Analysis
- geolocation tags
- user interaction
yes - max time kernel
1379s - max time network
1377s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 09:48
General
- Target README.md
- Size 701B
- Sample260812-ls2m2abh35
- SHA256 7851a7e9ecc27aefe4c8c7f25350df7d471e0392dca4fc7c96e5d067d968682b
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 34 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 32 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 44 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 22 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- cURL User-Agent 2 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\README.md1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd9269c728,0x7ffd9269c734,0x7ffd9269c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1872,i,13631297349075136251,10865217235347244599,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,12962016018146002541,5861770312377053474,262144 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,8610299461996039131,4040974171047215658,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,5061412280703288225,7719742395200616516,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,16716113625786864764,17545588536919389042,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4740,i,2785319465339667496,12923293894654908830,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4932,i,9642592046725212952,13546383129402199807,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,439934633809629801,15435314267139379874,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5520,i,640238180401500175,5762785950801020049,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5536,i,2191939190407704679,8441244829418264122,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5856,i,17788874182194148565,18146944214008344753,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5808,i,14781196161099924589,14281065687039141384,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6116,i,16623824247607710878,2833091118369736841,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6208,i,6729465938223095373,7623492433970602188,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6392,i,1528100162346871164,4137080088747025990,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6344,i,16436845746918121052,3283146172020049345,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6748,i,10025486310595615736,4566945374894556441,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6392,i,7011665261640158751,8066207253063202951,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6604,i,4795429664219415199,4837292041115626494,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6040,i,7415529755335431317,17480223055223981996,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5936,i,18182113744697204030,3540995228334309881,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6592,i,17179368432304238327,8710405914229385274,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6236,i,9659980252659562523,17230221200002633058,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6164,i,18262204625036495892,11131274867867124184,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,8977570698923252093,3921571726742231,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6400,i,15949753827997811807,4151998940838485319,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,12850117126402245009,12389263116265247249,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6340,i,10987879652181726704,11736931498374389916,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7024,i,11508544355440846184,14845677329671872710,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3708,i,4703436338505756853,13956152183727945530,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3712,i,3333099395806704079,16721398119351014536,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6152,i,2629304283008867109,15914101556195799727,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,12483884193492958495,12731461305306877897,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6536,i,9990785681664280360,9103913311071972005,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5744,i,8880262782281831697,11818800454597201869,262144 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6432,i,7417642946451710930,10179067485799743965,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6948,i,10987760311463105157,6351727819269476553,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=5968,i,5923228650277064942,3845630097843257920,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4504,i,14062779100124163297,317230719126804374,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6308,i,14573495196805534140,8337173856905565866,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,5108652578626483002,1947389710245132718,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7400,i,13419999947915646529,822600536487359630,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7516,i,754176589350591527,16373301683539377022,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\python-3.14.7-amd64.exe"C:\Users\Admin\Downloads\python-3.14.7-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{9C6ABB2D-7DF8-4C36-9C38-C365714450EB}\.cr\python-3.14.7-amd64.exe"C:\Windows\Temp\{9C6ABB2D-7DF8-4C36-9C38-C365714450EB}\.cr\python-3.14.7-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.14.7-amd64.exe" -burn.filehandle.attached=756 -burn.filehandle.self=7603⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=4560,i,10487528361750224053,18437316456098990672,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7812,i,13143687917285194007,4631000233439510428,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7628,i,12928871143342937171,12909424239326908260,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7384,i,7284005652214693785,13973650801200647278,524288 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7916,i,7656390158545456708,12205882297466534553,2097152 --field-trial-handle=1904,i,6015429798504133625,920207680713886865,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\curl.execurl -o python_installer.exe https://python.org2⤵
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E439927E9B8D0D30E95BAFEC114B966D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe" -I -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpgq5a9swh\\pip-26.2.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpgq5a9swh', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.14.7 (64-bit)_20260812055344.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.14.7 (64-bit)_20260812055344.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\0ddb59e2-71f3-418c-8773-3039bf4dfac8_Blacktiger-main.zip.ac8\Blacktiger-main\blacktiger.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe "C:\Users\Admin\AppData\Local\Temp\0ddb59e2-71f3-418c-8773-3039bf4dfac8_Blacktiger-main.zip.ac8\Blacktiger-main\blacktiger.py"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\.blacktiger\output\blacktiger_results_20260812_055625.txt1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Windows\system32\curl.execurl -L https://www.python.org/ftp/python/3.11.8/python-3.11.8-amd64.exe -o python_installer.exe2⤵
- Downloads MZ/PE file
-
-
C:\Users\Admin\python_installer.exepython_installer.exe /quiet InstallAllUsers=1 PrependPath=12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{CB06176E-541F-4F5C-99DF-A180C7F57000}\.cr\python_installer.exe"C:\Windows\Temp\{CB06176E-541F-4F5C-99DF-A180C7F57000}\.cr\python_installer.exe" -burn.clean.room="C:\Users\Admin\python_installer.exe" -burn.filehandle.attached=596 -burn.filehandle.self=736 /quiet InstallAllUsers=1 PrependPath=13⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\Temp\{BB96BB4E-8298-49F0-AB9D-CA5522A9A15E}\.be\python-3.11.8-amd64.exe"C:\Windows\Temp\{BB96BB4E-8298-49F0-AB9D-CA5522A9A15E}\.be\python-3.11.8-amd64.exe" -q -burn.elevated BurnPipe.{56D01C68-80D8-4BAF-A199-BBB60AA5B1B6} {A8841A65-970D-44AB-8663-152E00087E42} 39524⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0B64105EDF6BB96419EE8D88D78694CA2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Python311\python.exe"C:\Program Files\Python311\python.exe" -E -s -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Python311\python.exe"C:\Program Files\Python311\python.exe" -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpug3kbx_5\\setuptools-65.5.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpug3kbx_5\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpug3kbx_5', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
-
C:\Users\Admin\AppData\Local\Package Cache\{02717f5c-724f-48a7-86c0-ee11d4de681c}\python-3.11.8-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{02717f5c-724f-48a7-86c0-ee11d4de681c}\python-3.11.8-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{02717f5c-724f-48a7-86c0-ee11d4de681c}\python-3.11.8-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{02717f5c-724f-48a7-86c0-ee11d4de681c}\python-3.11.8-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.11.8 (64-bit)_20260812060035.log" InstallAllUsers=1 PrependPath=12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{02717f5c-724f-48a7-86c0-ee11d4de681c}\python-3.11.8-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{02717f5c-724f-48a7-86c0-ee11d4de681c}\python-3.11.8-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{02717f5c-724f-48a7-86c0-ee11d4de681c}\python-3.11.8-amd64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.11.8 (64-bit)_20260812060035.log" InstallAllUsers=1 PrependPath=13⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Package Cache\{02717f5c-724f-48a7-86c0-ee11d4de681c}\python-3.11.8-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{02717f5c-724f-48a7-86c0-ee11d4de681c}\python-3.11.8-amd64.exe" -q -burn.elevated BurnPipe.{4052AC9D-25FA-4F3D-9F6A-CC9690953F58} {2CE8B85C-8F6D-452A-B464-D736EE85C36B} 56564⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Users\Admin\python_installer.exepython_installer.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{4E000DEF-0072-4C52-92E2-7B3BEEBBE5B8}\.cr\python_installer.exe"C:\Windows\Temp\{4E000DEF-0072-4C52-92E2-7B3BEEBBE5B8}\.cr\python_installer.exe" -burn.clean.room="C:\Users\Admin\python_installer.exe" -burn.filehandle.attached=748 -burn.filehandle.self=5723⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\python_installer.exepython_installer.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{DAF235F1-1E70-46C7-A2F2-77579A0D25FB}\.cr\python_installer.exe"C:\Windows\Temp\{DAF235F1-1E70-46C7-A2F2-77579A0D25FB}\.cr\python_installer.exe" -burn.clean.room="C:\Users\Admin\python_installer.exe" -burn.filehandle.attached=592 -burn.filehandle.self=5883⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\.blacktiger\output\discord_rat.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe "C:\Users\Admin\.blacktiger\output\discord_rat.py"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\Python311\Scripts\pip.exe"C:\Program Files\Python311\Scripts\pip.exe" install pyinstaller2⤵
- Executes dropped EXE
-
C:\Program Files\Python311\python.exe"C:\Program Files\Python311\python.exe" "C:\Program Files\Python311\Scripts\pip.exe" install pyinstaller3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
-
-
C:\Program Files\Python311\Scripts\pyinstaller.exe"C:\Program Files\Python311\Scripts\pyinstaller.exe" --onefile --noconsole 3432⤵
- Executes dropped EXE
-
C:\Program Files\Python311\python.exe"C:\Program Files\Python311\python.exe" "C:\Program Files\Python311\Scripts\pyinstaller.exe" --onefile --noconsole 3433⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
C:\Program Files\Python311\python.exe"C:\Program Files\Python311\python.exe" "C:\Program Files\Python311\Lib\site-packages\PyInstaller\isolated\_child.py" 484 4644⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Program Files\Python311\python.exe"C:\Program Files\Python311\python.exe" "C:\Program Files\Python311\Lib\site-packages\PyInstaller\isolated\_child.py" 652 6484⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Program Files\Python311\python.exe"C:\Program Files\Python311\python.exe" "C:\Program Files\Python311\Lib\site-packages\PyInstaller\isolated\_child.py" 648 6684⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Program Files\Python311\python.exe"C:\Program Files\Python311\python.exe" "C:\Program Files\Python311\Lib\site-packages\PyInstaller\isolated\_child.py" 668 4844⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Program Files\Python311\python.exe"C:\Program Files\Python311\python.exe" "C:\Program Files\Python311\Lib\site-packages\PyInstaller\isolated\_child.py" 648 4644⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5d5932.rbs
e5d5937.rbs
e5d593c.rbs
e5d5941.rbs
e5d5946.rbs
e5d594b.rbs
e5d5950.rbs
e5d5955.rbs
e5d595a.rbs
e63d8a5.rbs
e63d8aa.rbs
e63d8af.rbs
e63d8b4.rbs
e63d8b9.rbs
e63d8bd.rbs
e63d8c1.rbs
e63d8c5.rbs
e63d8c9.rbs
e63d8cd.rbs
e63d8d1.rbs
e63d8d5.rbs
e63d8d9.rbs
e63d8de.rbs
e63d8e2.rbs
e63d8e5.rbs
e63d8e8.rbs
__init__.py
__main__.py
_recursion_too_deep_message.py
_shared_with_waf.py
__init__.py
pyz_crypto.py
readers.py
writers.py
api.py
build_main.py
datastruct.py
icon.py
makespec.py
osx.py
splash.py
splash_templates.py
templates.py
utils.py
compat.py
config.py
configure.py
analysis.py
bindepend.py
bytecode.py
dylib.py
imphook.py
imphookapi.py
utils.py
exceptions.py
__init__.py
_win32.py
qt.py
tempfile.py
pyi_splash.py
hook-PIL.Image.py
hook-PIL.ImageFilter.py
hook-PIL.SpiderImagePlugin.py
hook-PIL.py
hook-PyQt5.Qt.py
hook-PyQt5.Qt3DAnimation.py
hook-PyQt5.QtNetwork.py
hook-PyQt5.QtQml.py
hook-PyQt5.QtWebEngineCore.py
hook-PyQt5.QtWebKitWidgets.py
hook-PyQt5.py
hook-PyQt5.uic.py
hook-PyQt6.Qt3DAnimation.py
hook-PyQt6.Qt3DRender.py
hook-PyQt6.QtGraphs.py
hook-PyQt6.QtGraphsWidgets.py
hook-PyQt6.QtHelp.py
hook-PyQt6.QtNetwork.py
hook-PyQt6.QtQml.py
hook-PyQt6.QtStateMachine.py
hook-PyQt6.QtWebEngineCore.py
hook-PyQt6.py
hook-PyQt6.uic.py
hook-PySide2.QtMultimedia.py
hook-PySide2.QtNetwork.py
hook-PySide2.QtQml.py
hook-PySide2.QtUiTools.py
hook-PySide2.QtWebEngineCore.py
hook-PySide2.Qwt5.py
hook-PySide2.py
hook-PySide6.Qt3DRender.py
hook-PySide6.QtGraphs.py
hook-PySide6.QtGraphsWidgets.py
hook-PySide6.QtHttpServer.py
hook-PySide6.QtMultimedia.py
hook-PySide6.QtNetwork.py
hook-PySide6.QtQml.py
hook-PySide6.QtQuickControls2.py
hook-PySide6.QtWebEngineCore.py
hook-PySide6.QtWebEngineQuick.py
hook-PySide6.py
hook-_ctypes.py
hook-_osx_support.py
hook-_pyi_rth_utils.py
hook-_tkinter.py
hook-babel.py
hook-difflib.py
hook-distutils.command.check.py
hook-distutils.py
hook-distutils.util.py
hook-django.contrib.sessions.py
hook-django.core.cache.py
hook-django.core.mail.py
hook-django.core.management.py
hook-django.db.backends.mysql.base.py
hook-django.db.backends.oracle.base.py
hook-django.db.backends.py
hook-django.py
hook-django.template.loaders.py
hook-encodings.py
hook-gevent.py
hook-gi.py
hook-gi.repository.Adw.py
hook-gi.repository.AppIndicator3.py
hook-gi.repository.Atk.py
hook-gi.repository.AyatanaAppIndicator3.py
hook-gi.repository.Champlain.py
hook-gi.repository.Clutter.py
hook-gi.repository.DBus.py
hook-gi.repository.GIRepository.py
hook-gi.repository.GLib.py
hook-gi.repository.GLibUnix.py
hook-gi.repository.GLibWin32.py
hook-gi.repository.GModule.py
hook-gi.repository.GObject.py
hook-gi.repository.Gdk.py
hook-gi.repository.GdkPixbuf.py
hook-gi.repository.Gio.py
hook-gi.repository.GioUnix.py
hook-gi.repository.GioWin32.py
hook-gi.repository.Graphene.py
hook-gi.repository.Gsk.py
hook-gi.repository.Gst.py
hook-gi.repository.GstAllocators.py
hook-gi.repository.GstApp.py
hook-gi.repository.GstAudio.py
hook-gi.repository.GstBadAudio.py
hook-gi.repository.GstBase.py
hook-gi.repository.GstCheck.py
hook-gi.repository.GstCodecs.py
hook-gi.repository.GstController.py
hook-gi.repository.GstGL.py
hook-gi.repository.GstGLEGL.py
hook-gi.repository.GstGLWayland.py
hook-gi.repository.GstGLX11.py
hook-gi.repository.GstInsertBin.py
hook-gi.repository.GstMpegts.py
hook-gi.repository.GstNet.py
hook-gi.repository.GstPbutils.py
hook-gi.repository.GstPlay.py
hook-gi.repository.GstPlayer.py
hook-gi.repository.GstRtp.py
hook-gi.repository.GstRtsp.py
hook-gi.repository.GstRtspServer.py
hook-gi.repository.GstSdp.py
hook-gi.repository.GstTag.py
hook-gi.repository.GstTranscoder.py
hook-gi.repository.GstVideo.py
hook-gi.repository.GstVulkan.py
hook-gi.repository.GstVulkanWayland.py
hook-gi.repository.GstVulkanXCB.py
hook-gi.repository.GstWebRTC.py
hook-gi.repository.Gtk.py
hook-gi.repository.GtkChamplain.py
hook-gi.repository.GtkClutter.py
hook-gi.repository.GtkSource.py
hook-gi.repository.GtkosxApplication.py
hook-gi.repository.HarfBuzz.py
hook-gi.repository.OsmGpsMap.py
hook-gi.repository.Pango.py
hook-gi.repository.PangoCairo.py
hook-gi.repository.Rsvg.py
hook-gi.repository.Soup.py
hook-gi.repository.Spelling.py
hook-gi.repository.cairo.py
hook-gi.repository.freetype2.py
hook-gi.repository.xlib.py
hook-heapq.py
hook-idlelib.py
hook-importlib_metadata.py
hook-importlib_resources.py
hook-keyring.py
hook-kivy.py
hook-lib2to3.py
hook-math.py
hook-matplotlib.backend_bases.py
hook-matplotlib.backends.backend_qtagg.py
hook-matplotlib.backends.backend_qtcairo.py
hook-matplotlib.backends.py
hook-matplotlib.backends.qt_compat.py
hook-matplotlib.figure.py
hook-matplotlib.numerix.py
hook-matplotlib.py
hook-matplotlib.pyplot.py
hook-multiprocessing.util.py
hook-numpy.py
hook-pandas.io.clipboard.py
hook-pandas.io.formats.style.py
hook-pandas.plotting.py
hook-pandas.py
hook-pickle.py
hook-pkg_resources.py
hook-platform.py
hook-pygments.py
hook-pytz.py
hook-pytzdata.py
hook-qtawesome.py
hook-qtpy.py
hook-scapy.layers.all.py
hook-scipy.io.matlab.py
hook-scipy.linalg.py
hook-scipy.py
hook-scipy.sparse.csgraph.py
hook-scipy.spatial._ckdtree.py
hook-scipy.spatial.transform.rotation.py
hook-scipy.special._ellip_harm_2.py
hook-scipy.special._ufuncs.py
hook-scipy.stats._stats.py
hook-scrapy.py
hook-setuptools._vendor.importlib_metadata.py
hook-setuptools._vendor.jaraco.text.py
hook-setuptools.py
hook-shelve.py
hook-shiboken6.py
hook-sphinx.py
hook-sqlalchemy.py
hook-sqlite3.py
hook-sysconfig.py
hook-wcwidth.py
hook-webbrowser.py
hook-win32ctypes.core.py
hook-xml.dom.domreg.py
hook-xml.etree.cElementTree.py
hook-xml.py
hook-zope.interface.py
hook-PyQt5.uic.port_v2.py
hook-_pyi_rth_utils.py
hook-distutils.py
hook-pyi_splash.py
hook-tkinter.py
hook-backports.py
hook-distutils.py
hook-gi.overrides.py
hook-gi.py
hook-gi.repository.Atk.py
hook-gi.repository.GioUnix.py
hook-gi.repository.GstVideo.py
hook-gi.repository.OsmGpsMap.py
hook-gi.repository.Rsvg.py
hook-gi.repository.Soup.py
hook-importlib_metadata.py
hook-setuptools.extern.six.moves.py
hook-six.moves.py
hook-urllib3.packages.six.moves.py
pyi_rth__tkinter.py
pyi_rth_django.py
pyi_rth_gdkpixbuf.py
pyi_rth_gi.py
pyi_rth_gio.py
pyi_rth_glib.py
pyi_rth_gstreamer.py
pyi_rth_gtk.py
pyi_rth_inspect.py
pyi_rth_kivy.py
pyi_rth_mplconfig.py
pyi_rth_multiprocessing.py
pyi_rth_pkgres.py
pyi_rth_pkgutil.py
pyi_rth_pyqt5.py
pyi_rth_pyqt6.py
pyi_rth_pyside2.py
pyi_rth_pyside6.py
pyi_rth_setuptools.py
__init__.py
_child.py
_parent.py
__init__.py
__main__.py
find_modules.py
modulegraph.py
util.py
pyiboot01_bootstrap.py
pyimod01_archive.py
pyimod02_importers.py
pyimod03_ctypes.py
pyimod04_pywin32.py
log.py
archive_viewer.py
bindepend.py
grab_version.py
makespec.py
set_version.py
conftest.py
__init__.py
conda.py
django.py
gi.py
__init__.py
_modules_info.py
setuptools.py
tcl_tk.py
misc.py
osx.py
run_tests.py
tests.py
icon.py
versioninfo.py
winmanifest.py
winresource.py
winutils.py
__init__.py
override.py
__init__.py
compat.py
__init__.py
hook-tensorflow.py
hook-win32com.py
__init__.py
pyi_rth_cryptography_openssl.py
pyi_rth_enchant.py
pyi_rth_ffpyplayer.py
pyi_rth_findlibs.py
pyi_rth_nltk.py
pyi_rth_osgeo.py
pyi_rth_pygraphviz.py
pyi_rth_pyproj.py
pyi_rth_pyqtgraph_multiprocess.py
pyi_rth_pythoncom.py
pyi_rth_tensorflow.py
pyi_rth_traitlets.py
pyi_rth_usb.py
hook-BTrees.py
hook-CTkMessagebox.py
hook-Crypto.py
hook-Cryptodome.py
hook-HtmlTestRunner.py
hook-IPython.py
hook-OpenGL.py
hook-OpenGL_accelerate.py
hook-PyTaskbar.py
hook-Xlib.py
hook-_mssql.py
hook-_mysql.py
hook-accessible_output2.py
hook-adbc_driver_manager.py
hook-adbutils.py
hook-adios.py
hook-afmformats.py
hook-aliyunsdkcore.py
hook-altair.py
hook-amazonproduct.py
hook-anyio.py
hook-apkutils.py
hook-appdirs.py
hook-appy.pod.py
hook-apscheduler.py
hook-argon2.py
hook-astor.py
hook-astroid.py
hook-astropy.py
hook-astropy_iers_data.py
hook-av.py
hook-avro.py
hook-azurerm.py
hook-backports.py
hook-backports.zoneinfo.py
hook-bacon.py
hook-bcrypt.py
hook-bitsandbytes.py
hook-black.py
hook-bleak.py
hook-blib2to3.py
hook-blspy.py
hook-bokeh.py
hook-boto.py
hook-boto3.py
hook-botocore.py
hook-branca.py
hook-cairocffi.py
hook-cairosvg.py
hook-capstone.py
hook-cassandra.py
hook-celpy.py
hook-certifi.py
hook-cf_units.py
hook-cftime.py
hook-chardet.py
hook-charset_normalizer.py
hook-cloudpickle.py
hook-cloudscraper.py
hook-clr.py
hook-clr_loader.py
hook-cmocean.py
hook-compliance_checker.py
hook-comtypes.client.py
hook-countrycode.py
hook-countryinfo.py
hook-cryptography.py
hook-cumm.py
hook-customtkinter.py
hook-cv2.py
hook-cx_Oracle.py
hook-cytoolz.itertoolz.py
hook-dash.py
hook-dash_bootstrap_components.py
hook-dash_core_components.py
hook-dash_html_components.py
hook-dash_renderer.py
hook-dash_table.py
hook-dash_uploader.py
hook-dask.py
hook-dateparser.py
hook-dateparser.utils.strptime.py
hook-dateutil.py
hook-dbus_fast.py
hook-dclab.py
hook-ddgs.py
hook-discid.py
hook-distorm3.py
hook-distributed.py
hook-dns.rdata.py
hook-docutils.py
hook-docx.py
hook-docx2pdf.py
hook-duckdb.py
hook-dynaconf.py
hook-easyocr.py
hook-eccodeslib.py
hook-eckitlib.py
hook-eel.py
hook-emoji.py
hook-enchant.py
hook-eng_to_ipa.py
hook-ens.py
hook-enzyme.parsers.ebml.core.py
hook-eth_abi.py
hook-eth_account.py
hook-eth_hash.py
hook-eth_keyfile.py
hook-eth_keys.py
hook-eth_rlp.py
hook-eth_typing.py
hook-eth_utils.network.py
hook-eth_utils.py
hook-exchangelib.py
hook-fabric.py
hook-fairscale.py
hook-fake_useragent.py
hook-faker.py
hook-falcon.py
hook-fastparquet.py
hook-fckitlib.py
hook-ffpyplayer.py
hook-fiona.py
hook-flask_compress.py
hook-flask_restx.py
hook-flex.py
hook-flirpy.py
hook-fmpy.py
hook-folium.py
hook-freetype.py
hook-frictionless.py
hook-fsspec.py
hook-gadfly.py
hook-gbulb.py
hook-gcloud.py
hook-geopandas.py
hook-gitlab.py
hook-globus_sdk.py
hook-gmplot.py
hook-gmsh.py
hook-gooey.py
hook-google.api_core.py
hook-google.cloud.bigquery.py
hook-google.cloud.core.py
hook-google.cloud.kms_v1.py
hook-google.cloud.pubsub_v1.py
hook-google.cloud.speech.py
hook-google.cloud.storage.py
hook-google.cloud.translate.py
hook-googleapiclient.model.py
hook-grapheme.py
hook-graphql_query.py
hook-great_expectations.py
hook-gribapi.py
hook-grpc.py
hook-gtk.py
hook-h3.py
hook-h5py.py
hook-hdf5plugin.py
hook-hexbytes.py
hook-httplib2.py
hook-humanize.py
hook-hydra.py
hook-ijson.py
hook-imageio.py
hook-imageio_ffmpeg.py
hook-imagingcontrol4.py
hook-iminuit.py
hook-intake.py
hook-iso639.py
hook-itk.py
hook-jaraco.text.py
hook-jedi.py
hook-jieba.py
hook-jinja2.py
hook-jinxed.py
hook-jira.py
hook-jsonpath_rw_ext.py
hook-jsonrpcserver.py
hook-jsonschema.py
hook-jsonschema_specifications.py
hook-jupyterlab.py
hook-kaleido.py
hook-khmernltk.py
hook-kinterbasdb.py
hook-langchain.py
hook-langchain_classic.py
hook-langcodes.py
hook-langdetect.py
hook-laonlp.py
hook-lark.py
hook-ldfparser.py
hook-lensfunpy.py
hook-libaudioverse.py
hook-librosa.py
hook-lightgbm.py
hook-lightning.py
hook-limits.py
hook-linear_operator.py
hook-lingua.py
hook-litestar.py
hook-llvmlite.py
hook-logilab.py
hook-lxml.etree.py
hook-lxml.isoschematron.py
hook-lxml.objectify.py
hook-lxml.py
hook-lz4.py
hook-magic.py
hook-mako.codegen.py
hook-mariadb.py
hook-markdown.py
hook-mecab.py
hook-metpy.py
hook-migrate.py
hook-mimesis.py
hook-minecraft_launcher_lib.py
hook-mistune.py
hook-mnemonic.py
hook-monai.py
hook-moviepy.audio.fx.all.py
hook-moviepy.video.fx.all.py
hook-mpl_toolkits.basemap.py
hook-msoffcrypto.py
hook-nacl.py
hook-names.py
hook-nanite.py
hook-narwhals.py
hook-nbconvert.py
hook-nbdime.py
hook-nbformat.py
hook-nbt.py
hook-ncclient.py
hook-netCDF4.py
hook-nicegui.py
hook-niquests.py
hook-nltk.py
hook-nnpy.py
hook-notebook.py
hook-numba.py
hook-numbers_parser.py
hook-numcodecs.py
hook-nvidia.cuda_nvcc.py
hook-nvidia.cudnn.py
hook-office365.py
hook-onnxruntime.py
hook-opencc.py
hook-openpyxl.py
hook-opentelemetry.py
hook-orjson.py
hook-osgeo.py
hook-pandas_flavor.py
hook-panel.py
hook-parsedatetime.py
hook-parso.py
hook-passlib.py
hook-paste.exceptions.reporter.py
hook-patoolib.py
hook-patsy.py
hook-pdfminer.py
hook-pendulum.py
hook-phonenumbers.py
hook-pingouin.py
hook-pint.py
hook-pinyin.py
hook-platformdirs.py
hook-plotly.py
hook-plum.py
hook-pointcept.py
hook-pptx.py
hook-prettytable.py
hook-psutil.py
hook-psychopy.py
hook-psycopg2.py
hook-psycopg_binary.py
hook-psycopg_c.py
hook-publicsuffix2.py
hook-pubsub.core.py
hook-puremagic.py
hook-py.py
hook-pyarrow.py
hook-pycountry.py
hook-pycparser.py
hook-pycrfsuite.py
hook-pydantic.py
hook-pydicom.py
hook-pydivert.py
hook-pyecharts.py
hook-pyexcel-io.py
hook-pyexcel-ods.py
hook-pyexcel-ods3.py
hook-pyexcel-odsr.py
hook-pyexcel-xls.py
hook-pyexcel-xlsx.py
hook-pyexcel-xlsxw.py
hook-pyexcel.py
hook-pyexcel_io.py
hook-pyexcel_ods.py
hook-pyexcel_ods3.py
hook-pyexcel_odsr.py
hook-pyexcel_xls.py
hook-pyexcel_xlsx.py
hook-pyexcel_xlsxw.py
hook-pyexcelerate.Writer.py
hook-pygraphviz.py
hook-pygwalker.py
hook-pylibmagic.py
hook-pylint.py
hook-pylsl.py
hook-pymediainfo.py
hook-pymeshlab.py
hook-pymorphy3.py
hook-pymssql.py
hook-pynng.py
hook-pynput.py
hook-pyodbc.py
hook-pyopencl.py
hook-pypdfium2.py
hook-pypdfium2_raw.py
hook-pypemicro.py
hook-pyphen.py
hook-pyppeteer.py
hook-pyproj.py
hook-pypsexec.py
hook-pypylon.py
hook-pyqtgraph.py
hook-pyshark.py
hook-pysnmp.py
hook-pystray.py
hook-pytest.py
hook-pythainlp.py
hook-pythoncom.py
hook-pytokens.py
hook-pyttsx.py
hook-pyttsx3.py
hook-pyviz_comms.py
hook-pyvjoy.py
hook-pywintypes.py
hook-pywt.py
hook-qtmodern.py
hook-radicale.py
hook-raven.py
hook-rawpy.py
hook-rdflib.py
hook-redmine.py
hook-regex.py
hook-reportlab.lib.utils.py
hook-reportlab.pdfbase._fontdata.py
hook-resampy.py
hook-rich.py
hook-rlp.py
hook-rpy2.py
hook-rtree.py
hook-ruamel.yaml.py
hook-sacremoses.py
hook-sam2.py
hook-saml2.py
hook-schwifty.py
hook-seedir.py
hook-selectolax.py
hook-selenium.py
hook-sentry_sdk.py
hook-setuptools_scm.py
hook-shapely.py
hook-shotgun_api3.py
hook-simplemma.py
hook-skimage.color.py
hook-skimage.data.py
hook-skimage.draw.py
hook-skimage.exposure.py
hook-skimage.feature.py
hook-skimage.filters.py
hook-skimage.future.py
hook-skimage.graph.py
hook-skimage.io.py
hook-skimage.measure.py
hook-skimage.metrics.py
hook-skimage.morphology.py
hook-skimage.py
hook-skimage.registration.py
hook-skimage.restoration.py
hook-skimage.segmentation.py
hook-skimage.transform.py
hook-sklearn.cluster.py
hook-sklearn.externals.array_api_compat.cupy.py
hook-sklearn.externals.array_api_compat.dask.array.py
hook-sklearn.externals.array_api_compat.numpy.py
hook-sklearn.externals.array_api_compat.torch.py
hook-sklearn.linear_model.py
hook-sklearn.metrics.cluster.py
hook-sklearn.metrics.pairwise.py
hook-sklearn.metrics.py
hook-sklearn.neighbors.py
hook-sklearn.py
hook-sklearn.tree.py
hook-sklearn.utils.py
hook-skyfield.py
hook-slixmpp.py
hook-sound_lib.py
hook-sounddevice.py
hook-soundfile.py
hook-spacy.py
hook-speech_recognition.py
hook-spiceypy.py
hook-spnego.py
hook-srsly.msgpack._packer.py
hook-sspilib.raw.py
hook-statsmodels.tsa.statespace.py
hook-stdnum.py
hook-storm.database.py
hook-sudachipy.py
hook-sunpy.py
hook-sv_ttk.py
hook-swagger_spec_validator.py
hook-tableauhyperapi.py
hook-tables.py
hook-tcod.py
hook-tensorflow.py
hook-tensorrt_libs.py
hook-text_unidecode.py
hook-textdistance.py
hook-thinc.backends.numpy_ops.py
hook-thinc.py
hook-timezonefinder.py
hook-timm.py
hook-tinycss2.py
hook-tkinterdnd2.py
hook-tkinterweb.py
hook-tkinterweb_tkhtml.py
hook-tkinterweb_tkhtml_extras.py
hook-toga.py
hook-toga_cocoa.py
hook-toga_gtk.py
hook-toga_winforms.py
hook-torch.py
hook-torchaudio.py
hook-torchtext.py
hook-torchvision.io.image.py
hook-torchvision.py
hook-trame.py
hook-trame_client.py
hook-trame_code.py
hook-trame_components.py
hook-trame_datagrid.py
hook-trame_deckgl.py
hook-trame_formkit.py
hook-trame_grid.py
hook-trame_iframe.py
hook-trame_keycloak.py
hook-trame_leaflet.py
hook-trame_markdown.py
hook-trame_matplotlib.py
hook-trame_mesh_streamer.py
hook-trame_plotly.py
hook-trame_pvui.py
hook-trame_quasar.py
hook-trame_rca.py
hook-trame_router.py
hook-trame_simput.py
hook-trame_tauri.py
hook-trame_tweakpane.py
hook-trame_vega.py
hook-trame_vtk.py
hook-trame_vtk3d.py
hook-trame_vtklocal.py
hook-trame_vuetify.py
hook-trame_xterm.py
hook-transformers.py
hook-travertino.py
hook-trimesh.py
hook-triton.py
hook-ttkthemes.py
hook-ttkwidgets.py
hook-tzdata.py
hook-tzwhere.py
hook-u1db.py
hook-ultralytics.py
hook-umap.py
hook-unidecode.py
hook-uniseg.py
hook-urllib3.py
hook-urllib3_future.py
hook-usb.py
hook-uuid6.py
hook-uvicorn.py
hook-uvloop.py
hook-vaderSentiment.py
hook-vtkmodules.vtkCommonColor.py
hook-vtkpython.py
hook-wavefile.py
hook-weasyprint.py
hook-web3.py
hook-webassets.py
hook-webrtcvad.py
hook-websockets.py
hook-webview.py
hook-win32com.py
hook-wordcloud.py
hook-workflow.py
hook-wx.lib.activex.py
hook-wx.lib.pubsub.py
hook-wx.xrc.py
hook-xarray.py
hook-xml.dom.html.HTMLDocument.py
hook-xml.sax.saxexts.py
hook-xmldiff.py
hook-xmlschema.py
hook-xsge_gui.py
hook-xyzservices.py
hook-yapf_third_party.py
hook-z3c.rml.py
hook-zarr.py
hook-zeep.py
hook-zmq.py
__init__.py
mypy.py
nvidia_cuda.py
vtkmodules.py
Dot.py
Graph.py
GraphAlgo.py
GraphStat.py
GraphUtil.py
ObjectGraph.py
__init__.py
__init__.py
oleaut32.py
ws2_32.py
wsock32.py
LICENSE.APACHE
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_ranges.py
_structures.py
_tokenizer.py
dependency_groups.py
direct_url.py
errors.py
__init__.py
_spdx.py
markers.py
metadata.py
pylock.py
ranges.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
pefile.py
peutils.py
METADATA
__init__.py
__main__.py
__pip-runner__.py
__init__.py
build_env.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
metadata_legacy.py
wheel.py
wheel_editable.py
wheel_legacy.py
check.py
freeze.py
__init__.py
editable_legacy.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
encoding.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
models.py
packaging.py
setuptools_build.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
core.py
__init__.py
big5freq.py
big5prober.py
chardistribution.py
charsetgroupprober.py
charsetprober.py
chardetect.py
codingstatemachine.py
codingstatemachinedict.py
cp949prober.py
enums.py
escprober.py
escsm.py
eucjpprober.py
euckrfreq.py
euckrprober.py
euctwfreq.py
euctwprober.py
gb2312freq.py
gb2312prober.py
hebrewprober.py
jisfreq.py
johabfreq.py
johabprober.py
jpcntx.py
langbulgarianmodel.py
langgreekmodel.py
langhebrewmodel.py
langhungarianmodel.py
langrussianmodel.py
langthaimodel.py
langturkishmodel.py
latin1prober.py
macromanprober.py
mbcharsetprober.py
mbcsgroupprober.py
mbcssm.py
languages.py
resultdict.py
sbcharsetprober.py
sbcsgroupprober.py
sjisprober.py
universaldetector.py
utf1632prober.py
utf8prober.py
version.py
__init__.py
ansi.py
ansitowin32.py
initialise.py
__init__.py
ansi_test.py
ansitowin32_test.py
initialise_test.py
isatty_test.py
utils.py
winterm_test.py
win32.py
winterm.py
__init__.py
compat.py
database.py
index.py
locators.py
manifest.py
markers.py
metadata.py
resources.py
scripts.py
util.py
version.py
wheel.py
__init__.py
__main__.py
distro.py
__init__.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
markers.py
requirements.py
__init__.py
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
cmdline.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
bbcode.py
groff.py
html.py
img.py
irc.py
latex.py
other.py
pangomarkup.py
rtf.py
svg.py
terminal.py
terminal256.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
token.py
unistring.py
util.py
__init__.py
actions.py
common.py
core.py
__init__.py
exceptions.py
helpers.py
results.py
unicode.py
util.py
__init__.py
_compat.py
_impl.py
__init__.py
_in_process.py
__init__.py
__version__.py
_internal_utils.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
collections_abc.py
providers.py
reporters.py
resolvers.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
six.py
__init__.py
_asyncio.py
_utils.py
after.py
before.py
before_sleep.py
nap.py
retry.py
stop.py
tornadoweb.py
wait.py
__init__.py
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
typing_extensions.py
__init__.py
_collections.py
_version.py
connection.py
connectionpool.py
_appengine_environ.py
bindings.py
low_level.py
appengine.py
ntlmpool.py
pyopenssl.py
securetransport.py
socks.py
exceptions.py
fields.py
filepost.py
makefile.py
weakref_finalize.py
six.py
poolmanager.py
request.py
response.py
__init__.py
connection.py
proxy.py
queue.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
wait.py
__init__.py
labels.py
mklabels.py
tests.py
x_user_defined.py
__init__.py
appdirs.py
__init__.py
_adapters.py
_common.py
_compat.py
_itertools.py
_legacy.py
abc.py
readers.py
simple.py
context.py
functools.py
__init__.py
__init__.py
more.py
recipes.py
__about__.py
__init__.py
_manylinux.py
_musllinux.py
_structures.py
markers.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
actions.py
common.py
core.py
__init__.py
exceptions.py
helpers.py
results.py
testing.py
unicode.py
util.py
zipp.py
__init__.py
INSTALLERzac6mmki.tmp
__init__.py
_deprecation_warning.py
__init__.py
_collections.py
_functools.py
_macos_compat.py
_msvccompiler.py
archive_util.py
bcppcompiler.py
ccompiler.py
cmd.py
__init__.py
_framework_compat.py
bdist.py
bdist_dumb.py
bdist_rpm.py
build.py
build_clib.py
build_ext.py
build_py.py
build_scripts.py
check.py
clean.py
config.py
install.py
install_data.py
install_egg_info.py
install_headers.py
install_lib.py
install_scripts.py
py37compat.py
register.py
sdist.py
upload.py
config.py
core.py
cygwinccompiler.py
debug.py
dep_util.py
dir_util.py
dist.py
errors.py
extension.py
fancy_getopt.py
file_util.py
filelist.py
log.py
msvc9compiler.py
msvccompiler.py
py38compat.py
py39compat.py
spawn.py
sysconfig.py
text_file.py
unixccompiler.py
util.py
version.py
versionpredicate.py
_entry_points.py
_imp.py
_importlib.py
_itertools.py
_path.py
_reqs.py
__init__.py
_adapters.py
_collections.py
_compat.py
_functools.py
_itertools.py
_meta.py
_text.py
functools.py
__init__.py
__init__.py
more.py
recipes.py
ordered_set.py
markers.py
requirements.py
__init__.py
_parser.py
_re.py
_types.py
typing_extensions.py
archive_util.py
build_meta.py
__init__.py
alias.py
bdist_egg.py
bdist_rpm.py
build.py
build_clib.py
build_ext.py
build_py.py
develop.py
dist_info.py
easy_install.py
editable_wheel.py
egg_info.py
install.py
install_egg_info.py
install_lib.py
install_scripts.py
py36compat.py
register.py
rotate.py
saveopts.py
sdist.py
setopt.py
test.py
upload.py
upload_docs.py
__init__.py
_apply_pyprojecttoml.py
__init__.py
error_reporting.py
extra_validations.py
fastjsonschema_exceptions.py
fastjsonschema_validations.py
formats.py
expand.py
pyprojecttoml.py
setupcfg.py
dep_util.py
depends.py
discovery.py
dist.py
errors.py
extension.py
__init__.py
glob.py
installer.py
launch.py
logging.py
monkey.py
msvc.py
namespaces.py
package_index.py
py34compat.py
sandbox.py
unicode_utils.py
version.py
wheel.py
windows_support.py
__init__.py
__init__.py
_winerrors.py
__init__.py
_authentication.py
_common.py
_dll.py
_nl_support.py
_resource.py
_system_information.py
_time.py
_util.py
compat.py
__init__.py
_authentication.py
_common.py
_dll.py
_nl_support.py
_resource.py
_system_information.py
_time.py
_util.py
__init__.py
pywintypes.py
win32api.py
win32cred.py
pywintypes.py
__init__.py
test_backends.py
test_win32api.py
test_win32cred.py
version.py
win32api.py
win32cred.py
iso2022_jp-utf8.txt
__init__.py
python.exe
BookmarkMergedSurfaceOrdering
f_000006
f_000007
f_000008
f_000009
f_00000a
f_00000b
f_00000c
f_00000d
f_00000e
f_000010
f_000012
f_000013
f_000016
f_000019
f_00001c
f_00001d
f_000021
f_000038
f_000039
f_00003a
f_00003b
f_00003d
f_00003e
f_000040
f_00004c
f_00005b
f_000069
f_000085
f_00009f
f_0000bc
temp-index
temp-index
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
messages.json
craw_background.js
CURRENT
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
7a0cbec571c1b129_0
the-real-index
the-real-index
the-real-index
the-real-index
data_0
data_1
data_2
data_3
MANIFEST-000001
index
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5acc2b.TMP
000003.log
LOG
LOG.old
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
doc_JustForMe
lib_JustForMe
dev.msi
tcltk.msi
core.msi
test.msi
state.rsm
launcher.msi
exe.msi
__init__.py
__main__.py
pip.exe
python.exe
2mm4hjgt
Python 3.14.7 (64-bit)_20260812055344_000_core_JustForMe.log
Python 3.14.7 (64-bit)_20260812055344_001_exe_JustForMe.log
Python 3.14.7 (64-bit)_20260812055344_002_dev_JustForMe.log
Python 3.14.7 (64-bit)_20260812055344_003_lib_JustForMe.log
__PSScriptPolicyTest_ep43szd3.bmx.ps1
packaging-26.3-py3-none-any.whl.metadata
pyinstaller-6.22.0-py3-none-win_amd64.whl.metadata
pefile-2024.8.26-py3-none-any.whl.metadata
pyinstaller_hooks_contrib-2026.6-py3-none-any.whl.metadata
pywin32_ctypes-0.2.3-py3-none-any.whl.metadata
altgraph-0.17.5-py2.py3-none-any.whl.metadata
altgraph-0.17.5-py2.py3-none-any.whl
packaging-26.3-py3-none-any.whl
pefile-2024.8.26-py3-none-any.whl
pyinstaller-6.22.0-py3-none-win_amd64.whl
pyinstaller_hooks_contrib-2026.6-py3-none-any.whl
pywin32_ctypes-0.2.3-py3-none-any.whl
messages.json
default.exc
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
Python-3.14.7.tar.xz.crdownload
python-3.14.7-amd64.exe
python-manager-26.3.msix
e63d8b5.msi
e63d8d2.msi
idle.exe
PythonBA.dll
SideBar.png
pip_JustForMe
BootstrapperApplicationData.xml
Default.thm
python-3.14.7-amd64.exe
PythonBA.dll
Default.wxl
python-3.11.8-amd64.exe
memory/876-5019-0x00000000003C0000-0x000000000044C000-memory.dmp
memory/876-4599-0x00000000003C0000-0x000000000044C000-memory.dmp
memory/4348-1168-0x0000000005CA0000-0x0000000005D06000-memory.dmp
memory/4348-1175-0x00000000709D0000-0x0000000070A1C000-memory.dmp
memory/4348-1165-0x0000000005FE0000-0x000000000662A000-memory.dmp
memory/4348-1166-0x0000000005B90000-0x0000000005BB2000-memory.dmp
memory/4348-1167-0x0000000005C30000-0x0000000005C96000-memory.dmp
memory/4348-1171-0x0000000006630000-0x000000000698B000-memory.dmp
memory/4348-1194-0x0000000007F30000-0x0000000007F38000-memory.dmp
memory/4348-1172-0x0000000005F90000-0x0000000005FAE000-memory.dmp
memory/4348-1188-0x0000000007F40000-0x0000000007F5C000-memory.dmp
memory/4348-1173-0x0000000006990000-0x00000000069DC000-memory.dmp
memory/4348-7643-0x0000000005840000-0x0000000005862000-memory.dmp
memory/4348-7644-0x0000000008F40000-0x00000000094FA000-memory.dmp
memory/4348-1174-0x0000000007B30000-0x0000000007B66000-memory.dmp
memory/4348-1164-0x0000000003220000-0x0000000003256000-memory.dmp
memory/4348-1179-0x0000000006F60000-0x0000000006F80000-memory.dmp
memory/4348-1176-0x0000000070B30000-0x0000000070E8B000-memory.dmp
memory/4348-1180-0x0000000007B80000-0x0000000007C23000-memory.dmp
memory/4348-1181-0x0000000008300000-0x000000000897C000-memory.dmp
memory/4348-1187-0x0000000007F00000-0x0000000007F15000-memory.dmp
memory/4348-1186-0x0000000007EF0000-0x0000000007F00000-memory.dmp
memory/4348-1182-0x0000000007CC0000-0x0000000007CDA000-memory.dmp
memory/4348-1183-0x0000000007D30000-0x0000000007D3A000-memory.dmp
memory/4348-1184-0x0000000007F70000-0x0000000008006000-memory.dmp
memory/4348-1185-0x0000000007ED0000-0x0000000007EE1000-memory.dmp
memory/4640-8201-0x0000000006BE0000-0x0000000006C2C000-memory.dmp
memory/4640-8202-0x0000000007020000-0x0000000007068000-memory.dmp
memory/5164-5012-0x00000000003C0000-0x000000000044C000-memory.dmp
memory/5164-4600-0x00000000003C0000-0x000000000044C000-memory.dmp