Analysis
- user interaction
yes - max time kernel
422s - max time network
420s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/07/2026, 15:58
General
- Target effectchanger-installer.exe
- Size 37.8MB
- Sample260702-tevxbshs7z
- SHA256 f0d1b3b723881a46bff46f08c11c2de1ec9f5a795583808de7e0a8d6c3f2b5a7
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 17 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 36 IoCs
- Drops file in Windows directory 60 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 52 IoCs
- Suspicious use of SendNotifyMessage 12 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\effectchanger-installer.exe"C:\Users\Admin\AppData\Local\Temp\effectchanger-installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-D5BTM6BN1T.tmp\effectchanger-installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-D5BTM6BN1T.tmp\effectchanger-installer.tmp" /SL5="$10004E,38403931,905728,C:\Users\Admin\AppData\Local\Temp\effectchanger-installer.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Effect Changer\synchost.exe"C:\Program Files\Effect Changer\synchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Effect Changer\synchost.exe"C:\Program Files\Effect Changer\synchost.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
C:\Users\Admin\AppData\Local\ProTankiOnline\synchost.exe"C:\Users\Admin\AppData\Local\ProTankiOnline\synchost.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ProTankiOnline\synchost.exe"C:\Users\Admin\AppData\Local\ProTankiOnline\synchost.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Program Files\Effect Changer\Effect Changer.exe"C:\Program Files\Effect Changer\Effect Changer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Effect Changer\Effect Changer.exe"C:\Program Files\Effect Changer\Effect Changer.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/8qFH8hH65⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2e8,0x7ff9470cc188,0x7ff9470cc194,0x7ff9470cc1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,15591709599465207055,3477012136138392204,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:36⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,15999829027015352954,8868136880974400038,262144 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,10417850987186745162,4429595940312796392,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,18066236329653624918,18320091886893799676,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,9460896696403519745,7106752924065394789,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4052,i,3870389361682571544,9081369154128796132,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4064,i,15011108618429443945,6257851552862067623,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,12496834948935740845,15075766816387081844,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,10976998084304858224,10282407508339910546,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5352,i,7688802356759210346,1464838427530132181,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,5751459604365596822,13119701350582336644,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,3179408594002951347,9783296012648188839,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,2064562522837111585,8053847017611963813,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,7432388628761710784,12410942308032990590,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,12149932130663043042,15104726724912461608,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,12149932130663043042,15104726724912461608,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,9010014877229805760,4639301894531857953,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,17602801482725276624,16196111305447477936,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,1245804311769610599,4495573842085802760,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,3880616984408571286,11131737890358920463,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,15808022385136465013,7713113634589640990,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6844,i,13289625297302506419,6751022732187962958,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7112,i,7133405553318432459,14272762097289629716,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5256,i,9420197919813309761,9399102827064966343,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,4662710971988688933,4385405942567007219,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4760,i,11318382862920300499,9323865842643122706,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4428,i,6257674324199561463,17027389551464538368,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6592,i,6767126672837869796,6550629433555942159,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7496,i,9855042940188256614,2591496333477015588,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,11491100305542180382,8729909391056758726,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7492,i,4316366207513324085,15949278769174784446,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7268,i,18053024861413983999,18180546529656073809,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7404,i,15249874229565012963,10411358055396498418,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5600,i,6835173972224967839,10118776822392373116,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7328,i,10056775190874874995,4074232030720436165,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7744,i,9552055426611487571,13374637286226263162,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5520,i,5486023004211920441,11017770720190074405,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7300,i,6248238516056752425,10791272282063721347,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7480,i,6207260711181121724,9158332690483064389,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6392,i,1911584256915710617,10299195756192547694,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7584,i,5924505496511507097,660692214523109067,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,10923519602657201231,13215608405997882235,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7300,i,16831036796621879533,8806347726082044447,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7680,i,2157341048852388914,9854595861101709254,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=8400 /prefetch:86⤵
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\python-manager-26.3.msi"6⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7636,i,12211198311031656168,12140609689336692440,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=8204 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7576,i,11854467236916642722,12671534277497566860,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7500,i,6762845620332598580,6797080314102668179,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:86⤵
-
-
C:\Users\Admin\Downloads\python-3.14.6-amd64.exe"C:\Users\Admin\Downloads\python-3.14.6-amd64.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{FC695AAB-302E-4F9A-BC92-EEF033CCDCFF}\.cr\python-3.14.6-amd64.exe"C:\Windows\Temp\{FC695AAB-302E-4F9A-BC92-EEF033CCDCFF}\.cr\python-3.14.6-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.14.6-amd64.exe" -burn.filehandle.attached=736 -burn.filehandle.self=7407⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Windows\Temp\{6037BFE7-DD57-4AB9-A622-28511F31A8AF}\.be\python-3.14.6-amd64.exe"C:\Windows\Temp\{6037BFE7-DD57-4AB9-A622-28511F31A8AF}\.be\python-3.14.6-amd64.exe" -q -burn.elevated BurnPipe.{DBA290FF-1112-4887-A043-787A56112013} {EEB30FAD-5A6F-440E-9959-18CF247DF588} 60368⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\pythonw.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python314\pythonw.exe" -c "import winreg; winreg.SetValueEx(winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\FileSystem'), 'LongPathsEnabled', None, winreg.REG_DWORD, 1)"8⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8612,i,7159406789353739121,12508520033148230499,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=8588 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=4048,i,1298911128286618324,4467987077936662906,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=8728 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=7172,i,9290597490444267773,6936357974678407010,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=7836,i,2200902097706106435,15602818068388087491,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=8684 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8924,i,14162148102252826909,9438716548617940419,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=8784 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=6872,i,460105540389173460,11738517247815649513,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=8344 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9076,i,11265513323624108139,6040782039969302223,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=9148 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=9204,i,4977522433634601165,9433853694980388187,262144 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=9116 /prefetch:86⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,1933570654221088738,14963707433747021617,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7608,i,733205123279057047,17923981424895102322,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=9204 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9152,i,8731648232814356103,11862328908540312025,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,16561448341380230606,12216913289361151680,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,6670780039212366249,5303055547346244095,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=8272 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=3704,i,3303754687725735143,1763332943819874770,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=3748,i,16359915026495431378,8196718919242762086,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=7088,i,12165562537135781213,10508002583651115457,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=9048 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=7480,i,18043834287298152589,12605417905371310352,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=9160 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8340,i,6512353229799543471,12469797038250722838,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=8496 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9220,i,14984181132347346450,12085536972433305870,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=9260 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=5468,i,10859925521609116500,10914748972737134344,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=9332 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9444,i,16177217110447893299,7178685697609795082,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9224,i,12539235150627969759,1733635370695111644,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:86⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4048,i,4227144015482149891,6163909442763973508,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=8792 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9088,i,16469892304116010436,9094731900883414228,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=8688 /prefetch:86⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=8688,i,4889322256290998017,9965504006562600956,2097152 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=9196 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,1656733039264136522,7109693956524329544,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=8432 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9272,i,4249689855727313863,8165945528952613457,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8372,i,2203838004437206395,296959897396772301,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8460,i,7446899281973084987,16504464179116505817,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,3059210869711493519,2379539435049868645,524288 --field-trial-handle=3052,i,17732827304573746609,12419389052402009907,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:86⤵
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 281693BAA97292A7D54D89B19D8E2BF3 C2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AE402D35157E3F3635F2DBE2DFA64F792⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe" -I -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5xbvyfzp\\pip-26.1.2-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5xbvyfzp', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Package Cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.14.6 (64-bit)_20260702170052.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.14.6 (64-bit)_20260702170052.log"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exepython pyinstxtractor.py synchost.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e59c415.rbs
e59c41a.rbs
e59c41f.rbs
e59c424.rbs
e59c429.rbs
e59c42e.rbs
e59c433.rbs
e59c438.rbs
e59c43d.rbs
e59c442.rbs
Effect Changer.exe
synchost.exe
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
protocols.json
crl-set
settings.dat
LOG.old
BookmarkMergedSurfaceOrdering
f_000082
f_000083
f_000084
f_000085
f_000086
f_000087
f_000089
f_00008a
f_0000b7
f_0000c5
f_0000d7
f_0000d8
f_0000e2
f_0000e8
f_0000e9
f_0000f8
0eb1763f04b21312_0
0fdcae0b58cc64d1_0
1d0aa42226a1112a_0
256c6f57ec621f9b_0
4036892574e9e41e_0
61a0b4d20ae0e222_0
67fa50d7bedc5c56_0
688a4b4b23c2152a_0
a067705c689d7daf_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
HubApps
MANIFEST-000001
00e2bc22-7238-4c67-ab04-88448eba5d9d.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe58fa49.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index
the-real-index
the-real-index~RFe5aa077.TMP
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58c83d.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe588e22.TMP
the-real-index
the-real-index~RFe591af1.TMP
sync_diagnostic.log
the-real-index
the-real-index~RFe5a9ee1.TMP
index.txt
index.txt
index.txt
index.txt
CURRENT
OperationConfig
OperationConfig~RFe597035.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe58efd9.TMP
keys.json
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
eab81544-7df0-439f-95a1-664f189427d6.tmp
f6e24152-d45b-482e-85e2-ef100e31b993.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
thumbcache_idx.db
doc_JustForMe
lib_JustForMe
tcltk_JustForMe
LICENSE.APACHE
LICENSE
__init__.py
__main__.py
__pip-runner__.py
__init__.py
build_env.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
index_command.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
lock.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
release_control.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
wheel.py
wheel_editable.py
check.py
freeze.py
__init__.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
pep723.py
req_dependency_group.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
packaging.py
pylock.py
retry.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
core.py
__init__.py
compat.py
resources.py
scripts.py
util.py
__init__.py
__main__.py
distro.py
__init__.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
dependency_groups.py
direct_url.py
errors.py
__init__.py
_spdx.py
markers.py
metadata.py
pylock.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
_mapping.py
token.py
unistring.py
util.py
__init__.py
_impl.py
__init__.py
_in_process.py
__init__.py
__version__.py
_internal_utils.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
providers.py
reporters.py
__init__.py
abstract.py
criterion.py
exceptions.py
resolution.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
__init__.py
_parser.py
_re.py
_types.py
__init__.py
_writer.py
__init__.py
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
__init__.py
_base_connection.py
_collections.py
_request_methods.py
_version.py
connection.py
connectionpool.py
__init__.py
connection.py
fetch.py
request.py
response.py
pyopenssl.py
socks.py
exceptions.py
fields.py
filepost.py
__init__.py
connection.py
probe.py
poolmanager.py
response.py
__init__.py
connection.py
proxy.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
util.py
wait.py
__init__.py
__main__.py
pip3.14.exe
python.exe
1b196774-3b13-457b-8dbf-d688366af6bc.tmp
39222ffe-2018-4808-ba9f-f944cfda9420.tmp
81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
_imaging.cp314-win_amd64.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
cd.cp314-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_psutil_windows.pyd
pyexpat.pyd
python3.dll
python314.dll
select.pyd
Lorem ipsum.txt
unicodedata.pyd
effectchanger-installer.tmp
content_new.js
ef09ff6c-7375-4b14-818c-595cfd452e4d.tmp
ccba5a5986c77e43.customDestinations-ms
pyinstxtractor-master.zip.crdownload
python-3.14.6-amd64.exe
python-manager-26.3.msi.crdownload
PythonBA.dll
SideBar.png
python-3.14.6-amd64.exe
pip_JustForMe
memory/3608-111-0x00000000008C0000-0x00000000009AC000-memory.dmp
memory/3608-925-0x00000000008C0000-0x00000000009AC000-memory.dmp
memory/3608-1-0x00000000008C0000-0x00000000009AC000-memory.dmp
memory/3884-1360-0x00007FF9479F0000-0x00007FF947A19000-memory.dmp
memory/4628-328-0x00000000002E0000-0x0000000000726000-memory.dmp
memory/4628-235-0x00000000002E0000-0x0000000000726000-memory.dmp
memory/4628-5-0x00000000013F0000-0x00000000013F1000-memory.dmp
memory/4700-14507-0x00007FF612AD0000-0x00007FF612B2D000-memory.dmp
memory/5124-14508-0x00007FF612AD0000-0x00007FF612B2D000-memory.dmp