py
appengine.py
ntlmpool.py
pyopenssl.py
securetransport.py
socks.py
exceptions.py
fields.py
filepost.py
makefile.py
weakref_finalize.py
six.py
poolmanager.py
request.py
response.py
__init__.py
connection.py
proxy.py
queue.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
wait.py
pythoncom.py
basictimerapp.py
customprint.py
demoutils.py
dlgappdemo.py
dojobapp.py
helloapp.py
cmdserver.py
createwin.py
demoutils.py
dibdemo.py
dlgtest.py
dyndlg.py
fontdemo.py
guidemo.py
hiertest.py
menutest.py
objdoc.py
flash.py
msoffice.py
ocxserialtest.py
ocxtest.py
webbrowser.py
openGLDemo.py
progressbar.py
sliderdemo.py
splittst.py
threadedgui.py
toolbar.py
__init__.py
__init__.py
configui.py
dbgcon.py
dbgpyapp.py
debugger.py
fail.py
ideoptions.py
list.py
login.py
status.py
DockingBar.py
app.py
bitmap.py
cmdline.py
dbgcommands.py
dlgappcore.py
ModuleBrowser.py
__init__.py
coloreditor.py
configui.py
document.py
editor.py
frame.py
template.py
vss.py
help.py
interact.py
intpyapp.py
intpydde.py
scriptutils.py
sgrepmdi.py
startup.py
stdin.py
toolmenu.py
window.py
winout.py
AutoExpand.py
AutoIndent.py
CallTips.py
FormatParagraph.py
IdleHistory.py
PyParse.py
__init__.py
activex.py
afxres.py
dialog.py
docview.py
object.py
thread.py
window.py
IDLEenvironment.py
__init__.py
bindings.py
config.py
configui.py
control.py
document.py
find.py
formatter.py
keycodes.py
scintillacon.py
view.py
TraceCollector.py
browseProjects.py
browser.py
hierlist.py
regedit.py
regpy.py
BackupRead_BackupWrite.py
BackupSeek_streamheaders.py
CopyFileEx.py
CreateFileTransacted_MiniVersion.py
EvtFormatMessage.py
EvtSubscribe_pull.py
EvtSubscribe_push.py
FileSecurityTest.py
GetSaveFileName.py
NetValidatePasswordPolicy.py
OpenEncryptedFileRaw.py
RegCreateKeyTransacted.py
RegRestoreKey.py
SystemParametersInfo.py
setup.py
ddeclient.py
ddeserver.py
desktopmanager.py
eventLogDemo.py
getfilever.py
mmapfile_demo.py
cat.py
runproc.py
print_desktop.py
rastest.py
GetTokenInformation.py
account_rights.py
explicit_entries.py
get_policy_info.py
list_rights.py
localized_names.py
lsaregevent.py
lsastore.py
query_information.py
regsave_sa.py
regsecurity.py
sa_inherit.py
security_enums.py
set_file_audit.py
set_file_owner.py
set_policy_info.py
setkernelobjectsecurity.py
setnamedsecurityinfo.py
setsecurityinfo.py
setuserobjectsecurity.py
fetch_url.py
simple_auth.py
socket_server.py
validate_password.py
nativePipeTestService.py
pipeTestService.py
pipeTestServiceClient.py
serviceEvents.py
timer_demo.py
win32clipboardDemo.py
win32clipboard_bitmapdemo.py
win32comport_demo.py
win32console_demo.py
win32cred_demo.py
win32fileDemo.py
win32gui_demo.py
win32gui_devicenotify.py
win32gui_dialog.py
win32gui_menu.py
win32gui_taskbar.py
win32netdemo.py
win32rcparser_demo.py
win32servicedemo.py
win32ts_logoff_disconnected.py
testwnet.py
winnetwk.py
winprocess.py
_win32verstamp_pywin32ctypes.py
afxres.py
commctrl.py
mmsystem.py
netbios.py
ntsecuritycon.py
pywin32_bootstrap.py
pywin32_testutil.py
pywintypes.py
rasutil.py
regcheck.py
regutil.py
sspi.py
sspicon.py
win2kras.py
win32con.py
win32cryptcon.py
win32evtlogutil.py
win32gui_struct.py
win32inetcon.py
win32netcon.py
win32pdhquery.py
win32pdhutil.py
win32rcparser.py
win32serviceutil.py
win32timezone.py
win32traceutil.py
win32verstamp.py
winerror.py
winioctlcon.py
winnt.py
winperf.py
winxptheme.py
ControlService.py
BrandProject.py
bulkstamp.py
vssutil.py
backupEventLog.py
h2py.py
killProcName.py
rasutil.py
regsetup.py
setup_d.py
handles.py
test_clipboard.py
test_exceptions.py
test_odbc.py
test_pywintypes.py
test_security.py
test_sspi.py
test_win32api.py
test_win32clipboard.py
test_win32cred.py
test_win32crypt.py
test_win32event.py
test_win32file.py
test_win32gui.py
test_win32guistruct.py
test_win32inet.py
test_win32net.py
test_win32pipe.py
test_win32print.py
test_win32profile.py
test_win32rcparser.py
test_win32timezone.py
test_win32trace.py
test_win32ts.py
test_win32wnet.py
testall.py
winxpgui.py
__init__.py
CLSIDToClass.py
__init__.py
build.py
combrowse.py
connect.py
dynamic.py
gencache.py
genpy.py
makepy.py
selecttlb.py
tlbrowse.py
util.py
connect.py
dump_clipboard.py
eventsApartmentThreaded.py
eventsFreeThreaded.py
excelAddin.py
excelRTDServer.py
iebutton.py
ietoolbar.py
outlookAddin.py
trybag.py
__init__.py
makegw.py
makegwenum.py
makegwparse.py
olectl.py
__init__.py
connect.py
dispatcher.py
exception.py
factory.py
localserver.py
policy.py
register.py
util.py
PythonTools.py
dictionary.py
interp.py
perfmon.py
test_pycomtest.py
storagecon.py
GenTestScripts.py
__init__.py
daodump.py
errorSemantics.py
pippo_server.py
policySemantics.py
testADOEvents.py
testAXScript.py
testAccess.py
testArrays.py
testClipboard.py
testCollections.py
testConversionErrors.py
testDCOM.py
testDates.py
testDictionary.py
testDynamic.py
testExchange.py
testExplorer.py
testGIT.py
testGatewayAddresses.py
testIterators.py
testMSOffice.py
testMSOfficeEvents.py
testMarshal.py
testPersist.py
testPippo.py
testPyComTest.py
testROT.py
testServers.py
testShell.py
testStorage.py
testStreams.py
testWMI.py
testall.py
testmakepy.py
testvb.py
testvbscript_regexp.py
testxslt.py
util.py
universal.py
util.py
__init__.py
adsicon.py
objectPicker.py
scp.py
search.py
test.py
__init__.py
EditSecurity.py
EditServiceSecurity.py
adb.py
codecontainer.py
contexts.py
debugger.py
documents.py
dump.py
expressions.py
gateways.py
stackframe.py
util.py
asputil.py
__init__.py
debug.py
error.py
framework.py
pydumper.py
pyscript.py
pyscript_rexec.py
scriptdispatch.py
axsite.py
leakTest.py
testHost.py
testHost4Dbg.py
show_all_jobs.py
test_bits.py
__init__.py
ds_record.py
ds_test.py
__init__.py
filterDemo.py
ifiltercon.py
__init__.py
inetcon.py
__init__.py
mapisend.py
emsabtags.py
mapitags.py
mapiutil.py
__init__.py
pscon.py
testpropsys.py
IActiveDesktop.py
IFileOperationProgressSink.py
IShellLinkDataList.py
ITransferAdviseSink.py
IUniformResourceLocator.py
browse_for_folder.py
create_link.py
dump_link.py
explorer_browser.py
column_provider.py
context_menu.py
copy_hook.py
empty_volume_cache.py
folder_view.py
icon_handler.py
shell_view.py
shellexecuteex.py
viewstate.py
walk_shell_folders.py
shellcon.py
testSHFileOperation.py
testShellFolder.py
testShellItem.py
test_addtask.py
test_addtask_1.py
test_addtask_2.py
test_localsystem.py
__init__.py
__main__.py
pip3.13.exe
pywin32_postinstall.py
pywin32_testall.py
python.exe
8a25668c-203f-4401-aaad-238da5625390.tmp
Python 3.13.7 (64-bit)_20260421145608_000_core_JustForMe.log
Python 3.13.7 (64-bit)_20260421145608_001_exe_JustForMe.log
Python 3.13.7 (64-bit)_20260421145608_002_dev_JustForMe.log
Python 3.13.7 (64-bit)_20260421145608_003_lib_JustForMe.log
Python 3.13.7 (64-bit)_20260421145608_004_test_JustForMe.log
Python 3.13.7 (64-bit)_20260421145608_005_doc_JustForMe.log
c388a4af-b521-4818-bd48-b8b32dc5d8da.tmp
pillow-12.2.0-cp313-cp313-win_amd64.whl.metadata
pywin32-311-cp313-cp313-win_amd64.whl.metadata
pillow-12.2.0-cp313-cp313-win_amd64.whl
pywin32-311-cp313-cp313-win_amd64.whl
content_new.js
2a536309-6f02-4018-9760-63ae2704d19f.tmp
ConvertFromUnprotect.tmp
DenyClose.docx
DisconnectRename.ocx
EnableSelect.wvx
ExportAssert.dll
FormatLock.pps
InstallResolve.otf
LimitDisable.mp2v
NewOpen.eps
OpenProtect.jpe
python-3.13.7-amd64.exe
t.zip:Zone.Identifier
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
edge_checkout_page_validator.js
manifest.json
manifest.json
manifest.json
manifest.json
Staging
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
python-3.13.7-amd64.exe
PythonBA.dll
SideBar.png
pip_JustForMe
memory/1532-1359-0x0000000001850000-0x0000000001E52000-memory.dmp
memory/1572-8860-0x00000000029C0000-0x0000000002FC2000-memory.dmp
memory/2332-8877-0x0000000000EC0000-0x00000000014C2000-memory.dmp
memory/2332-1215-0x0000000000EC0000-0x00000000014C2000-memory.dmp
memory/2416-361-0x0000000000C00000-0x0000000001202000-memory.dmp
memory/2460-1360-0x0000000001560000-0x0000000001B62000-memory.dmp
memory/2936-1361-0x000001CE720F0000-0x000001CE720FC000-memory.dmp
memory/2936-14495-0x000001CE720F0000-0x000001CE720FC000-memory.dmp
memory/3524-14211-0x0000022FB82F0000-0x0000022FB82FC000-memory.dmp
memory/4312-15571-0x00007FFCF7FF0000-0x00007FFCF8019000-memory.dmp
memory/4312-14500-0x00007FFCF7FF0000-0x00007FFCF8019000-memory.dmp
memory/4328-16000-0x0000022FA5000000-0x0000022FA5100000-memory.dmp
memory/4328-16045-0x00000230D8B20000-0x00000230D8B40000-memory.dmp
memory/4328-15995-0x0000022FA5140000-0x0000022FA5240000-memory.dmp
memory/4328-16053-0x0000022FD86B0000-0x0000022FD86D0000-memory.dmp
memory/4328-16080-0x00000230DA030000-0x00000230DA130000-memory.dmp
memory/4328-16081-0x00000230D9510000-0x00000230D9530000-memory.dmp
memory/4460-1208-0x0000000000FB0000-0x00000000015B2000-memory.dmp
memory/4460-8878-0x0000000000FB0000-0x00000000015B2000-memory.dmp
memory/5812-14247-0x00007FFD008B0000-0x00007FFD008D9000-memory.dmp
memory/5812-14225-0x00007FFD008B0000-0x00007FFD008D9000-memory.dmp
memory/5988-14499-0x00007FFD01270000-0x00007FFD01299000-memory.dmp
memory/5988-14493-0x00007FFD01270000-0x00007FFD01299000-memory.dmp