Analysis
- user interaction
yes - max time kernel
1048s - max time network
1051s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
03/10/2026, 12:20
General
- Target Texto.txt
- Size 14KB
- Sample261003-ph9sfayblc
- SHA256 f278a718d38b93a17cfc197f30c1bf31521ed7ffa18c16bf80a5d995a7c0fdf1
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 16 IoCs
- Loads dropped DLL 46 IoCs
- Suspicious clipboard content. 1 IoCs
A suspicious script was copied to clipboard.
- Adds Run key to start application 2 TTPs 2 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 61 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 5 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 15 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 54 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Texto.txt1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff84c07c188,0x7ff84c07c194,0x7ff84c07c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,9221865977339494942,14359203194801499531,262144 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,3962687399278100881,3180393292673584272,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,14377729186824207600,3996122131162318324,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,12076954343580139722,17533720941092631304,2097152 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,9201960481463100070,5369809499049174175,2097152 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,15222777758385521842,16473218429199310898,2097152 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,2220001285479271021,8060863833418404434,2097152 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,12005190056741593273,11599495772661672910,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,15135201044733758380,4408345965594633387,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,2509211299424707443,2024670765041125708,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,11054741299996582523,219583336216854974,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,18164360910450500781,12953568911301955187,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,18164360910450500781,12953568911301955187,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,14776423272746631987,10892906021923335315,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,14955065726010266652,10130462013010674641,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,15877172825992993230,11758829254919801460,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,8628130654551500561,17559627331991016136,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,16365197814097123078,9383559325118889174,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6424,i,16701570849701311722,15257715592988539626,2097152 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,3516634234816679597,7249549991225505007,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=556 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,9365068462804934665,11986629400940039726,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,3603797201741256100,9262152391775433507,524288 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6108,i,8084839780536657245,1627046745565359605,2097152 --field-trial-handle=2312,i,18084376315983482204,11941460454011842611,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:13⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Suspicious clipboard content.
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff84c2ac728,0x7ff84c2ac734,0x7ff84c2ac7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,12103844122816573291,13943129166766164182,262144 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1996 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,2219183997220416040,3371597955230615502,524288 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1952 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,11255436496707667786,7024403334300924244,524288 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2576 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,1065933809807351884,14311719798515923495,2097152 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,10323737544210813782,4419782306934731599,2097152 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,1927893769346488597,7865524695333342333,2097152 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4476 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,5918806214997088384,624029578931302080,2097152 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,4799883100019346347,9931960855768110559,524288 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5544 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5828,i,8873342619611605785,4416730561326046807,2097152 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5896 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3276,i,993430153848059034,7249931514027652031,524288 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3320 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3228,i,13696171629720710657,3131221967512656112,524288 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5920 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3296,i,12277318168999808731,16325726318150169089,524288 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3428 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3324,i,11354079781095970814,14009158927975616180,2097152 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3380 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,17845744240308197318,13516870511702067498,524288 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4508 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3256,i,13604959171015761593,4929266996942399209,524288 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3388 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=1220,i,17180728582760778080,6949864664706612035,2097152 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5880 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5832,i,6758399307519621901,13889036734655315447,2097152 --field-trial-handle=2000,i,7850660282288338593,8902850700294326934,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ff84c07c188,0x7ff84c07c194,0x7ff84c07c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,5472101081387448216,8544692129580641415,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,5323630850791228539,6784052711293061791,262144 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,7292345142847320531,4131698970873404466,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13918406783652591235,1970135289564172442,2097152 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,16385373261302470504,4610233958708771874,2097152 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,13277841629881593213,12237631375034918671,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,15452288430600872077,17081238770872889485,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,48019282948682828,4322321237190671221,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,48019282948682828,4322321237190671221,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6328,i,13650463609810690871,16351648242154278034,2097152 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6620,i,7981431701696512395,2897862006213548757,2097152 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,8136864949588199595,569464446495822100,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,11660268096821014888,1214767809022148829,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,770288749885709690,13830378337469226513,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,9153921811444334104,7755297629646123802,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,10136496813406498688,1642085175036157645,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,2556117493734264024,8871973171407406598,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,9371345709850813295,4713077886843531451,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,571518294564774065,15217308643294501192,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5532,i,7065202629744403440,10933862037564390701,262144 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,4934846785299728630,7962381398925437813,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3240,i,884257414551512294,10246457575081778857,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,16505133494681305945,1414682116417945283,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=1536 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,1857646859200442422,12030226165715069540,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,5402049686040376128,13990552154369044187,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,4369245885043554825,5277231057927459265,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,39624478654010240,2613890467354898681,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6904,i,1667613160181650526,12314998942852269127,2097152 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5524,i,1738619285475794887,6031854817010643070,2097152 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,6917468980173123899,1117554985049560854,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,4781103392275311361,13133898896476607397,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7152,i,16665964527137975181,14217360916373432040,2097152 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7684,i,10036923607302338037,12157360967813770657,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\python-3.14.8-amd64.exe"C:\Users\Admin\Downloads\python-3.14.8-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{38727DD4-D54B-442D-A4B8-EA2C730E994A}\.cr\python-3.14.8-amd64.exe"C:\Windows\Temp\{38727DD4-D54B-442D-A4B8-EA2C730E994A}\.cr\python-3.14.8-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.14.8-amd64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=7003⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Downloads\python-3.14.8-amd64.exe"C:\Users\Admin\Downloads\python-3.14.8-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{45F97372-0AB1-41BF-8AA8-0BF807FA897D}\.cr\python-3.14.8-amd64.exe"C:\Windows\Temp\{45F97372-0AB1-41BF-8AA8-0BF807FA897D}\.cr\python-3.14.8-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.14.8-amd64.exe" -burn.filehandle.attached=692 -burn.filehandle.self=7003⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Downloads\python-3.14.8-amd64.exe"C:\Users\Admin\Downloads\python-3.14.8-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{FEAC550F-ECFC-4DED-A046-2C94E7920FD1}\.cr\python-3.14.8-amd64.exe"C:\Windows\Temp\{FEAC550F-ECFC-4DED-A046-2C94E7920FD1}\.cr\python-3.14.8-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.14.8-amd64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=6963⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7772,i,3859005265125057153,4788637011822950929,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,2836349535778373400,158061093307687482,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\python-3.14.8-amd64.exe"C:\Users\Admin\Downloads\python-3.14.8-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{35FDC66E-0216-49E3-BD27-14BE679A474A}\.cr\python-3.14.8-amd64.exe"C:\Windows\Temp\{35FDC66E-0216-49E3-BD27-14BE679A474A}\.cr\python-3.14.8-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.14.8-amd64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=7003⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\Temp\{B393071A-FC0E-4585-8713-8691D6ADA5D9}\.be\python-3.14.8-amd64.exe"C:\Windows\Temp\{B393071A-FC0E-4585-8713-8691D6ADA5D9}\.be\python-3.14.8-amd64.exe" -q -burn.elevated BurnPipe.{A26C7A4A-B291-4E79-AEAF-2D9FD62DAE04} {82EA0B9B-B75E-42FF-9B19-6A291339A267} 45444⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7896,i,8761021822206728622,6187518781913974118,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7372,i,2122002321638825048,2637225828113077682,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,16481613367918885342,5095698755698777413,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7268,i,10033591480404844,7908607432364854890,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7744,i,16188660929313410843,1976175048252078947,524288 --field-trial-handle=2172,i,5984730917514389972,17331572949751922649,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ff84c07c188,0x7ff84c07c194,0x7ff84c07c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,10497183802641878871,4686116967260404171,524288 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,10033882737377975637,1195100457188241101,262144 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,1700075981871015473,12478119218875532791,524288 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,6191158016271296286,5269407275396246183,524288 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,6191158016271296286,5269407275396246183,524288 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4820,i,5911520909599965206,11500213828113189841,2097152 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,16221768886099897275,3931752215145918621,524288 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,16747401258209904271,11076680223215094690,524288 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5552,i,7769864806318303742,18346022034381294696,2097152 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,4606042683971403974,17057316094088702486,524288 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,15227234768894357295,13074109340701046365,524288 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,6139729872297560185,18213399867927997412,524288 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,16201688801765780058,8304564638483672655,524288 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,5403631366829448809,7593769021028377086,524288 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,14394190166253741051,6933030737164594848,524288 --field-trial-handle=2264,i,17149776704320935146,18387552820667425511,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault7c4fd445hecd7h4051h871ahf103a10a0ee91⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Texto.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\InstallDisconnect.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84c2ac728,0x7ff84c2ac734,0x7ff84c2ac7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,17700914301819339041,17313727252268977527,262144 --field-trial-handle=1988,i,9258621592149744984,11658555119571026653,262144 --variations-seed-version=20261002-170206.331000-production --mojo-platform-channel-handle=1984 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,9724127440232662499,16616557277421658687,524288 --field-trial-handle=1988,i,9258621592149744984,11658555119571026653,262144 --variations-seed-version=20261002-170206.331000-production --mojo-platform-channel-handle=2240 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,17365848356423316892,10580873483071053503,524288 --field-trial-handle=1988,i,9258621592149744984,11658555119571026653,262144 --variations-seed-version=20261002-170206.331000-production --mojo-platform-channel-handle=2548 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,12849373386244755193,2075027255718227856,2097152 --field-trial-handle=1988,i,9258621592149744984,11658555119571026653,262144 --variations-seed-version=20261002-170206.331000-production --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,11476617507938758674,3307359624676593917,2097152 --field-trial-handle=1988,i,9258621592149744984,11658555119571026653,262144 --variations-seed-version=20261002-170206.331000-production --mojo-platform-channel-handle=3292 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4564,i,15536549784887007716,3409374351557982028,2097152 --field-trial-handle=1988,i,9258621592149744984,11658555119571026653,262144 --variations-seed-version=20261002-170206.331000-production --mojo-platform-channel-handle=4544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D21CFAF55A26214010176C98C9DD774F2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe" -I -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpuxp8cwat\\pip-26.2.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpuxp8cwat', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
-
-
C:\Users\Admin\AppData\Local\Package Cache\{2528e662-d535-44b5-82ab-3b0cd1175719}\python-3.14.8-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{2528e662-d535-44b5-82ab-3b0cd1175719}\python-3.14.8-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{2528e662-d535-44b5-82ab-3b0cd1175719}\python-3.14.8-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{2528e662-d535-44b5-82ab-3b0cd1175719}\python-3.14.8-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{2528e662-d535-44b5-82ab-3b0cd1175719}\python-3.14.8-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{2528e662-d535-44b5-82ab-3b0cd1175719}\python-3.14.8-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{2528e662-d535-44b5-82ab-3b0cd1175719}\python-3.14.8-amd64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=5403⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\py.exe"C:\Windows\py.exe" "C:\Users\Admin\Desktop\Texto.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe "C:\Users\Admin\Desktop\Texto.py"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e64165d.rbs
e641662.rbs
e641667.rbs
e64166c.rbs
e641671.rbs
e641676.rbs
e64167b.rbs
e641680.rbs
e641685.rbs
e64168a.rbs
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Social
Staging
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Social
Staging
crs.pb
ct_config.pb
kp_pinslist.pb
crl-set
LICENSE
verified_contents.json
sets.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
regex_patterns.json
v1FieldTypes.json
automation.js
classification.js
extraction.js
travel-facilitated-booking-bing.js
travel-facilitated-booking-kayak.js
nav_config.json
arbitration_metadata.txt
verified_contents.json
keys.json
protocols.json
deny_domains.list
deny_etld1_domains.list
deny_full_domains.list
manifest.json
llm_user_input_extractor_config.json
office_endpoints_list.json
smart_switch_list.json
domain_actions.dll
verified_contents.json
safety_tips.pb
typosquatting_list.pb
69441d1c-00e7-4887-ae5b-1a6b1b471848.tmp
8b3acde3-f737-4a30-8431-bfc767274674.tmp
901c9de9-f347-4b59-ac4a-6b33ddae378f.tmp
9e600885-e1fb-42ab-a2ff-c1676094a2fa.tmp
settings.dat
1136c7d6-f497-4bcf-8d80-d74ee461cdc5.tmp
3f2351f9-71e4-4085-8a32-0349eb25e767.tmp
42a83a6d-8ee3-47b6-89e1-b9b4eb33d486.tmp
98d95630-7bc4-45e1-a493-e2d9288f135a.tmp
data_0
f_000007
f_000015
f_00001b
f_00001e
temp-index
07f5cbed-c6f6-4abd-80ee-6c2910ce5e14.tmp
5bf4e5ee-a8be-4719-a552-1bb3f8f6ba5b.tmp
6041a671-1cda-4e6a-b515-0088a02ef344.tmp
a5cc5980-3e11-4871-a457-0baee984ecca.tmp
f4778c1f-54b5-4cbc-97e0-052dc4f0899a.tmp
Preferences
temp-index
the-real-index
temp-index
index.txt
index.txt.tmp
index.txt.tmp
index.txt.tmp
CURRENT
a89811f7-9ab0-44ce-b915-126f9797a8b9.tmp
c12927da-24a5-4c05-bbec-1e9f8332d6c3.tmp
edec5cc2-f5f5-453b-9d0f-47d002c81622.tmp
fc9db083-9442-4bd5-a0e4-4eb8cb856f77.tmp
f63da305-44c2-4319-81ee-ab6646e75890.tmp
010f274c-e957-4dba-81f7-1095109f5cd0.tmp
092ac186-0d9c-4fd1-8ebf-00cdedd37d64.tmp
0b50aafc-de11-4193-b516-219639cbbecd.tmp
1b506e47-cdd4-4214-b15e-14683c1685c6.tmp
1fce1568-dd46-499b-bffa-2af4f69bb841.tmp
22dd4979-e23b-40c5-9717-48401fbdb69b.tmp
4955c421-02df-4117-80d4-20a70e935c90.tmp
4eb8bde8-244e-4bbb-8ea0-b5a483b409e1.tmp
6bc828fb-97d0-41d5-b726-8de79784b67d.tmp
95fbfa96-8c9d-41b9-9e5f-b6b841704f57.tmp
70f6c45b-f653-4d26-95c2-03665d366b96.tmp
manifest.json
manifest.json
manifest.json
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
04794b24-d0b4-4363-a131-6289cb3ae8cd.tmp
1b18746c-41d0-4e03-a6e4-8a9efa24e2c5.tmp
1ff803b7-6f95-44e8-898e-e60cf7d27b7e.tmp
30e0ed28-ce6c-4a7b-824f-5877f40d640a.tmp
4e8c7a46-23e4-4827-b775-ac5d2b656153.tmp
7902e557-3510-44d3-b147-49064a504270.tmp
8210b6ad-7fba-42fc-b62c-f1a0c1f2585e.tmp
8beb4d04-5254-42fe-876a-957163fc50d5.tmp
8e886c33-4dfa-4d93-80e3-9d7c4b3ca671.tmp
LOG
LOG.old
LOG.old
f_00005c
f_00005d
f_00005f
f_000060
f_00006a
f_00006c
f_000073
f_000074
f_000078
f_000081
f_00008b
f_00009f
f_0000a0
f_0000a1
f_0000a2
f_0000a3
f_0000a9
f_0000ae
f_0000b6
f_0000ba
f_0000bb
f_0000c6
f_0000e2
f_0000e3
temp-index
temp-index
temp-index
temp-index
temp-index
the-real-index
0abdc9d0-e477-4c0f-a6b7-1e4c13c9572e.tmp
dasherSettingSchema.json
computed_hashes.json
verified_contents.json
Favicons
data_1
History
000003.log
LOG
09dcc755-ca71-46a8-8073-1bffcc4a94db.tmp
1aeb1d0f-a1a5-4365-bacb-3b539ea7bee6.tmp
287b8e17-852f-4f41-a541-4e1caa79aebc.tmp
2c68618e-de0d-4efe-be63-4d4a916bea1e.tmp
31c02771-ebdd-465c-9c7f-64dc7936fc94.tmp
4452947a-e182-4726-981f-23c015594b91.tmp
45b301a8-faaf-45ca-9039-39f0621ed218.tmp
4d5883c1-8e43-42ab-a19d-e57e2f40c91c.tmp
5603e3f4-2c4f-43ee-aef3-0e4e3e0472dc.tmp
58250b07-e3d6-46b2-82a0-bad7efababb1.tmp
7b638fa7-a483-47f9-a5a6-5b6462858990.tmp
86cdf48a-0f68-4328-9968-d4698506e391.tmp
9d778673-f86d-4924-afad-222b93763861.tmp
Sdch Dictionaries
e03ff762-765d-4fb5-bbe7-f6a4c600beea.tmp
f34adf75-c147-40a3-a736-c5320e144395.tmp
index
temp-index
the-real-index
temp-index
temp-index
the-real-index
temp-index
the-real-index
623cd082b6202da0_0
temp-index
temp-index
the-real-index
temp-index
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
000003.log
LOG
temp-index
the-real-index
000007.ldb
Tabs_13435503911186803
000003.log
LOG
000003.log
LOG
sync_diagnostic.log
b96c995c-eb0b-48cb-88f3-2ec6a719d2ef.tmp
ba0b06f2-e237-40ac-999e-3cc576c04bc9.tmp
c6a1eb1d-2660-4bb5-81f8-c98c68b6d8f6.tmp
ddf97470-bc06-4887-94b4-7fa6280f4218.tmp
df9a1b93-35fe-4a55-99b9-e464bc034152.tmp
dfce3f7e-f2c2-4e08-88ba-4f59e66baf2f.tmp
e8f7e7c6-c760-4b74-86b1-ea8a22bfddca.tmp
load_statistics.db
manifest.json
data.txt
manifest.json
9ec6f16b-8b5e-4111-a217-e163fc2d3b3e.tmp
OperationConfig
manifest.json
manifest.json
manifest.json
manifest.json
data_1
Last Version
Local State
campaign_history
manifest.json
RevisitationBloomfilter
manifest.json
data_1
Other
manifest.json
manifest.json
Variations
Variations
manifest.json
manifest.json
a3716425-0f75-43cd-84cb-236ad4a7dd79.tmp
a817ee7f-ed61-450c-86c2-756657f1e791.tmp
b1c39832-3949-4d74-8fc5-df07ab58831a.tmp
b716cf83-c050-4b96-bf20-0aaabedebdf5.tmp
c404c40f-2011-4f1b-bad4-eb11b7219ba9.tmp
cadcf249-fab6-43b4-82b8-f110d152e564.tmp
ce0457d9-f42a-47da-be2f-005b10446a19.tmp
003675e5-b603-44e0-be00-db9031c433f8.tmp
056d2438-8309-455c-b79b-6d110cf0f166.tmp
0bd8d8b8-6d56-4146-bddc-42383a95c0c9.tmp
2b3e4452-9b82-4237-b8fe-ca8d54d3e1a7.tmp
4131bb85-9462-4a73-a172-856dea3f3d70.tmp
5fb3e6f6-3be8-4088-8b15-04a1c3c90d89.tmp
88950a71-0eb1-4dfa-938c-6a2a3d7ce9a3.tmp
9146a0a7-af89-4712-a94d-6e1ca8666538.tmp
ba8c038a-87d1-4266-929e-8bcbd87166ba.tmp
d002a5c0-9ebe-4342-a2a4-70e85776b576.tmp
d683182d-c0ad-4fa6-a5ed-8446c5e61f61.tmp
e3e479f2-c76b-4044-80cf-a29557a61d2d.tmp
efc4dc06-40a4-4edb-8843-cce9364a75b4.tmp
f1f4e17b-059f-42f5-bbae-504def28bea8.tmp
f42f66a1-9055-474c-94b5-1a85a63e11ca.tmp
de97cf95-ee5e-4fe8-9d98-c8bce47c95e8.tmp
e2c2cb1b-5fdb-4e29-af4f-331a68ff6c85.tmp
4d3ceb6a-ca7c-4090-aa5a-a4cb55f3f1f6.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
doc_JustForMe
lib_JustForMe
tcltk_JustForMe
INSTALLER
RECORD
LICENSE
LICENSE
__init__.py
__main__.py
__pip-runner__.py
__init__.cpython-314.pyc
__main__.cpython-314.pyc
__pip-runner__.cpython-314.pyc
__init__.py
__init__.cpython-314.pyc
cache.cpython-314.pyc
configuration.cpython-314.pyc
exceptions.cpython-314.pyc
main.cpython-314.pyc
pyproject.cpython-314.pyc
self_outdated_check.cpython-314.pyc
wheel_builder.cpython-314.pyc
__init__.py
__init__.cpython-314.pyc
base.cpython-314.pyc
installer.cpython-314.pyc
noop.cpython-314.pyc
venv.cpython-314.pyc
virtual.cpython-314.pyc
base.py
installer.py
noop.py
venv.py
virtual.py
cache.py
__init__.py
__init__.cpython-314.pyc
autocompletion.cpython-314.pyc
base_command.cpython-314.pyc
cmdoptions.cpython-314.pyc
command_context.cpython-314.pyc
index_command.cpython-314.pyc
main.cpython-314.pyc
main_parser.cpython-314.pyc
parser.cpython-314.pyc
progress_bars.cpython-314.pyc
req_command.cpython-314.pyc
spinners.cpython-314.pyc
status_codes.cpython-314.pyc
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
index_command.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
__init__.cpython-314.pyc
cache.cpython-314.pyc
check.cpython-314.pyc
completion.cpython-314.pyc
configuration.cpython-314.pyc
debug.cpython-314.pyc
download.cpython-314.pyc
freeze.cpython-314.pyc
hash.cpython-314.pyc
help.cpython-314.pyc
index.cpython-314.pyc
inspect.cpython-314.pyc
install.cpython-314.pyc
list.cpython-314.pyc
lock.cpython-314.pyc
search.cpython-314.pyc
show.cpython-314.pyc
uninstall.cpython-314.pyc
wheel.cpython-314.pyc
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
lock.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
__init__.cpython-314.pyc
base.cpython-314.pyc
installed.cpython-314.pyc
sdist.cpython-314.pyc
wheel.cpython-314.pyc
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
__init__.cpython-314.pyc
collector.cpython-314.pyc
package_finder.cpython-314.pyc
sources.cpython-314.pyc
collector.py
package_finder.py
sources.py
__init__.py
__init__.cpython-314.pyc
_distutils.cpython-314.pyc
_sysconfig.cpython-314.pyc
base.cpython-314.pyc
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
__init__.cpython-314.pyc
_json.cpython-314.pyc
base.cpython-314.pyc
pkg_resources.cpython-314.pyc
_json.py
base.py
__init__.py
__init__.cpython-314.pyc
_compat.cpython-314.pyc
_dists.cpython-314.pyc
_envs.cpython-314.pyc
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
__init__.cpython-314.pyc
candidate.cpython-314.pyc
direct_url.cpython-314.pyc
format_control.cpython-314.pyc
index.cpython-314.pyc
installation_report.cpython-314.pyc
link.cpython-314.pyc
release_control.cpython-314.pyc
scheme.cpython-314.pyc
search_scope.cpython-314.pyc
selection_prefs.cpython-314.pyc
target_python.cpython-314.pyc
wheel.cpython-314.pyc
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
release_control.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
__init__.cpython-314.pyc
auth.cpython-314.pyc
cache.cpython-314.pyc
download.cpython-314.pyc
lazy_wheel.cpython-314.pyc
session.cpython-314.pyc
utils.cpython-314.pyc
xmlrpc.cpython-314.pyc
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
__init__.cpython-314.pyc
check.cpython-314.pyc
freeze.cpython-314.pyc
prepare.cpython-314.pyc
__init__.cpython-314.pyc
build_tracker.cpython-314.pyc
metadata.cpython-314.pyc
metadata_editable.cpython-314.pyc
wheel.cpython-314.pyc
wheel_editable.cpython-314.pyc
build_tracker.py
metadata.py
metadata_editable.py
wheel.py
wheel_editable.py
check.py
freeze.py
__init__.py
__init__.cpython-314.pyc
wheel.cpython-314.pyc
wheel.py
prepare.py
pyproject.py
__init__.py
__init__.cpython-314.pyc
constructors.cpython-314.pyc
pep723.cpython-314.pyc
req_dependency_group.cpython-314.pyc
req_file.cpython-314.pyc
req_install.cpython-314.pyc
req_set.cpython-314.pyc
req_uninstall.cpython-314.pyc
constructors.py
pep723.py
req_dependency_group.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
__init__.cpython-314.pyc
base.cpython-314.pyc
base.py
__init__.cpython-314.pyc
resolver.cpython-314.pyc
resolver.py
__init__.cpython-314.pyc
base.cpython-314.pyc
candidates.cpython-314.pyc
factory.cpython-314.pyc
found_candidates.cpython-314.pyc
provider.cpython-314.pyc
reporter.cpython-314.pyc
requirements.cpython-314.pyc
resolver.cpython-314.pyc
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
__init__.cpython-314.pyc
_jaraco_text.cpython-314.pyc
_log.cpython-314.pyc
appdirs.cpython-314.pyc
compat.cpython-314.pyc
compatibility_tags.cpython-314.pyc
datetime.cpython-314.pyc
deprecation.cpython-314.pyc
direct_url_helpers.cpython-314.pyc
egg_link.cpython-314.pyc
entrypoints.cpython-314.pyc
filesystem.cpython-314.pyc
filetypes.cpython-314.pyc
glibc.cpython-314.pyc
hashes.cpython-314.pyc
logging.cpython-314.pyc
misc.cpython-314.pyc
packaging.cpython-314.pyc
pylock.cpython-314.pyc
retry.cpython-314.pyc
subprocess.cpython-314.pyc
temp_dir.cpython-314.pyc
unpacking.cpython-314.pyc
urls.cpython-314.pyc
virtualenv.cpython-314.pyc
wheel.cpython-314.pyc
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
packaging.py
pylock.py
retry.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
__init__.cpython-314.pyc
bazaar.cpython-314.pyc
git.cpython-314.pyc
mercurial.cpython-314.pyc
subversion.cpython-314.pyc
versioncontrol.cpython-314.pyc
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.cpython-314.pyc
LICENSE.txt
__init__.py
__init__.cpython-314.pyc
_cmd.cpython-314.pyc
adapter.cpython-314.pyc
cache.cpython-314.pyc
controller.cpython-314.pyc
filewrapper.cpython-314.pyc
heuristics.cpython-314.pyc
serialize.cpython-314.pyc
wrapper.cpython-314.pyc
_cmd.py
adapter.py
cache.py
__init__.py
__init__.cpython-314.pyc
file_cache.cpython-314.pyc
redis_cache.cpython-314.pyc
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
LICENSE
__init__.py
__main__.py
__init__.cpython-314.pyc
__main__.cpython-314.pyc
core.cpython-314.pyc
cacert.pem
core.py
LICENSE.txt
__init__.py
__init__.cpython-314.pyc
compat.cpython-314.pyc
resources.cpython-314.pyc
scripts.cpython-314.pyc
util.cpython-314.pyc
compat.py
resources.py
scripts.py
util.py
LICENSE
__init__.py
__main__.py
__init__.cpython-314.pyc
__main__.cpython-314.pyc
distro.cpython-314.pyc
distro.py
LICENSE.md
__init__.py
__main__.py
__init__.cpython-314.pyc
__main__.cpython-314.pyc
cli.cpython-314.pyc
codec.cpython-314.pyc
compat.cpython-314.pyc
core.cpython-314.pyc
idnadata.cpython-314.pyc
intranges.cpython-314.pyc
package_data.cpython-314.pyc
uts46data.cpython-314.pyc
cli.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
COPYING
__init__.py
__init__.cpython-314.pyc
exceptions.cpython-314.pyc
ext.cpython-314.pyc
fallback.cpython-314.pyc
exceptions.py
ext.py
fallback.py
LICENSE
LICENSE.BSD
__init__.py
__init__.cpython-314.pyc
_elffile.cpython-314.pyc
_manylinux.cpython-314.pyc
_musllinux.cpython-314.pyc
_parser.cpython-314.pyc
_structures.cpython-314.pyc
_tokenizer.cpython-314.pyc
dependency_groups.cpython-314.pyc
direct_url.cpython-314.pyc
errors.cpython-314.pyc
markers.cpython-314.pyc
metadata.cpython-314.pyc
pylock.cpython-314.pyc
requirements.cpython-314.pyc
specifiers.cpython-314.pyc
tags.cpython-314.pyc
utils.cpython-314.pyc
version.cpython-314.pyc
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
dependency_groups.py
direct_url.py
errors.py
__init__.py
__init__.cpython-314.pyc
_spdx.cpython-314.pyc
_spdx.py
markers.py
metadata.py
pylock.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
LICENSE
__init__.py
__init__.cpython-314.pyc
LICENSE
__init__.py
__main__.py
__init__.cpython-314.pyc
__main__.cpython-314.pyc
_xdg.cpython-314.pyc
android.cpython-314.pyc
api.cpython-314.pyc
macos.cpython-314.pyc
unix.cpython-314.pyc
version.cpython-314.pyc
windows.cpython-314.pyc
_xdg.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
LICENSE
__init__.py
__main__.py
__init__.cpython-314.pyc
__main__.cpython-314.pyc
console.cpython-314.pyc
filter.cpython-314.pyc
formatter.cpython-314.pyc
lexer.cpython-314.pyc
modeline.cpython-314.pyc
plugin.cpython-314.pyc
regexopt.cpython-314.pyc
scanner.cpython-314.pyc
sphinxext.cpython-314.pyc
style.cpython-314.pyc
token.cpython-314.pyc
unistring.cpython-314.pyc
util.cpython-314.pyc
console.py
filter.py
__init__.py
__init__.cpython-314.pyc
formatter.py
__init__.py
__init__.cpython-314.pyc
_mapping.cpython-314.pyc
_mapping.py
lexer.py
__init__.py
__init__.cpython-314.pyc
_mapping.cpython-314.pyc
python.cpython-314.pyc
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
__init__.cpython-314.pyc
_mapping.cpython-314.pyc
_mapping.py
token.py
unistring.py
util.py
LICENSE
__init__.py
__init__.cpython-314.pyc
_impl.cpython-314.pyc
_impl.py
__init__.py
__init__.cpython-314.pyc
_in_process.cpython-314.pyc
_in_process.py
__init__.py
__init__.cpython-314.pyc
__version__.cpython-314.pyc
_internal_utils.cpython-314.pyc
_types.cpython-314.pyc
adapters.cpython-314.pyc
api.cpython-314.pyc
auth.cpython-314.pyc
certs.cpython-314.pyc
compat.cpython-314.pyc
cookies.cpython-314.pyc
exceptions.cpython-314.pyc
help.cpython-314.pyc
hooks.cpython-314.pyc
models.cpython-314.pyc
packages.cpython-314.pyc
sessions.cpython-314.pyc
status_codes.cpython-314.pyc
structures.cpython-314.pyc
utils.cpython-314.pyc
__version__.py
_internal_utils.py
_types.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
LICENSE
__init__.py
__init__.cpython-314.pyc
providers.cpython-314.pyc
reporters.cpython-314.pyc
structs.cpython-314.pyc
providers.py
reporters.py
__init__.py
__init__.cpython-314.pyc
abstract.cpython-314.pyc
criterion.cpython-314.pyc
exceptions.cpython-314.pyc
resolution.cpython-314.pyc
abstract.py
criterion.py
exceptions.py
resolution.py
structs.py
LICENSE
__init__.py
__main__.py
__init__.cpython-314.pyc
__main__.cpython-314.pyc
_cell_widths.cpython-314.pyc
_emoji_codes.cpython-314.pyc
_emoji_replace.cpython-314.pyc
_export_format.cpython-314.pyc
_extension.cpython-314.pyc
_fileno.cpython-314.pyc
_inspect.cpython-314.pyc
_log_render.cpython-314.pyc
_loop.cpython-314.pyc
_null_file.cpython-314.pyc
_palettes.cpython-314.pyc
_pick.cpython-314.pyc
_ratio.cpython-314.pyc
_spinners.cpython-314.pyc
_stack.cpython-314.pyc
_timer.cpython-314.pyc
_win32_console.cpython-314.pyc
_windows.cpython-314.pyc
_windows_renderer.cpython-314.pyc
_wrap.cpython-314.pyc
abc.cpython-314.pyc
align.cpython-314.pyc
ansi.cpython-314.pyc
bar.cpython-314.pyc
box.cpython-314.pyc
cells.cpython-314.pyc
color.cpython-314.pyc
color_triplet.cpython-314.pyc
columns.cpython-314.pyc
console.cpython-314.pyc
constrain.cpython-314.pyc
containers.cpython-314.pyc
control.cpython-314.pyc
default_styles.cpython-314.pyc
diagnose.cpython-314.pyc
emoji.cpython-314.pyc
errors.cpython-314.pyc
file_proxy.cpython-314.pyc
filesize.cpython-314.pyc
highlighter.cpython-314.pyc
json.cpython-314.pyc
jupyter.cpython-314.pyc
layout.cpython-314.pyc
live.cpython-314.pyc
live_render.cpython-314.pyc
logging.cpython-314.pyc
markup.cpython-314.pyc
measure.cpython-314.pyc
padding.cpython-314.pyc
pager.cpython-314.pyc
palette.cpython-314.pyc
panel.cpython-314.pyc
pretty.cpython-314.pyc
progress.cpython-314.pyc
progress_bar.cpython-314.pyc
prompt.cpython-314.pyc
protocol.cpython-314.pyc
region.cpython-314.pyc
repr.cpython-314.pyc
rule.cpython-314.pyc
scope.cpython-314.pyc
screen.cpython-314.pyc
segment.cpython-314.pyc
spinner.cpython-314.pyc
status.cpython-314.pyc
style.cpython-314.pyc
styled.cpython-314.pyc
syntax.cpython-314.pyc
table.cpython-314.pyc
terminal_theme.cpython-314.pyc
text.cpython-314.pyc
theme.cpython-314.pyc
themes.cpython-314.pyc
traceback.cpython-314.pyc
tree.cpython-314.pyc
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
__init__.py
__init__.cpython-314.pyc
_parser.cpython-314.pyc
_re.cpython-314.pyc
_types.cpython-314.pyc
_parser.py
_re.py
_types.py
__init__.py
__init__.cpython-314.pyc
_writer.cpython-314.pyc
_writer.py
py.typed
LICENSE
__init__.py
__init__.cpython-314.pyc
_api.cpython-314.pyc
_macos.cpython-314.pyc
_openssl.cpython-314.pyc
_ssl_constants.cpython-314.pyc
_windows.cpython-314.pyc
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
LICENSE.txt
__init__.py
__init__.cpython-314.pyc
_base_connection.cpython-314.pyc
_collections.cpython-314.pyc
_request_methods.cpython-314.pyc
_version.cpython-314.pyc
connection.cpython-314.pyc
connectionpool.cpython-314.pyc.2449476364656
exceptions.cpython-314.pyc
fields.cpython-314.pyc
filepost.cpython-314.pyc
poolmanager.cpython-314.pyc
response.cpython-314.pyc
_base_connection.py
_collections.py
_request_methods.py
_version.py
connection.py
connectionpool.py
__init__.cpython-314.pyc
pyopenssl.cpython-314.pyc
socks.cpython-314.pyc
__init__.py
__init__.cpython-314.pyc
connection.cpython-314.pyc
fetch.cpython-314.pyc
request.cpython-314.pyc
response.cpython-314.pyc
connection.py
fetch.py
request.py
response.py
pyopenssl.py
socks.py
exceptions.py
fields.py
filepost.py
__init__.py
__init__.cpython-314.pyc
connection.cpython-314.pyc
probe.cpython-314.pyc
connection.py
probe.py
poolmanager.py
response.py
__init__.py
__init__.cpython-314.pyc
connection.cpython-314.pyc
proxy.cpython-314.pyc
request.cpython-314.pyc
response.cpython-314.pyc
retry.cpython-314.pyc
ssl_.cpython-314.pyc
ssl_match_hostname.cpython-314.pyc
ssltransport.cpython-314.pyc
timeout.cpython-314.pyc
url.cpython-314.pyc
util.cpython-314.pyc
wait.cpython-314.pyc
connection.py
proxy.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
util.py
wait.py
__init__.py
__main__.py
test_foo.py
pip3.exe
python.exe
3ed04636-819c-463d-9140-bc7f956ed2c4.tmp
c483278f-0064-40df-93c2-00443eb8d3a8.tmp
content.js
d8445d85-6808-42cc-8c6e-66f17c6d9eab.tmp
messages.json
default.dic
b18ee83c-ddf2-41e7-942e-0065c973e040.tmp
SideBar.png
python-3.14.8-amd64.exe
BootstrapperApplicationData.xml
Default.thm
Default.wxl
launcher_JustForMe
PythonBA.dll