Analysis
- user interaction
yes - max time kernel
899s - max time network
902s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
12/07/2026, 12:11
General
- Target https://gofile.io/d/dzbQg8
- Sample260712-pcwcvsbv4t
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 41 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 8 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/dzbQg81⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffcccbec188,0x7ffcccbec194,0x7ffcccbec1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,11752277191618755246,4223486828640189200,262144 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,5462478088098050389,7954970277409073045,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,8199149653881579601,1691485133582092299,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,12292659442182388857,6613383601567919532,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3664,i,8601656027780502144,16994903196806445606,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,9887220734991884175,17774391867887591168,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,15721590761222067221,14288387895428575770,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5336,i,15524522736325660703,16469689161404750218,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,7737372681155834402,14945576654945555135,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,7658341922735841339,10140361977859308717,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,10504470957044558975,11328915813560192084,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,10504470957044558975,11328915813560192084,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6532,i,14191876408739530130,6772438618298320634,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,10126539870436956084,13228342787283587348,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,11094602474899086160,7259453044235990912,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6844,i,453871343778082826,4142675324497642061,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7180,i,8508103604748330877,5438975624123968180,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7160,i,15061095493645450101,2989917159749061439,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,4031836837103246566,17482382002477021479,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:142⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\install.bat" "2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,1848100195920197788,8417977648630901312,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,13831663352979024187,13022579147865267214,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,242684851023731635,13789963159366888867,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7040,i,15834680922583245100,6929243047129650390,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7340,i,273843530292071800,16019753113101278928,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5592,i,13264159369175782567,17552538885874857218,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5604,i,5316685658909795465,2245484694132916060,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3924,i,6814798341496957760,69324401365586172,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7256,i,212662225871701534,16376932140326056245,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,14350417421263321264,15508106136556620149,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7572,i,1313795004467566445,17965188876180566499,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7700,i,13184974517047354771,9650478347175280405,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7728,i,15814908125443376746,6706072589122935085,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8096,i,9760398573823758873,867074726236448131,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=8100 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\python-3.11.0-amd64.exe"C:\Users\Admin\Downloads\python-3.11.0-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{AB85759D-43FA-4C74-A79F-86CC701008E2}\.cr\python-3.11.0-amd64.exe"C:\Windows\Temp\{AB85759D-43FA-4C74-A79F-86CC701008E2}\.cr\python-3.11.0-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.11.0-amd64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=7323⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Temp\{4C9CE04E-B2B4-45FA-BBC3-7E7E7DB07225}\.be\python-3.11.0-amd64.exe"C:\Windows\Temp\{4C9CE04E-B2B4-45FA-BBC3-7E7E7DB07225}\.be\python-3.11.0-amd64.exe" -q -burn.elevated BurnPipe.{900E4ABB-0C78-45AE-A9FE-527FCC64A9AB} {A9397B0B-D67D-4437-B5DB-21BEC706E405} 24884⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\pythonw.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\pythonw.exe" -c "import winreg; winreg.SetValueEx(winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\FileSystem'), 'LongPathsEnabled', None, winreg.REG_DWORD, 1)"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7872,i,990290079164655204,1531975861138876988,262144 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,15060186881129119859,2194914230992183901,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7788,i,1757695160595188270,1127753629570052071,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8188,i,10582054093009526288,1292781182191945399,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=8184 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8272,i,2427843050945398377,13890367181698644831,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=8280 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3316,i,11157005602764481741,13915367422946894787,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8300,i,13374699519953011687,4817687515915593577,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7024,i,5784128336034367418,6854069065879021827,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,14757879863343834186,16711864554911772061,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,16017619828796807628,10918169799692960840,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,16017619828796807628,10918169799692960840,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6128,i,925881445548420144,13012632163572518368,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=8352 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7328,i,4338558684565303677,12202966222727535962,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8444,i,8042121280917702604,6168826078030146971,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8432,i,13249045100316925431,17981140314744245673,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=5380,i,8867338247069142595,11713958290171076906,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=8412 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7972,i,17359614528845711911,29280882883580682,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7324,i,13326798876017437942,4050853000075068792,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8512,i,13031358857201574308,2192567003492021919,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=8528 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8732,i,12790834325920054619,10841188612704659937,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,12654364095940514830,8541540074385975968,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8368,i,12329158696308277575,2447229071689344873,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:122⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8744,i,3343853718638582608,7198605238055037958,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=8664 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=6504,i,7497467772634672068,8032501085996867285,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=5540,i,5654132120828942635,2192882935630859956,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8868,i,11659401297206515099,7482732262426360433,2097152 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,18049380821181555357,10387767466829116053,524288 --field-trial-handle=2556,i,12068180158409501353,4760853392268624145,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-XV39BQX6D6.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-XV39BQX6D6.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe" -personalizedToken XV39BQX6D6 --deeplink https://www.roblox.com/games/17625359962/RIVALS -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 67523⤵
- Executes dropped EXE
-
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe" -personalizedToken XV39BQX6D6 --deeplink https://www.roblox.com/games/17625359962/RIVALS -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 67523⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E82F718BAB741BA113E25804A98395582⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" -E -s -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpzl8xbgbk\\setuptools-65.5.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpzl8xbgbk\\pip-22.3-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpzl8xbgbk', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.11.0 (64-bit)_20260712131332.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.11.0 (64-bit)_20260712131332.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe" -q -burn.elevated BurnPipe.{586B8E48-7EF8-4C82-82B7-77C1BA443484} {D3999DA4-8380-4F0F-A57F-70366D9F040B} 84⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\pythonw.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\pythonw.exe" -c "import winreg; winreg.SetValueEx(winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\FileSystem'), 'LongPathsEnabled', None, winreg.REG_DWORD, 1)"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\LegitBall\LegitBall\install.bat" "1⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exepip install pymem requests pywin32 numpy dearpygui pyinstaller2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" install pymem requests pywin32 numpy dearpygui pyinstaller3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Expand-Archive -Path 'D:\pyMeow-1.73.42 (1).zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\pymeow_extract' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\LegitBall\LegitBall\install.bat"1⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exepip install pymem requests pywin32 numpy dearpygui pyinstaller2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" install pymem requests pywin32 numpy dearpygui pyinstaller3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Expand-Archive -Path 'D:\pyMeow-1.73.42 (1).zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\pymeow_extract' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\LegitBall\LegitBall\install.bat"1⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exepip install pymem requests pywin32 numpy dearpygui2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" install pymem requests pywin32 numpy dearpygui3⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Expand-Archive -Path 'C:\Users\Admin\Downloads\LegitBall\LegitBall\pyMeow-1.73.42.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\pymeow_extract' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exepip install .2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" install .3⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\LegitBall\LegitBall\awra.bat" "1⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exepip install pymem requests pywin32 numpy dearpygui2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" install pymem requests pywin32 numpy dearpygui3⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Expand-Archive -Path 'C:\Users\Admin\Downloads\LegitBall\LegitBall\pyMeow-1.73.42.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\pymeow_extract' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exepip install .2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" install .3⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -c " exec(compile(''' # This is <pip-setuptools-caller> -- a caller that pip uses to run setup.py # # - It imports setuptools before invoking setup.py, to enable projects that directly # import from `distutils.core` to work with newer packaging standards. # - It provides a clear error message when setuptools is not installed. # - It sets `sys.argv[0]` to the underlying `setup.py`, when invoking `setup.py` so # setuptools doesn't think the script is `-c`. This avoids the following warning: # manifest_maker: standard file '-c' not found\". # - It generates a shim setup.py, for handling setup.cfg-only projects. import os, sys, tokenize try: import setuptools except ImportError as error: print( \"ERROR: Can not execute `setup.py` since setuptools is not available in \" \"the build environment.\", file=sys.stderr, ) sys.exit(1) __file__ = %r sys.argv[0] = __file__ if os.path.exists(__file__): filename = __file__ with tokenize.open(__file__) as f: setup_py_code = f.read() else: filename = \"<auto-generated setuptools caller>\" setup_py_code = \"from setuptools import setup; setup()\" exec(compile(setup_py_code, filename, \"exec\")) ''' % ('C:\\Users\\Admin\\AppData\\Local\\Temp\\pymeow_extract\\setup.py',), \"<pip-setuptools-caller>\", \"exec\"))" egg_info --egg-base C:\Users\Admin\AppData\Local\Temp\pip-pip-egg-info-92lbvu5t4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -u -c " exec(compile(''' # This is <pip-setuptools-caller> -- a caller that pip uses to run setup.py # # - It imports setuptools before invoking setup.py, to enable projects that directly # import from `distutils.core` to work with newer packaging standards. # - It provides a clear error message when setuptools is not installed. # - It sets `sys.argv[0]` to the underlying `setup.py`, when invoking `setup.py` so # setuptools doesn't think the script is `-c`. This avoids the following warning: # manifest_maker: standard file '-c' not found\". # - It generates a shim setup.py, for handling setup.cfg-only projects. import os, sys, tokenize try: import setuptools except ImportError as error: print( \"ERROR: Can not execute `setup.py` since setuptools is not available in \" \"the build environment.\", file=sys.stderr, ) sys.exit(1) __file__ = %r sys.argv[0] = __file__ if os.path.exists(__file__): filename = __file__ with tokenize.open(__file__) as f: setup_py_code = f.read() else: filename = \"<auto-generated setuptools caller>\" setup_py_code = \"from setuptools import setup; setup()\" exec(compile(setup_py_code, filename, \"exec\")) ''' % ('C:\\Users\\Admin\\AppData\\Local\\Temp\\pymeow_extract\\setup.py',), \"<pip-setuptools-caller>\", \"exec\"))" install --record C:\Users\Admin\AppData\Local\Temp\pip-record-t51_els4\install-record.txt --single-version-externally-managed --compile --install-headers C:\Users\Admin\AppData\Local\Programs\Python\Python311\Include\pyMeow4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
-
C:\Windows\system32\utilman.exeutilman.exe /debug1⤵
-
C:\Windows\system32\utilman.exeutilman.exe /debug1⤵
-
C:\Windows\system32\utilman.exeutilman.exe /debug1⤵
-
C:\Windows\system32\utilman.exeutilman.exe /debug1⤵
-
C:\Windows\system32\utilman.exeutilman.exe /debug1⤵
-
C:\Windows\system32\utilman.exeutilman.exe /debug1⤵
-
C:\Windows\system32\utilman.exeutilman.exe /debug1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D01⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding1⤵
-
C:\Windows\system32\utilman.exeutilman.exe /debug1⤵
-
C:\Windows\System32\VoiceAccess.exe"C:\Windows\System32\VoiceAccess.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\LegitBall\LegitBall\LegitBall.exe"C:\Users\Admin\Downloads\LegitBall\LegitBall\LegitBall.exe"1⤵
-
C:\Users\Admin\Downloads\LegitBall\LegitBall\LegitBall.exe"C:\Users\Admin\Downloads\LegitBall\LegitBall\LegitBall.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title LegitBall3⤵
-
-
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Accessibility Features
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Accessibility Features
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5af978.rbs
e5af97d.rbs
e5af982.rbs
e5af987.rbs
e5af98c.rbs
e5af991.rbs
e5af995.rbs
e5af999.rbs
e5af99d.rbs
e5af9a1.rbs
e5af9a5.rbs
e5af9a9.rbs
e5af9ad.rbs
e5af9b1.rbs
e5af9b5.rbs
e5af9b9.rbs
e5af9bd.rbs
e5af9c0.rbs
e5af9c3.rbs
RobloxStudioInstaller.exe
3785aa51-b187-4bf0-a6f0-f29e230ccece.tmp
settings.dat
settings.dat
000003.log
LOG.old
LOG.old
f_000087
f_000088
f_000089
f_00008a
f_00008b
f_00008c
f_00008d
f_00008e
f_00008f
f_000094
f_000095
f_000096
f_000097
f_000098
f_00009f
f_0000a0
f_0000ad
f_0000ae
f_0000af
f_0000b0
f_0000dc
f_0000de
f_0000e0
f_0000e1
f_000123
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe595385.TMP
SiteList-Enterprise.json
Edge Profile.ico
000003.log
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe59ac15.TMP
the-real-index
the-real-index~RFe62b689.TMP
the-real-index
the-real-index
the-real-index
index.txt
index.txt
index.txt
index.txt.tmp
the-real-index
the-real-index~RFe5a3c5e.TMP
sync_diagnostic.log
sync_diagnostic.log
CURRENT
MANIFEST-000001
OperationConfig
OperationConfig~RFe59cf0e.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe59d4fa.TMP
2f2244d1-e83d-4300-9611-0e4f19ae78f1.tmp
doc_JustForMe
lib_JustForMe
tcltk_JustForMe
pip.msi
core.msi
dev.msi
state.rsm
path.msi
exe.msi
test.msi
__init__.py
__main__.py
_recursion_too_deep_message.py
_shared_with_waf.py
__init__.py
pyz_crypto.py
readers.py
writers.py
api.py
build_main.py
datastruct.py
icon.py
makespec.py
osx.py
splash.py
splash_templates.py
templates.py
utils.py
compat.py
config.py
configure.py
analysis.py
bindepend.py
bytecode.py
dylib.py
imphook.py
imphookapi.py
utils.py
exceptions.py
__init__.py
_win32.py
qt.py
tempfile.py
pyi_splash.py
hook-PIL.Image.py
hook-PIL.ImageFilter.py
hook-PIL.SpiderImagePlugin.py
hook-PIL.py
hook-PyQt5.Qt.py
hook-PyQt5.Qt3DExtras.py
hook-PyQt5.QtNetwork.py
hook-PyQt5.QtQml.py
hook-PyQt5.QtWebEngineCore.py
hook-PyQt5.py
hook-PyQt5.uic.py
hook-PyQt6.Qt3DExtras.py
hook-PyQt6.Qt3DRender.py
hook-PyQt6.QtGraphs.py
hook-PyQt6.QtGraphsWidgets.py
hook-PyQt6.QtNetwork.py
hook-PyQt6.QtOpenGLWidgets.py
hook-PyQt6.QtQml.py
hook-PyQt6.QtStateMachine.py
hook-PyQt6.QtWebEngineCore.py
hook-PyQt6.QtWebEngineQuick.py
hook-PyQt6.py
hook-PyQt6.uic.py
hook-PySide2.QtMultimedia.py
hook-PySide2.QtNetwork.py
hook-PySide2.QtQml.py
hook-PySide2.QtUiTools.py
hook-PySide2.QtWebEngineCore.py
hook-PySide2.QtWebEngineWidgets.py
hook-PySide2.Qwt5.py
hook-PySide2.py
hook-PySide6.Qt3DRender.py
hook-PySide6.QtGraphs.py
hook-PySide6.QtGraphsWidgets.py
hook-PySide6.QtHttpServer.py
hook-PySide6.QtMultimedia.py
hook-PySide6.QtNetwork.py
hook-PySide6.QtQml.py
hook-PySide6.QtQuickControls2.py
hook-PySide6.QtWebEngineCore.py
hook-PySide6.py
hook-_ctypes.py
hook-_osx_support.py
hook-_pyi_rth_utils.py
hook-_tkinter.py
hook-babel.py
hook-difflib.py
hook-distutils.command.check.py
hook-distutils.py
hook-distutils.util.py
hook-django.contrib.sessions.py
hook-django.core.cache.py
hook-django.core.mail.py
hook-django.core.management.py
hook-django.db.backends.mysql.base.py
hook-django.db.backends.oracle.base.py
hook-django.db.backends.py
hook-django.py
hook-django.template.loaders.py
hook-encodings.py
hook-gevent.py
hook-gi.py
hook-gi.repository.Adw.py
hook-gi.repository.AppIndicator3.py
hook-gi.repository.Atk.py
hook-gi.repository.AyatanaAppIndicator3.py
hook-gi.repository.Champlain.py
hook-gi.repository.Clutter.py
hook-gi.repository.DBus.py
hook-gi.repository.GIRepository.py
hook-gi.repository.GLib.py
hook-gi.repository.GLibUnix.py
hook-gi.repository.GLibWin32.py
hook-gi.repository.GModule.py
hook-gi.repository.GObject.py
hook-gi.repository.Gdk.py
hook-gi.repository.GdkPixbuf.py
hook-gi.repository.Gio.py
hook-gi.repository.GioUnix.py
hook-gi.repository.GioWin32.py
hook-gi.repository.Graphene.py
hook-gi.repository.Gsk.py
hook-gi.repository.Gst.py
hook-gi.repository.GstAllocators.py
hook-gi.repository.GstApp.py
hook-gi.repository.GstAudio.py
hook-gi.repository.GstBadAudio.py
hook-gi.repository.GstBase.py
hook-gi.repository.GstCheck.py
hook-gi.repository.GstCodecs.py
hook-gi.repository.GstController.py
hook-gi.repository.GstGL.py
hook-gi.repository.GstGLEGL.py
hook-gi.repository.GstGLWayland.py
hook-gi.repository.GstGLX11.py
hook-gi.repository.GstInsertBin.py
hook-gi.repository.GstMpegts.py
hook-gi.repository.GstNet.py
hook-gi.repository.GstPbutils.py
hook-gi.repository.GstPlay.py
hook-gi.repository.GstPlayer.py
hook-gi.repository.GstRtp.py
hook-gi.repository.GstRtsp.py
hook-gi.repository.GstRtspServer.py
hook-gi.repository.GstSdp.py
hook-gi.repository.GstTag.py
hook-gi.repository.GstTranscoder.py
hook-gi.repository.GstVideo.py
hook-gi.repository.GstVulkan.py
hook-gi.repository.GstVulkanWayland.py
hook-gi.repository.GstVulkanXCB.py
hook-gi.repository.GstWebRTC.py
hook-gi.repository.Gtk.py
hook-gi.repository.GtkChamplain.py
hook-gi.repository.GtkClutter.py
hook-gi.repository.GtkSource.py
hook-gi.repository.GtkosxApplication.py
hook-gi.repository.HarfBuzz.py
hook-gi.repository.OsmGpsMap.py
hook-gi.repository.Pango.py
hook-gi.repository.PangoCairo.py
hook-gi.repository.Rsvg.py
hook-gi.repository.cairo.py
hook-gi.repository.freetype2.py
hook-gi.repository.xlib.py
hook-heapq.py
hook-idlelib.py
hook-importlib_metadata.py
hook-importlib_resources.py
hook-keyring.py
hook-kivy.py
hook-lib2to3.py
hook-math.py
hook-matplotlib.backend_bases.py
hook-matplotlib.backends.backend_qtagg.py
hook-matplotlib.backends.backend_qtcairo.py
hook-matplotlib.backends.py
hook-matplotlib.backends.qt_compat.py
hook-matplotlib.numerix.py
hook-matplotlib.py
hook-matplotlib.pyplot.py
hook-multiprocessing.util.py
hook-numpy.py
hook-pandas.io.clipboard.py
hook-pandas.io.formats.style.py
hook-pandas.plotting.py
hook-pandas.py
hook-pickle.py
hook-pkg_resources.py
hook-platform.py
hook-pygments.py
hook-pytz.py
hook-pytzdata.py
hook-qtawesome.py
hook-qtpy.py
hook-scapy.layers.all.py
hook-scipy.io.matlab.py
hook-scipy.linalg.py
hook-scipy.py
hook-scipy.sparse.csgraph.py
hook-scipy.spatial._ckdtree.py
hook-scipy.spatial.transform.rotation.py
hook-scipy.special._ellip_harm_2.py
hook-scipy.special._ufuncs.py
hook-scipy.stats._stats.py
hook-scrapy.py
hook-setuptools._vendor.importlib_metadata.py
hook-setuptools._vendor.jaraco.text.py
hook-setuptools.py
hook-shelve.py
hook-shiboken6.py
hook-sphinx.py
hook-sqlalchemy.py
hook-sqlite3.py
hook-sysconfig.py
hook-wcwidth.py
hook-webbrowser.py
hook-win32ctypes.core.py
hook-xml.dom.domreg.py
hook-xml.etree.cElementTree.py
hook-xml.py
hook-zope.interface.py
hook-PyQt5.uic.port_v2.py
hook-_pyi_rth_utils.py
hook-distutils.py
hook-pyi_splash.py
hook-tkinter.py
hook-backports.py
hook-distutils.py
hook-gi.overrides.py
hook-gi.py
hook-gi.repository.Champlain.py
hook-gi.repository.GLibUnix.py
hook-gi.repository.GstVideo.py
hook-gi.repository.OsmGpsMap.py
hook-gi.repository.Rsvg.py
hook-inflect.py
hook-setuptools.extern.six.moves.py
hook-six.moves.py
hook-urllib3.packages.six.moves.py
pyi_rth__tkinter.py
pyi_rth_django.py
pyi_rth_gdkpixbuf.py
pyi_rth_gi.py
pyi_rth_gio.py
pyi_rth_glib.py
pyi_rth_gstreamer.py
pyi_rth_gtk.py
pyi_rth_inspect.py
pyi_rth_kivy.py
pyi_rth_mplconfig.py
pyi_rth_multiprocessing.py
pyi_rth_pkgres.py
pyi_rth_pkgutil.py
pyi_rth_pyqt5.py
pyi_rth_pyqt6.py
pyi_rth_pyside2.py
pyi_rth_pyside6.py
pyi_rth_setuptools.py
__init__.py
_child.py
_parent.py
__init__.py
__main__.py
find_modules.py
modulegraph.py
util.py
pyiboot01_bootstrap.py
pyimod01_archive.py
pyimod02_importers.py
pyimod03_ctypes.py
pyimod04_pywin32.py
log.py
archive_viewer.py
bindepend.py
grab_version.py
makespec.py
set_version.py
conftest.py
__init__.py
conda.py
django.py
gi.py
__init__.py
_modules_info.py
setuptools.py
tcl_tk.py
misc.py
osx.py
run_tests.py
tests.py
icon.py
versioninfo.py
winmanifest.py
winresource.py
winutils.py
__init__.py
override.py
__init__.py
compat.py
__init__.py
hook-tensorflow.py
hook-win32com.py
__init__.py
pyi_rth_cryptography_openssl.py
pyi_rth_enchant.py
pyi_rth_ffpyplayer.py
pyi_rth_findlibs.py
pyi_rth_nltk.py
pyi_rth_osgeo.py
pyi_rth_pygraphviz.py
pyi_rth_pyproj.py
pyi_rth_pyqtgraph_multiprocess.py
pyi_rth_pythoncom.py
pyi_rth_tensorflow.py
pyi_rth_traitlets.py
pyi_rth_usb.py
hook-BTrees.py
hook-CTkMessagebox.py
hook-Crypto.py
hook-Cryptodome.py
hook-HtmlTestRunner.py
hook-IPython.py
hook-OpenGL.py
hook-OpenGL_accelerate.py
hook-PyTaskbar.py
hook-Xlib.py
hook-_mssql.py
hook-_mysql.py
hook-accessible_output2.py
hook-adbc_driver_manager.py
hook-adbutils.py
hook-adios.py
hook-afmformats.py
hook-aliyunsdkcore.py
hook-altair.py
hook-amazonproduct.py
hook-anyio.py
hook-apkutils.py
hook-appdirs.py
hook-appy.pod.py
hook-apscheduler.py
hook-argon2.py
hook-astor.py
hook-astroid.py
hook-astropy.py
hook-astropy_iers_data.py
hook-av.py
hook-avro.py
hook-azurerm.py
hook-backports.py
hook-backports.zoneinfo.py
hook-bacon.py
hook-bcrypt.py
hook-bitsandbytes.py
hook-black.py
hook-bleak.py
hook-blib2to3.py
hook-blspy.py
hook-bokeh.py
hook-boto.py
hook-boto3.py
hook-botocore.py
hook-branca.py
hook-cairocffi.py
hook-cairosvg.py
hook-capstone.py
hook-cassandra.py
hook-celpy.py
hook-certifi.py
hook-cf_units.py
hook-cftime.py
hook-chardet.py
hook-charset_normalizer.py
hook-cloudpickle.py
hook-cloudscraper.py
hook-clr.py
hook-clr_loader.py
hook-cmocean.py
hook-compliance_checker.py
hook-comtypes.client.py
hook-countrycode.py
hook-countryinfo.py
hook-cryptography.py
hook-cumm.py
hook-customtkinter.py
hook-cv2.py
hook-cx_Oracle.py
hook-cytoolz.itertoolz.py
hook-dash.py
hook-dash_bootstrap_components.py
hook-dash_core_components.py
hook-dash_html_components.py
hook-dash_renderer.py
hook-dash_table.py
hook-dash_uploader.py
hook-dask.py
hook-dateparser.py
hook-dateparser.utils.strptime.py
hook-dateutil.py
hook-dbus_fast.py
hook-dclab.py
hook-ddgs.py
hook-discid.py
hook-distorm3.py
hook-distributed.py
hook-dns.rdata.py
hook-docutils.py
hook-docx.py
hook-docx2pdf.py
hook-duckdb.py
hook-dynaconf.py
hook-easyocr.py
hook-eccodeslib.py
hook-eckitlib.py
hook-eel.py
hook-emoji.py
hook-enchant.py
hook-eng_to_ipa.py
hook-ens.py
hook-enzyme.parsers.ebml.core.py
hook-eth_abi.py
hook-eth_account.py
hook-eth_hash.py
hook-eth_keyfile.py
hook-eth_keys.py
hook-eth_rlp.py
hook-eth_typing.py
hook-eth_utils.network.py
hook-eth_utils.py
hook-exchangelib.py
hook-fabric.py
hook-fairscale.py
hook-fake_useragent.py
hook-faker.py
hook-falcon.py
hook-fastparquet.py
hook-fckitlib.py
hook-ffpyplayer.py
hook-fiona.py
hook-flask_compress.py
hook-flask_restx.py
hook-flex.py
hook-flirpy.py
hook-fmpy.py
hook-folium.py
hook-freetype.py
hook-frictionless.py
hook-fsspec.py
hook-gadfly.py
hook-gbulb.py
hook-gcloud.py
hook-geopandas.py
hook-gitlab.py
hook-globus_sdk.py
hook-gmplot.py
hook-gmsh.py
hook-gooey.py
hook-google.api_core.py
hook-google.cloud.bigquery.py
hook-google.cloud.core.py
hook-google.cloud.kms_v1.py
hook-google.cloud.pubsub_v1.py
hook-google.cloud.speech.py
hook-google.cloud.storage.py
hook-google.cloud.translate.py
hook-googleapiclient.model.py
hook-grapheme.py
hook-graphql_query.py
hook-great_expectations.py
hook-gribapi.py
hook-grpc.py
hook-gtk.py
hook-h3.py
hook-h5py.py
hook-hdf5plugin.py
hook-hexbytes.py
hook-httplib2.py
hook-humanize.py
hook-hydra.py
hook-ijson.py
hook-imageio.py
hook-imageio_ffmpeg.py
hook-imagingcontrol4.py
hook-iminuit.py
hook-intake.py
hook-iso639.py
hook-itk.py
hook-jaraco.text.py
hook-jedi.py
hook-jieba.py
hook-jinja2.py
hook-jinxed.py
hook-jira.py
hook-jsonpath_rw_ext.py
hook-jsonrpcserver.py
hook-jsonschema.py
hook-jsonschema_specifications.py
hook-jupyterlab.py
hook-kaleido.py
hook-khmernltk.py
hook-kinterbasdb.py
hook-langchain.py
hook-langchain_classic.py
hook-langcodes.py
hook-langdetect.py
hook-laonlp.py
hook-lark.py
hook-ldfparser.py
hook-lensfunpy.py
hook-libaudioverse.py
hook-librosa.py
hook-lightgbm.py
hook-lightning.py
hook-limits.py
hook-linear_operator.py
hook-lingua.py
hook-litestar.py
hook-llvmlite.py
hook-logilab.py
hook-lxml.etree.py
hook-lxml.isoschematron.py
hook-lxml.objectify.py
hook-lxml.py
hook-lz4.py
hook-magic.py
hook-mako.codegen.py
hook-mariadb.py
hook-markdown.py
hook-mecab.py
hook-metpy.py
hook-migrate.py
hook-mimesis.py
hook-minecraft_launcher_lib.py
hook-mistune.py
hook-mnemonic.py
hook-monai.py
hook-moviepy.audio.fx.all.py
hook-moviepy.video.fx.all.py
hook-mpl_toolkits.basemap.py
hook-msoffcrypto.py
hook-nacl.py
hook-names.py
hook-nanite.py
hook-narwhals.py
hook-nbconvert.py
hook-nbdime.py
hook-nbformat.py
hook-nbt.py
hook-ncclient.py
hook-netCDF4.py
hook-nicegui.py
hook-niquests.py
hook-nltk.py
hook-nnpy.py
hook-notebook.py
hook-numba.py
hook-numbers_parser.py
hook-numcodecs.py
hook-nvidia.cuda_nvcc.py
hook-nvidia.cudnn.py
hook-office365.py
hook-onnxruntime.py
hook-opencc.py
hook-openpyxl.py
hook-opentelemetry.py
hook-orjson.py
hook-osgeo.py
hook-pandas_flavor.py
hook-panel.py
hook-parsedatetime.py
hook-parso.py
hook-passlib.py
hook-paste.exceptions.reporter.py
hook-patoolib.py
hook-patsy.py
hook-pdfminer.py
hook-pendulum.py
hook-phonenumbers.py
hook-pingouin.py
hook-pint.py
hook-pinyin.py
hook-platformdirs.py
hook-plotly.py
hook-plum.py
hook-pointcept.py
hook-pptx.py
hook-prettytable.py
hook-psutil.py
hook-psychopy.py
hook-psycopg2.py
hook-psycopg_binary.py
hook-psycopg_c.py
hook-publicsuffix2.py
hook-pubsub.core.py
hook-puremagic.py
hook-py.py
hook-pyarrow.py
hook-pycountry.py
hook-pycparser.py
hook-pycrfsuite.py
hook-pydantic.py
hook-pydicom.py
hook-pydivert.py
hook-pyecharts.py
hook-pyexcel-io.py
hook-pyexcel-ods.py
hook-pyexcel-ods3.py
hook-pyexcel-odsr.py
hook-pyexcel-xls.py
hook-pyexcel-xlsx.py
hook-pyexcel-xlsxw.py
hook-pyexcel.py
hook-pyexcel_io.py
hook-pyexcel_ods.py
hook-pyexcel_ods3.py
hook-pyexcel_odsr.py
hook-pyexcel_xls.py
hook-pyexcel_xlsx.py
hook-pyexcel_xlsxw.py
hook-pyexcelerate.Writer.py
hook-pygraphviz.py
hook-pygwalker.py
hook-pylibmagic.py
hook-pylint.py
hook-pylsl.py
hook-pymediainfo.py
hook-pymeshlab.py
hook-pymorphy3.py
hook-pymssql.py
hook-pynng.py
hook-pynput.py
hook-pyodbc.py
hook-pyopencl.py
hook-pypdfium2.py
hook-pypdfium2_raw.py
hook-pypemicro.py
hook-pyphen.py
hook-pyppeteer.py
hook-pyproj.py
hook-pypsexec.py
hook-pypylon.py
hook-pyqtgraph.py
hook-pyshark.py
hook-pysnmp.py
hook-pystray.py
hook-pytest.py
hook-pythainlp.py
hook-pythoncom.py
hook-pytokens.py
hook-pyttsx.py
hook-pyttsx3.py
hook-pyviz_comms.py
hook-pyvjoy.py
hook-pywintypes.py
hook-pywt.py
hook-qtmodern.py
hook-radicale.py
hook-raven.py
hook-rawpy.py
hook-rdflib.py
hook-redmine.py
hook-regex.py
hook-reportlab.lib.utils.py
hook-reportlab.pdfbase._fontdata.py
hook-resampy.py
hook-rich.py
hook-rlp.py
hook-rpy2.py
hook-rtree.py
hook-ruamel.yaml.py
hook-sacremoses.py
hook-sam2.py
hook-saml2.py
hook-schwifty.py
hook-seedir.py
hook-selectolax.py
hook-selenium.py
hook-sentry_sdk.py
hook-setuptools_scm.py
hook-shapely.py
hook-shotgun_api3.py
hook-simplemma.py
hook-skimage.color.py
hook-skimage.data.py
hook-skimage.draw.py
hook-skimage.exposure.py
hook-skimage.feature.py
hook-skimage.filters.py
hook-skimage.future.py
hook-skimage.graph.py
hook-skimage.io.py
hook-skimage.measure.py
hook-skimage.metrics.py
hook-skimage.morphology.py
hook-skimage.py
hook-skimage.registration.py
hook-skimage.restoration.py
hook-skimage.segmentation.py
hook-skimage.transform.py
hook-sklearn.cluster.py
hook-sklearn.externals.array_api_compat.cupy.py
hook-sklearn.externals.array_api_compat.dask.array.py
hook-sklearn.externals.array_api_compat.numpy.py
hook-sklearn.externals.array_api_compat.torch.py
hook-sklearn.linear_model.py
hook-sklearn.metrics.cluster.py
hook-sklearn.metrics.pairwise.py
hook-sklearn.metrics.py
hook-sklearn.neighbors.py
hook-sklearn.py
hook-sklearn.tree.py
hook-sklearn.utils.py
hook-skyfield.py
hook-slixmpp.py
hook-sound_lib.py
hook-sounddevice.py
hook-soundfile.py
hook-spacy.py
hook-speech_recognition.py
hook-spiceypy.py
hook-spnego.py
hook-srsly.msgpack._packer.py
hook-sspilib.raw.py
hook-statsmodels.tsa.statespace.py
hook-stdnum.py
hook-storm.database.py
hook-sudachipy.py
hook-sunpy.py
hook-sv_ttk.py
hook-swagger_spec_validator.py
hook-tableauhyperapi.py
hook-tables.py
hook-tcod.py
hook-tensorflow.py
hook-tensorrt_libs.py
hook-text_unidecode.py
hook-textdistance.py
hook-thinc.backends.numpy_ops.py
hook-thinc.py
hook-timezonefinder.py
hook-timm.py
hook-tinycss2.py
hook-tkinterdnd2.py
hook-tkinterweb.py
hook-tkinterweb_tkhtml.py
hook-tkinterweb_tkhtml_extras.py
hook-toga.py
hook-toga_cocoa.py
hook-toga_gtk.py
hook-toga_winforms.py
hook-torch.py
hook-torchaudio.py
hook-torchtext.py
hook-torchvision.io.image.py
hook-torchvision.py
hook-trame.py
hook-trame_client.py
hook-trame_code.py
hook-trame_components.py
hook-trame_datagrid.py
hook-trame_deckgl.py
hook-trame_formkit.py
hook-trame_grid.py
hook-trame_iframe.py
hook-trame_keycloak.py
hook-trame_leaflet.py
hook-trame_markdown.py
hook-trame_matplotlib.py
hook-trame_mesh_streamer.py
hook-trame_plotly.py
hook-trame_pvui.py
hook-trame_quasar.py
hook-trame_rca.py
hook-trame_router.py
hook-trame_simput.py
hook-trame_tauri.py
hook-trame_tweakpane.py
hook-trame_vega.py
hook-trame_vtk.py
hook-trame_vtk3d.py
hook-trame_vtklocal.py
hook-trame_vuetify.py
hook-trame_xterm.py
hook-transformers.py
hook-travertino.py
hook-trimesh.py
hook-triton.py
hook-ttkthemes.py
hook-ttkwidgets.py
hook-tzdata.py
hook-tzwhere.py
hook-u1db.py
hook-ultralytics.py
hook-umap.py
hook-unidecode.py
hook-uniseg.py
hook-urllib3.py
hook-urllib3_future.py
hook-usb.py
hook-uuid6.py
hook-uvicorn.py
hook-uvloop.py
hook-vaderSentiment.py
hook-vtkmodules.vtkCommonColor.py
hook-vtkpython.py
hook-wavefile.py
hook-weasyprint.py
hook-web3.py
hook-webassets.py
hook-webrtcvad.py
hook-websockets.py
hook-webview.py
hook-win32com.py
hook-wordcloud.py
hook-workflow.py
hook-wx.lib.activex.py
hook-wx.lib.pubsub.py
hook-wx.xrc.py
hook-xarray.py
hook-xml.dom.html.HTMLDocument.py
hook-xml.sax.saxexts.py
hook-xmldiff.py
hook-xmlschema.py
hook-xsge_gui.py
hook-xyzservices.py
hook-yapf_third_party.py
hook-z3c.rml.py
hook-zarr.py
hook-zeep.py
hook-zmq.py
__init__.py
mypy.py
nvidia_cuda.py
vtkmodules.py
__init__.py
ado_consts.py
adodbapi.py
apibase.py
db_print.py
db_table_names.py
xls_read.py
xls_write.py
is64bit.py
process_connect_string.py
schema_table.py
setup.py
adodbapitest.py
adodbapitestconfig.py
dbapi20.py
is64bit.py
setuptestframework.py
test_adodbapi_dbapi20.py
tryconnection.py
METADATA
Dot.py
Graph.py
GraphAlgo.py
GraphStat.py
GraphUtil.py
ObjectGraph.py
__init__.py
METADATA
__init__.py
__main__.py
core.py
METADATA
__init__.py
__main__.py
api.py
cd.py
__init__.py
__main__.py
constant.py
legacy.py
md.py
models.py
utils.py
version.py
METADATA
__init__.py
dearpygui.py
demo.py
experimental.py
type_info.py
METADATA
__init__.py
__main__.py
cli.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
install.py
isapicon.py
advanced.py
redirector.py
redirector_asynch.py
redirector_with_filter.py
test.py
simple.py
extension_simple.py
threaded_extension.py
METADATA
__config__.py
__init__.py
_array_api_info.py
_configtool.py
__init__.py
_add_newdocs.py
_add_newdocs_scalars.py
_asarray.py
_dtype.py
_dtype_ctypes.py
_exceptions.py
_internal.py
_methods.py
_string_helpers.py
_type_aliases.py
_ufunc_config.py
arrayprint.py
cversions.py
defchararray.py
einsumfunc.py
fromnumeric.py
function_base.py
getlimits.py
memmap.py
multiarray.py
numeric.py
numerictypes.py
overrides.py
printoptions.py
records.py
shape_base.py
strings.py
_locales.py
_natype.py
setup.py
setup.py
test__exceptions.py
test_abc.py
test_api.py
test_argparse.py
test_array_api_info.py
test_array_coercion.py
test_array_interface.py
test_arraymethod.py
test_arrayobject.py
test_arrayprint.py
test_casting_floatingpoint_errors.py
test_casting_unittests.py
test_conversion_utils.py
test_cpu_dispatcher.py
test_cpu_features.py
test_custom_dtypes.py
test_cython.py
test_datetime.py
test_defchararray.py
test_deprecations.py
test_dlpack.py
test_dtype.py
test_einsum.py
test_errstate.py
test_extint128.py
test_finfo.py
test_function_base.py
test_getlimits.py
test_half.py
test_hashtable.py
test_indexerrors.py
test_indexing.py
test_item_selection.py
test_limited_api.py
test_longdouble.py
test_mem_overlap.py
test_mem_policy.py
test_memmap.py
test_multiarray.py
test_multiprocessing.py
test_multithreading.py
test_nditer.py
test_nep50_promotions.py
test_numeric.py
test_numerictypes.py
test_overrides.py
test_print.py
test_protocols.py
test_records.py
test_regression.py
test_scalar_ctors.py
test_scalar_methods.py
test_scalarbuffer.py
test_scalarinherit.py
test_scalarmath.py
test_scalarprint.py
test_shape_base.py
test_simd.py
test_simd_module.py
test_stringdtype.py
test_strings.py
test_ufunc.py
test_umath.py
test_umath_accuracy.py
test_umath_complex.py
test_unicode.py
umath.py
_distributor_init.py
_expired_attrs_2_0.py
_globals.py
hook-numpy.py
__init__.py
pyinstaller-smoke.py
test_pyinstaller.py
_pytesttester.py
__init__.py
_add_docstring.py
_array_like.py
_char_codes.py
_dtype_like.py
_extended_precision.py
_nbit.py
_nbit_base.py
_nested_sequence.py
_scalars.py
_shape.py
_ufunc.py
__init__.py
_convertions.py
_inspect.py
_pep440.py
__init__.py
conftest.py
__init__.py
_dtype.py
_dtype_ctypes.py
_internal.py
_multiarray_umath.py
_utils.py
arrayprint.py
defchararray.py
einsumfunc.py
fromnumeric.py
function_base.py
getlimits.py
multiarray.py
numeric.py
numerictypes.py
overrides.py
records.py
shape_base.py
umath.py
__init__.py
_ctypeslib.py
__init__.py
_shell_utils.py
armccompiler.py
ccompiler.py
ccompiler_opt.py
__init__.py
autodist.py
bdist_rpm.py
build.py
build_clib.py
build_ext.py
build_py.py
build_scripts.py
build_src.py
config.py
config_compiler.py
develop.py
egg_info.py
install.py
install_clib.py
install_data.py
install_headers.py
sdist.py
conv_template.py
core.py
cpuinfo.py
exec_command.py
extension.py
__init__.py
absoft.py
arm.py
compaq.py
environment.py
fujitsu.py
g95.py
gnu.py
hpux.py
ibm.py
intel.py
lahey.py
mips.py
nag.py
none.py
nv.py
pathf95.py
pg.py
sun.py
vast.py
from_template.py
fujitsuccompiler.py
intelccompiler.py
lib2def.py
line_endings.py
log.py
mingw32ccompiler.py
misc_util.py
msvc9compiler.py
msvccompiler.py
npy_pkg_config.py
numpy_distribution.py
pathccompiler.py
system_info.py
test_build_ext.py
test_ccompiler_opt.py
test_ccompiler_opt_conf.py
test_exec_command.py
test_fcompiler.py
test_fcompiler_gnu.py
test_fcompiler_intel.py
test_fcompiler_nagfor.py
test_from_template.py
test_log.py
test_mingw32ccompiler.py
test_misc_util.py
test_npy_pkg_config.py
test_shell_utils.py
test_system_info.py
utilities.py
unixccompiler.py
ufuncs.py
dtypes.py
exceptions.py
__init__.py
__main__.py
__version__.py
__init__.py
_backend.py
_distutils.py
_meson.py
_isocbind.py
_src_pyf.py
auxfuncs.py
capi_maps.py
cb_rules.py
cfuncs.py
common_rules.py
crackfortran.py
diagnose.py
f2py2e.py
f90mod_rules.py
func2subr.py
rules.py
symbolic.py
test_abstract_interface.py
test_array_from_pyobj.py
test_assumed_shape.py
test_block_docstring.py
test_callback.py
test_capi_maps.py
test_character.py
test_common.py
test_crackfortran.py
test_data.py
test_docs.py
test_f2cmap.py
test_f2py2e.py
test_isoc.py
test_kind.py
test_mixed.py
test_modules.py
test_parameter.py
test_pyf_src.py
test_quoted_character.py
test_regression.py
test_return_character.py
test_return_complex.py
test_return_integer.py
test_return_logical.py
test_return_real.py
test_routines.py
test_semicolon_split.py
test_size.py
test_string.py
test_symbolic.py
test_value_attrspec.py
util.py
use_rules.py
__init__.py
_helper.py
_pocketfft.py
test_helper.py
test_pocketfft.py
__init__.py
_array_utils_impl.py
_arraypad_impl.py
_arraysetops_impl.py
_arrayterator_impl.py
_datasource.py
_format_impl.py
_function_base_impl.py
_histograms_impl.py
_index_tricks_impl.py
_iotools.py
_nanfunctions_impl.py
_npyio_impl.py
_polynomial_impl.py
_scimath_impl.py
_shape_base_impl.py
_stride_tricks_impl.py
_twodim_base_impl.py
_type_check_impl.py
_ufunclike_impl.py
_user_array_impl.py
_utils_impl.py
_version.py
array_utils.py
format.py
introspect.py
mixins.py
npyio.py
recfunctions.py
scimath.py
stride_tricks.py
test__datasource.py
test__iotools.py
test__version.py
test_array_utils.py
test_arraypad.py
test_arraysetops.py
test_arrayterator.py
test_format.py
test_function_base.py
test_histograms.py
test_index_tricks.py
test_io.py
test_loadtxt.py
test_mixins.py
test_nanfunctions.py
test_packbits.py
test_polynomial.py
test_recfunctions.py
test_regression.py
test_shape_base.py
test_stride_tricks.py
test_twodim_base.py
test_type_check.py
test_ufunclike.py
test_utils.py
user_array.py
__init__.py
_linalg.py
test_deprecations.py
test_linalg.py
test_regression.py
__init__.py
core.py
extras.py
mrecords.py
test_arrayobject.py
test_core.py
test_deprecations.py
test_extras.py
test_mrecords.py
test_old_ma.py
test_regression.py
test_subclassing.py
testutils.py
matlib.py
__init__.py
defmatrix.py
test_defmatrix.py
test_interaction.py
test_masked_matrix.py
test_matrix_linalg.py
test_multiarray.py
test_numeric.py
test_regression.py
__init__.py
_polybase.py
chebyshev.py
hermite.py
hermite_e.py
laguerre.py
legendre.py
polynomial.py
polyutils.py
test_chebyshev.py
test_classes.py
test_hermite.py
test_hermite_e.py
test_laguerre.py
test_legendre.py
test_polynomial.py
test_polyutils.py
test_printing.py
test_symbol.py
__init__.py
extending.py
parse.py
extending.py
extending_distributions.py
_pickle.py
test_direct.py
test_extending.py
test_generator_mt19937.py
test_generator_mt19937_regressions.py
test_random.py
test_randomstate.py
test_randomstate_regression.py
test_regression.py
test_seed_sequence.py
test_smoke.py
__init__.py
__init__.py
__init__.py
extbuild.py
utils.py
overrides.py
print_coercion_tables.py
test_utils.py
test__all__.py
test_configtool.py
test_ctypeslib.py
test_lazyloading.py
test_matlib.py
test_numpy_config.py
test_numpy_version.py
test_public_api.py
test_reloading.py
test_scripts.py
test_warnings.py
__init__.py
mypy_plugin.py
arithmetic.py
array_constructors.py
array_like.py
arrayprint.py
arrayterator.py
bitwise_ops.py
comparisons.py
dtype.py
einsumfunc.py
flatiter.py
fromnumeric.py
index_tricks.py
lib_user_array.py
lib_utils.py
lib_version.py
literal.py
ma.py
mod.py
modules.py
multiarray.py
ndarray_conversion.py
ndarray_misc.py
ndarray_shape_manipulation.py
nditer.py
numeric.py
numerictypes.py
random.py
recfunctions.py
scalars.py
shape.py
simple.py
ufunc_config.py
ufunclike.py
ufuncs.py
warnings_and_errors.py
test_isfile.py
test_runtime.py
test_typing.py
version.py
__init__.py
oleaut32.py
ws2_32.py
wsock32.py
METADATA
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
dependency_groups.py
direct_url.py
errors.py
__init__.py
_spdx.py
markers.py
metadata.py
pylock.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
METADATA
pefile.py
peutils.py
METADATA
top_level.txt
__init__.py
__main__.py
__pip-runner__.py
__init__.py
build_env.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
metadata_legacy.py
wheel.py
wheel_editable.py
wheel_legacy.py
check.py
freeze.py
__init__.py
editable_legacy.py
legacy.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
distutils_args.py
egg_link.py
encoding.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
inject_securetransport.py
logging.py
misc.py
models.py
packaging.py
setuptools_build.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
compat.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
core.py
__init__.py
big5freq.py
big5prober.py
chardistribution.py
charsetgroupprober.py
charsetprober.py
chardetect.py
codingstatemachine.py
cp949prober.py
enums.py
escprober.py
escsm.py
eucjpprober.py
euckrfreq.py
euckrprober.py
euctwfreq.py
euctwprober.py
gb2312freq.py
gb2312prober.py
hebrewprober.py
jisfreq.py
johabfreq.py
johabprober.py
jpcntx.py
langbulgarianmodel.py
langgreekmodel.py
langhebrewmodel.py
langhungarianmodel.py
langrussianmodel.py
langthaimodel.py
langturkishmodel.py
latin1prober.py
mbcharsetprober.py
mbcsgroupprober.py
mbcssm.py
languages.py
sbcharsetprober.py
sbcsgroupprober.py
sjisprober.py
universaldetector.py
utf1632prober.py
utf8prober.py
version.py
__init__.py
ansi.py
ansitowin32.py
initialise.py
win32.py
winterm.py
__init__.py
compat.py
database.py
index.py
locators.py
manifest.py
markers.py
metadata.py
resources.py
scripts.py
util.py
version.py
wheel.py
__init__.py
__main__.py
distro.py
__init__.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
markers.py
requirements.py
__init__.py
_compat.py
build.py
check.py
colorlog.py
dirtools.py
envbuild.py
__init__.py
_in_process.py
meta.py
wrappers.py
__init__.py
py31compat.py
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
cmdline.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
bbcode.py
groff.py
html.py
img.py
irc.py
latex.py
other.py
pangomarkup.py
rtf.py
svg.py
terminal.py
terminal256.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
token.py
unistring.py
util.py
__init__.py
__init__.py
__init__.py
__version__.py
_internal_utils.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
collections_abc.py
providers.py
reporters.py
resolvers.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_inspect.py
_log_render.py
_loop.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
six.py
__init__.py
_asyncio.py
_utils.py
after.py
before.py
before_sleep.py
nap.py
retry.py
stop.py
tornadoweb.py
wait.py
typing_extensions.py
__init__.py
_collections.py
_version.py
connection.py
connectionpool.py
_appengine_environ.py
bindings.py
low_level.py
appengine.py
ntlmpool.py
pyopenssl.py
securetransport.py
socks.py
exceptions.py
fields.py
filepost.py
makefile.py
six.py
poolmanager.py
request.py
response.py
__init__.py
connection.py
proxy.py
queue.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
wait.py
__init__.py
labels.py
mklabels.py
tests.py
x_user_defined.py
__init__.py
appdirs.py
__init__.py
_adapters.py
_common.py
_compat.py
_itertools.py
_legacy.py
abc.py
readers.py
simple.py
context.py
functools.py
__init__.py
__init__.py
more.py
recipes.py
__about__.py
__init__.py
_manylinux.py
_musllinux.py
_structures.py
markers.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
actions.py
common.py
core.py
__init__.py
exceptions.py
helpers.py
results.py
testing.py
unicode.py
util.py
zipp.py
__init__.py
METADATA
METADATA
WHEEL
METADATA
__init__.py
exception.py
memory.py
pattern.py
process.py
ptypes.py
__init__.py
advapi32.py
kernel32.py
ntdll.py
psapi.py
structure.py
thread.py
pythoncom.py
License.txt
basictimerapp.py
customprint.py
demoutils.py
dlgappdemo.py
dojobapp.py
helloapp.py
cmdserver.py
createwin.py
demoutils.py
dibdemo.py
dlgtest.py
dyndlg.py
fontdemo.py
guidemo.py
hiertest.py
menutest.py
objdoc.py
flash.py
msoffice.py
ocxserialtest.py
ocxtest.py
webbrowser.py
openGLDemo.py
progressbar.py
sliderdemo.py
splittst.py
threadedgui.py
toolbar.py
__init__.py
__init__.py
configui.py
dbgcon.py
dbgpyapp.py
debugger.py
fail.py
ideoptions.py
list.py
login.py
status.py
DockingBar.py
app.py
bitmap.py
cmdline.py
dbgcommands.py
dlgappcore.py
ModuleBrowser.py
__init__.py
coloreditor.py
configui.py
document.py
editor.py
frame.py
template.py
vss.py
help.py
interact.py
intpyapp.py
intpydde.py
scriptutils.py
sgrepmdi.py
startup.py
stdin.py
toolmenu.py
window.py
winout.py
AutoExpand.py
AutoIndent.py
CallTips.py
FormatParagraph.py
IdleHistory.py
PyParse.py
__init__.py
activex.py
afxres.py
dialog.py
docview.py
object.py
thread.py
window.py
IDLEenvironment.py
__init__.py
bindings.py
config.py
configui.py
control.py
document.py
find.py
formatter.py
keycodes.py
scintillacon.py
view.py
TraceCollector.py
browseProjects.py
browser.py
hierlist.py
regedit.py
regpy.py
METADATA
METADATA
METADATA
__init__.py
__version__.py
_internal_utils.py
_types.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
_deprecation_warning.py
__init__.py
_collections.py
_functools.py
_macos_compat.py
_msvccompiler.py
archive_util.py
bcppcompiler.py
ccompiler.py
cmd.py
__init__.py
_framework_compat.py
bdist.py
bdist_dumb.py
bdist_rpm.py
build.py
build_clib.py
build_ext.py
build_py.py
build_scripts.py
check.py
clean.py
config.py
install.py
install_data.py
install_egg_info.py
install_headers.py
install_lib.py
install_scripts.py
py37compat.py
register.py
sdist.py
upload.py
config.py
core.py
cygwinccompiler.py
debug.py
dep_util.py
dir_util.py
dist.py
errors.py
extension.py
fancy_getopt.py
file_util.py
filelist.py
log.py
msvc9compiler.py
msvccompiler.py
py38compat.py
py39compat.py
spawn.py
sysconfig.py
text_file.py
unixccompiler.py
util.py
version.py
versionpredicate.py
_entry_points.py
_imp.py
_importlib.py
_itertools.py
_path.py
_reqs.py
__init__.py
_adapters.py
_collections.py
_compat.py
_functools.py
_itertools.py
_meta.py
_text.py
functools.py
__init__.py
__init__.py
more.py
recipes.py
ordered_set.py
markers.py
requirements.py
common.cpython-311.pyc
core.cpython-311.pyc
helpers.cpython-311.pyc
__init__.py
_parser.py
_re.py
_types.py
typing_extensions.py
archive_util.py
build_meta.py
__init__.py
alias.py
bdist_egg.py
bdist_rpm.py
build.py
build_clib.py
build_ext.py
build_py.py
develop.py
dist_info.py
easy_install.py
editable_wheel.py
egg_info.py
install.py
install_egg_info.py
install_lib.py
install_scripts.py
py36compat.py
register.py
rotate.py
saveopts.py
sdist.py
setopt.py
test.py
upload.py
upload_docs.py
__init__.py
_apply_pyprojecttoml.py
__init__.py
error_reporting.py
extra_validations.py
fastjsonschema_exceptions.py
fastjsonschema_validations.py
formats.py
expand.py
pyprojecttoml.py
setupcfg.py
dep_util.py
depends.py
discovery.py
dist.py
errors.py
extension.py
__init__.py
glob.py
installer.py
launch.py
logging.py
monkey.py
msvc.py
namespaces.py
package_index.py
py34compat.py
sandbox.py
unicode_utils.py
version.py
wheel.py
windows_support.py
__init__.py
_base_connection.py
_collections.py
_request_methods.py
_version.py
connection.py
connectionpool.py
__init__.py
connection.py
fetch.py
request.py
response.py
pyopenssl.py
socks.py
exceptions.py
fields.py
filepost.py
__init__.py
connection.py
probe.py
poolmanager.py
response.py
__init__.py
connection.py
proxy.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
util.py
wait.py
BackupRead_BackupWrite.py
BackupSeek_streamheaders.py
CopyFileEx.py
CreateFileTransacted_MiniVersion.py
EvtFormatMessage.py
EvtSubscribe_pull.py
EvtSubscribe_push.py
FileSecurityTest.py
GetSaveFileName.py
NetValidatePasswordPolicy.py
OpenEncryptedFileRaw.py
RegCreateKeyTransacted.py
RegRestoreKey.py
SystemParametersInfo.py
setup.py
ddeclient.py
ddeserver.py
desktopmanager.py
eventLogDemo.py
getfilever.py
mmapfile_demo.py
cat.py
runproc.py
print_desktop.py
rastest.py
GetTokenInformation.py
account_rights.py
explicit_entries.py
get_policy_info.py
list_rights.py
localized_names.py
lsaregevent.py
lsastore.py
query_information.py
regsave_sa.py
regsecurity.py
sa_inherit.py
security_enums.py
set_file_audit.py
set_file_owner.py
set_policy_info.py
setkernelobjectsecurity.py
setnamedsecurityinfo.py
setsecurityinfo.py
setuserobjectsecurity.py
fetch_url.py
simple_auth.py
socket_server.py
validate_password.py
nativePipeTestService.py
pipeTestService.py
pipeTestServiceClient.py
serviceEvents.py
timer_demo.py
win32clipboardDemo.py
win32clipboard_bitmapdemo.py
win32comport_demo.py
win32console_demo.py
win32cred_demo.py
win32fileDemo.py
win32gui_demo.py
win32gui_devicenotify.py
win32gui_dialog.py
win32gui_menu.py
win32gui_taskbar.py
win32netdemo.py
win32rcparser_demo.py
win32servicedemo.py
win32ts_logoff_disconnected.py
testwnet.py
winnetwk.py
winprocess.py
_win32verstamp_pywin32ctypes.py
afxres.py
commctrl.py
mmsystem.py
netbios.py
ntsecuritycon.py
pywin32_bootstrap.py
pywin32_testutil.py
pywintypes.py
rasutil.py
regcheck.py
regutil.py
sspi.py
sspicon.py
win2kras.py
win32con.py
win32cryptcon.py
win32evtlogutil.py
win32gui_struct.py
win32inetcon.py
win32netcon.py
win32pdhquery.py
win32pdhutil.py
win32rcparser.py
win32serviceutil.py
win32timezone.py
win32traceutil.py
win32verstamp.py
winerror.py
winioctlcon.py
winnt.py
winperf.py
winxptheme.py
ControlService.py
BrandProject.py
bulkstamp.py
vssutil.py
backupEventLog.py
h2py.py
killProcName.py
rasutil.py
regsetup.py
setup_d.py
handles.py
test_clipboard.py
test_exceptions.py
test_odbc.py
test_pywintypes.py
test_security.py
test_sspi.py
test_win32api.py
test_win32clipboard.py
test_win32cred.py
test_win32crypt.py
test_win32event.py
test_win32file.py
test_win32gui.py
test_win32guistruct.py
test_win32inet.py
test_win32net.py
test_win32pipe.py
test_win32print.py
test_win32profile.py
test_win32rcparser.py
test_win32timezone.py
test_win32trace.py
test_win32ts.py
test_win32wnet.py
testall.py
winxpgui.py
License.txt
__init__.py
CLSIDToClass.py
__init__.py
build.py
combrowse.py
connect.py
dynamic.py
gencache.py
genpy.py
makepy.py
selecttlb.py
tlbrowse.py
util.py
connect.py
dump_clipboard.py
eventsApartmentThreaded.py
eventsFreeThreaded.py
excelAddin.py
excelRTDServer.py
iebutton.py
ietoolbar.py
outlookAddin.py
trybag.py
__init__.py
makegw.py
makegwenum.py
makegwparse.py
olectl.py
__init__.py
connect.py
dispatcher.py
exception.py
factory.py
localserver.py
policy.py
register.py
util.py
PythonTools.py
dictionary.py
interp.py
perfmon.py
test_pycomtest.py
storagecon.py
GenTestScripts.py
__init__.py
daodump.py
errorSemantics.py
pippo_server.py
policySemantics.py
testADOEvents.py
testAXScript.py
testAccess.py
testArrays.py
testClipboard.py
testCollections.py
testConversionErrors.py
testDCOM.py
testDates.py
testDictionary.py
testDynamic.py
testExchange.py
testExplorer.py
testGIT.py
testGatewayAddresses.py
testIterators.py
testMSOffice.py
testMSOfficeEvents.py
testMarshal.py
testPersist.py
testPippo.py
testPyComTest.py
testROT.py
testServers.py
testShell.py
testStorage.py
testStreams.py
testWMI.py
testall.py
testmakepy.py
testvb.py
testvbscript_regexp.py
testxslt.py
util.py
universal.py
util.py
__init__.py
adsicon.py
objectPicker.py
scp.py
search.py
test.py
__init__.py
EditSecurity.py
EditServiceSecurity.py
adb.py
codecontainer.py
contexts.py
debugger.py
documents.py
dump.py
expressions.py
gateways.py
stackframe.py
util.py
asputil.py
__init__.py
debug.py
error.py
framework.py
pydumper.py
pyscript.py
pyscript_rexec.py
scriptdispatch.py
axsite.py
leakTest.py
testHost.py
testHost4Dbg.py
show_all_jobs.py
test_bits.py
__init__.py
ds_record.py
ds_test.py
__init__.py
filterDemo.py
ifiltercon.py
__init__.py
inetcon.py
__init__.py
mapisend.py
emsabtags.py
mapitags.py
mapiutil.py
__init__.py
pscon.py
testpropsys.py
IActiveDesktop.py
IFileOperationProgressSink.py
IShellLinkDataList.py
ITransferAdviseSink.py
IUniformResourceLocator.py
browse_for_folder.py
create_link.py
dump_link.py
explorer_browser.py
column_provider.py
context_menu.py
copy_hook.py
empty_volume_cache.py
folder_view.py
icon_handler.py
shell_view.py
shellexecuteex.py
viewstate.py
walk_shell_folders.py
shellcon.py
testSHFileOperation.py
testShellFolder.py
testShellItem.py
test_addtask.py
test_addtask_1.py
test_addtask_2.py
test_localsystem.py
__init__.py
__init__.py
_winerrors.py
__init__.py
_authentication.py
_common.py
_dll.py
_nl_support.py
_resource.py
_system_information.py
_time.py
_util.py
compat.py
__init__.py
_authentication.py
_common.py
_dll.py
_nl_support.py
_resource.py
_system_information.py
_time.py
_util.py
__init__.py
pywintypes.py
win32api.py
win32cred.py
pywintypes.py
__init__.py
test_backends.py
test_win32api.py
test_win32cred.py
version.py
win32api.py
win32cred.py
__main__.py
__init__.py
pip3.11.exe
pywin32_postinstall.py
pywin32_testall.py
python.exe
Python 3.11.0 (64-bit)_20260712131332_000_core_JustForMe.log
Python 3.11.0 (64-bit)_20260712131332_001_exe_JustForMe.log
Python 3.11.0 (64-bit)_20260712131332_002_dev_JustForMe.log
Python 3.11.0 (64-bit)_20260712131332_003_lib_JustForMe.log
Python 3.11.0 (64-bit)_20260712131332_004_test_JustForMe.log
Python 3.11.0 (64-bit)_20260712131332_005_doc_JustForMe.log
cd.cp311-win_amd64.pyd
LICENSE.txt
LICENSE
LICENSE.md
__PSScriptPolicyTest_zwyususw.m5p.ps1
izshe_q_
dependency_links.txt
pywin32-312-cp311-cp311-win_amd64.whl
pyinstaller-6.21.0-py3-none-win_amd64.whl
urllib3-2.7.0-py3-none-any.whl
pywin32_ctypes-0.2.3-py3-none-any.whl
charset_normalizer-3.4.9-cp311-cp311-win_amd64.whl
pymem-1.14.0-py3-none-any.whl
altgraph-0.17.5-py2.py3-none-any.whl
idna-3.18-py3-none-any.whl
pefile-2024.8.26-py3-none-any.whl
certifi-2026.6.17-py3-none-any.whl
requests-2.34.2-py3-none-any.whl
pyinstaller_hooks_contrib-2026.6-py3-none-any.whl
packaging-26.2-py3-none-any.whl
dearpygui-2.3.1-cp311-cp311-win_amd64.whl
numpy-2.4.6-cp311-cp311-win_amd64.whl
__init__.py
pyMeow.pyd
pyMeow.pyi
pyMeow.so
PKG-INFO
SOURCES.txt
top_level.txt
default.exc
ccba5a5986c77e43.customDestinations-ms
CustomCommands.json
LegitBall.zip.crdownload
install.bat
RobloxPlayerInstaller-XV39BQX6D6.exe
install.bat
python-3.11.0-amd64.exe.crdownload
PythonBA.dll
SideBar.png
launcher_AllUsers
tools_JustForMe
python-3.11.0-amd64.exe
memory/3188-36589-0x0000017F1C590000-0x0000017F1C642000-memory.dmp
memory/3264-36279-0x00000213C2260000-0x00000213C2282000-memory.dmp
memory/3264-36282-0x00000213C22F0000-0x00000213C230E000-memory.dmp
memory/3264-36283-0x00000213DA330000-0x00000213DA3E2000-memory.dmp
memory/3264-36284-0x00000213C2310000-0x00000213C231A000-memory.dmp
memory/6188-36493-0x000001D2FBBA0000-0x000001D2FBBB2000-memory.dmp
memory/6188-36494-0x000001D2FBB80000-0x000001D2FBB8A000-memory.dmp
memory/6692-39153-0x00007FFCBD360000-0x00007FFCBD6A0000-memory.dmp
memory/6692-39152-0x00007FFCBD6A0000-0x00007FFCBEA21000-memory.dmp
memory/6692-39161-0x00007FFCBD360000-0x00007FFCBD6A0000-memory.dmp
memory/6692-39160-0x00007FFCBD6A0000-0x00007FFCBEA21000-memory.dmp
memory/6848-36310-0x0000020AFD1F0000-0x0000020AFD2A2000-memory.dmp