Resubmissions
10/08/2026, 12:19
260810-phjk9ayble810/08/2026, 12:11
260810-pc4n8sgr2w810/08/2026, 11:59
260810-n5pkcaszbv810/08/2026, 11:51
260810-n1j43agn4t8Analysis
- user interaction
yes - max time kernel
255s - max time network
257s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
10/08/2026, 12:11
General
- Target https://mega.nz/file/UMUAVBoa#_gkpTLUOiGk3XqUEufmn1_-JFaG2bV9S5OMCWIoAtfY
- Sample260810-pc4n8sgr2w
Score
8/10
Malware Config
Signatures
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Downloads MZ/PE file 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 38 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 3 IoCs
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 61 IoCs
- Suspicious use of SendNotifyMessage 16 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/UMUAVBoa#_gkpTLUOiGk3XqUEufmn1_-JFaG2bV9S5OMCWIoAtfY1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffdbc1ec188,0x7ffdbc1ec194,0x7ffdbc1ec1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,8163190417915745099,14573401359901292927,262144 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,2178335201618763486,6365055336005782856,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,16166807194694773091,6968526927190214353,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,12851957665372310275,6920785327228445556,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,7324548600973088927,15567700598269440678,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,1794290829862421879,18309013272486331417,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4188,i,6303790246798336345,2453391478542806680,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4200,i,9519033418272746910,8024298546476852218,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,1708103219172860129,11215806765892278793,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,2810206592991817690,2695330524004678811,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,6755494155741505651,13672782634090645317,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,16029840903171063878,3469196565616905003,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11403⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,4791901707812692796,2990045823808438110,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,4791901707812692796,2990045823808438110,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,11592371355415540283,5567352080657504976,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,4441143901755012285,5577190033395580491,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:122⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,6462481420786754676,12169390119342773733,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4184,i,12959374475757396959,16684394955024572720,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,7870368080706326447,12595645159885115570,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3484,i,18073651562404243579,12067765072672195466,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,15696769007700355290,5893362111115893630,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,12030050785783545453,16103516003264655598,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,4220518963053632637,6936954747655513957,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,2456231272790043873,3000691134481364150,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7620,i,8853269493538563257,7805224056146245696,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7260,i,17091099006710286053,1574822558222880402,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=2568,i,11266538179764634848,5573753439019699700,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7944,i,10325329227537358675,8000475052877718616,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6956,i,8190001238997478615,1528412226029889813,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8056,i,5730240342011572320,2474901207860336140,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=8120 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7428,i,4543240719914386907,3098726145370793153,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8052,i,16613505211636158212,15107763841679873006,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\python-3.14.7-amd64.exe"C:\Users\Admin\Downloads\python-3.14.7-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{9DA3046D-CD88-40D0-A51C-30748BDA9F45}\.cr\python-3.14.7-amd64.exe"C:\Windows\Temp\{9DA3046D-CD88-40D0-A51C-30748BDA9F45}\.cr\python-3.14.7-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.14.7-amd64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=7323⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8576,i,15292432775630659088,1652384139965075527,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=8856 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5728,i,13088341420697778175,11539852656699590608,262144 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8740,i,14645304573420953242,13033319915934955809,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8024,i,10367648783295723413,10080591076659159929,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=7984 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=6012,i,2058239386471043634,7957454560918705717,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6884,i,5154678218266877511,11452056703653382524,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5664,i,14436614382773181879,3400977128178686475,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5676,i,1410502322885471202,16714049629840192571,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7984,i,669362866399630271,7791272482699700419,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=8700 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=3000,i,17847146770615203323,17862778547530103691,2097152 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7896,i,4408606396424457862,2458566701453224566,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9004,i,14643291422392471576,3519637623224528654,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9076,i,10006470638229209725,6963419066729495821,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=9084 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9268,i,5423801143871127055,2532158742939815867,524288 --field-trial-handle=2236,i,6364635140969938565,16253200056913843280,262144 --variations-seed-version --mojo-platform-channel-handle=9244 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4B3198D29FCB5685327B2F451F10B2742⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe" -I -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpoge5ny17\\pip-26.2.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpoge5ny17', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.14.7 (64-bit)_20260810131300.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=568 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.14.7 (64-bit)_20260810131300.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\GPI.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe "C:\Users\Admin\Downloads\GPI.py"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe"C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe"1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004DC1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e58f81a.rbs
e58f81f.rbs
e58f824.rbs
e58f829.rbs
e58f82e.rbs
e58f833.rbs
e58f837.rbs
e58f83b.rbs
e58f840.rbs
e58f845.rbs
e58f849.rbs
e58f84c.rbs
e58f84f.rbs
e58f852.rbs
e58f855.rbs
5A6896595A9B5FF7A8254147F2B2367B
77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
EF7234CDBB1649702229F955C785C39F
5A6896595A9B5FF7A8254147F2B2367B
77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
EF7234CDBB1649702229F955C785C39F
blocklist
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
f_0000c1
f_0000c2
f_0000c3
f_0000c4
f_0000c5
f_0000c6
f_0000c7
f_0000c8
f_0000c9
f_0000ca
f_0000cb
f_0000cc
f_0000cd
f_0000ce
f_0000cf
f_0000d0
f_0000d2
f_0000d3
f_0000d4
f_0000d5
f_0000d8
f_0000d9
f_0000da
f_0000db
f_0000dc
f_0000e2
f_0000e3
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58824a.TMP
SiteList-Enterprise.json
Edge Profile.ico
MANIFEST-000001
CURRENT
MANIFEST-000001
7e20c84b-3d7f-4b38-af11-5cd425b01065.tmp
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe58dcaf.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe58c81d.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a8241.TMP
index.txt
index.txt
index.txt
the-real-index
the-real-index
the-real-index~RFe588a0b.TMP
sync_diagnostic.log
25331c19-86dc-4c0d-88f1-4c7584138d15.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe596623.TMP
caaebbf1-3ba0-4182-847f-9d596f4076ca.tmp
doc_JustForMe
lib_JustForMe
dev.msi
tcltk.msi
core.msi
test.msi
state.rsm
launcher.msi
exe.msi
LICENSE.APACHE
LICENSE
__init__.py
__main__.py
__pip-runner__.py
__init__.py
__init__.py
base.py
installer.py
noop.py
venv.py
virtual.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
index_command.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
lock.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
release_control.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
wheel.py
wheel_editable.py
check.py
freeze.py
__init__.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
pep723.py
req_dependency_group.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
packaging.py
pylock.py
retry.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
core.py
__init__.py
compat.py
resources.py
scripts.py
util.py
__init__.py
__main__.py
distro.py
__init__.py
__main__.py
cli.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
dependency_groups.py
direct_url.py
errors.py
__init__.py
_spdx.py
markers.py
metadata.py
pylock.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
__init__.py
__main__.py
_xdg.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
_mapping.py
token.py
unistring.py
util.py
__init__.py
_impl.py
__init__.py
_in_process.py
__init__.py
__version__.py
_internal_utils.py
_types.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
providers.py
reporters.py
__init__.py
abstract.py
criterion.py
exceptions.py
resolution.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
__init__.py
_parser.py
_re.py
_types.py
__init__.py
_writer.py
__init__.py
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
__init__.py
_base_connection.py
_collections.py
_request_methods.py
_version.py
connection.py
connectionpool.py
__init__.py
connection.py
fetch.py
request.py
response.py
pyopenssl.py
socks.py
exceptions.py
fields.py
filepost.py
__init__.py
connection.py
probe.py
poolmanager.py
response.py
__init__.py
connection.py
proxy.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
util.py
wait.py
__init__.py
__main__.py
pip3.14.exe
python.exe
Python 3.14.7 (64-bit)_20260810131300_000_core_JustForMe.log
Python 3.14.7 (64-bit)_20260810131300_001_exe_JustForMe.log
Python 3.14.7 (64-bit)_20260810131300_002_dev_JustForMe.log
Python 3.14.7 (64-bit)_20260810131300_003_lib_JustForMe.log
Python 3.14.7 (64-bit)_20260810131300_004_test_JustForMe.log
Python 3.14.7 (64-bit)_20260810131300_005_doc_JustForMe.log
GPI.py:Zone.Identifier
python-3.14.7-amd64.exe
python-3.14.7-amd64.exe:Zone.Identifier
salinewin1.5.zip
PythonBA.dll
SideBar.png
pip_JustForMe
python-3.14.7-amd64.exe