Analysis
- user interaction
yes - max time kernel
1799s - max time network
1729s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/10/2026, 17:26
General
- Target python-3.15.0-amd64.exe
- Size 43.3MB
- Sample261012-v1chjsds3s
- SHA256 67d9a63eb145a34aa939f02eadbf8c57f21fcdd6decb901ccac578d2d1f01d6f
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 64 IoCs
- Executes dropped EXE 22 IoCs
- Loads dropped DLL 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 10 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 60 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 20 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Users\Admin\AppData\Local\Temp\python-3.15.0-amd64.exe"C:\Users\Admin\AppData\Local\Temp\python-3.15.0-amd64.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{BDC3981C-071B-4B39-9459-345339AA86B1}\.cr\python-3.15.0-amd64.exe"C:\Windows\Temp\{BDC3981C-071B-4B39-9459-345339AA86B1}\.cr\python-3.15.0-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python-3.15.0-amd64.exe" -burn.filehandle.attached=764 -burn.filehandle.self=7682⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff84cc8c728,0x7ff84cc8c734,0x7ff84cc8c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1824,i,12594573104490695461,12613049848195922312,524288 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,14335013295979499186,9715958481779928721,262144 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,15316506235473112927,9793504182226684575,524288 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,366036386553780904,10968692404839910453,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,18167341134386464402,7576559295118863979,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4720,i,12500303955185170034,9574017366399949913,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,17042492365100555878,16629047145563442825,524288 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,5555949085404082908,15670474277443618471,524288 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5520,i,13904235827362489675,13200661366874267024,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,9474736870980694508,3309383692802314578,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,6516025474739470839,5840409067331352137,524288 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5612,i,10104477201268683183,3358575037516326199,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5816,i,6870094379778088167,7475892265067796918,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,6946917206734528163,12284847902894733370,524288 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6296,i,12089216746997505224,1691743183336560016,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5420,i,8716860680292187191,92687465532826659,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5648,i,7155572921093916972,8176082563895643842,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,13736070193142821633,804868141212408112,524288 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6112,i,1090603051029304663,12760158475390383764,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4852,i,6581882942676604693,1325032980396702889,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4752,i,11381256202339429526,4766893844979792235,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4712,i,5794455674057310349,13850853226555035298,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4816,i,2203922539124811103,2733399045788915162,524288 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,17130068857247597787,13534167982932832458,524288 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,10845732553614459313,8517407137792893608,524288 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,12360668643552432057,2573314488495524286,524288 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\python-3.15.0-amd64.exe"C:\Users\Admin\Downloads\python-3.15.0-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{09C5D685-6065-4A37-88A8-2409D54562C8}\.cr\python-3.15.0-amd64.exe"C:\Windows\Temp\{09C5D685-6065-4A37-88A8-2409D54562C8}\.cr\python-3.15.0-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.15.0-amd64.exe" -burn.filehandle.attached=756 -burn.filehandle.self=7603⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{BF6B7B8A-1740-4441-ACFA-1084B6426845}\.be\python-3.15.0-amd64.exe"C:\Windows\Temp\{BF6B7B8A-1740-4441-ACFA-1084B6426845}\.be\python-3.15.0-amd64.exe" -q -burn.elevated BurnPipe.{CA8FCF2B-4896-45A0-8435-1C126663D730} {07B54200-6EFF-4D29-8747-2110FBDFF482} 22324⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3632,i,3816762964085349542,7098095270796218360,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6360,i,1033076633996250920,255960547012860965,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6736,i,14166793605205921835,16228419884343859985,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6484,i,15512882269896416922,11828178210161124033,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=904,i,4342765411804054758,17889187123125829480,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,5055225897398082472,3963217505234481533,524288 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6952,i,5847506382465802101,3799910858337000725,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7100,i,11990703627666193936,12122957158255275197,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6848,i,6504273335750985201,10556011961360307512,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7108,i,3685069555286773396,16268045370142348733,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7064,i,9896611816758269767,5774109169950432856,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6428,i,12137703321560113755,4835994269268272782,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7124,i,16298955219062736031,13919625214006468496,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=5532,i,16790967601306985759,13646824663229561205,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6608,i,6177797939519860790,14195907850124956554,262144 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=1188 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3528,i,15509502093744465505,853602102757081853,524288 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=4768,i,13743122161637794637,9454385812788540716,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=3368,i,12759985048542207494,14602860250187273515,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6508,i,16734839485391798788,12288744737715581207,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=6620,i,16497117060097294681,18221667583264011242,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=6460,i,14494728937804758186,12431118391499874309,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=6044,i,14655447666663291044,1954319878922414555,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=5036,i,4036391611776377214,11030887771427262886,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=5552,i,2259686836531411727,4747968440922313991,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=1188 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=3696,i,8479423097597486060,11648605909561209867,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=7380,i,8919112734409650671,11521375286202423637,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7428,i,11741889266215249851,4487440278521940128,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=1540,i,11902740979420292875,10517812263751405421,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=7588,i,7276096024048275716,12965646014462594379,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=6892,i,9478111857032438606,776462907018987359,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=7412,i,14994443303354328650,10437944295386299404,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=8000,i,2790256660752960346,8037364557033367522,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=7748,i,7222245548506994089,9454239875209588368,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=8072,i,5536800501311792708,12536214281771282896,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=7368,i,17871441476410394165,4757108147677881878,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=8000,i,4253529725451714946,5589596353114725033,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=7880,i,13758569445785753447,11461689786033772183,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=7984,i,15686952363562487692,13259317810674991895,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=7804,i,6020970624617783249,918921967727193600,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=4868,i,1679241813535549424,16355572323050029800,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=7440,i,16311956615050824034,7543650188598816715,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=7812,i,1065502461095117707,9852022858290769327,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=7880,i,17064471877318019450,8239013461334135074,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=3712,i,7246271130535648198,2119657269653326725,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=4540,i,6009318458921448568,9668552988519216434,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=7016,i,14521252195047867456,15182965501806909263,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=6992,i,2908645940239094826,16649523675021211188,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=8076,i,4261354127456478741,2933447776634037845,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=8092 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=6952,i,14125180148357037436,12679798321802405763,2097152 --field-trial-handle=1916,i,17670092042414630460,15456017396843394126,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Users\Admin\AppData\Local\Package Cache\{c7d15cec-c713-485e-96e3-2c16dadd28a1}\python-3.15.0-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{c7d15cec-c713-485e-96e3-2c16dadd28a1}\python-3.15.0-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Package Cache\{c7d15cec-c713-485e-96e3-2c16dadd28a1}\python-3.15.0-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{c7d15cec-c713-485e-96e3-2c16dadd28a1}\python-3.15.0-amd64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.15.0 (64-bit)_20261012182900.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Package Cache\{c7d15cec-c713-485e-96e3-2c16dadd28a1}\python-3.15.0-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{c7d15cec-c713-485e-96e3-2c16dadd28a1}\python-3.15.0-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{c7d15cec-c713-485e-96e3-2c16dadd28a1}\python-3.15.0-amd64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.15.0 (64-bit)_20261012182900.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4C8C350D0D409AC2CA4AA1DCBE3C4BC82⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe" -I -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpbl4bomn9\\pip-26.2.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpbl4bomn9', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Guardian-Premium (2)\Guardian-Premium\run.bat" "1⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exepython checker.py2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Guardian-Premium (2)\Guardian-Premium\run.bat1⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Guardian-Premium (2)\Guardian-Premium\run.bat" "1⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\Scripts\pip.exepip install -r requirements.txt2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python315\Scripts\pip.exe" install -r requirements.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
-
-
-
C:\Windows\py.exe"C:\Windows\py.exe" "C:\Users\Admin\Downloads\Guardian-Premium (2)\Guardian-Premium\checker.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe "C:\Users\Admin\Downloads\Guardian-Premium (2)\Guardian-Premium\checker.py"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\py.exe"C:\Windows\py.exe" "C:\Users\Admin\Downloads\Guardian-Premium (2)\Guardian-Premium\checker.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe "C:\Users\Admin\Downloads\Guardian-Premium (2)\Guardian-Premium\checker.py"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\py.exe"C:\Windows\py.exe" "C:\Users\Admin\Downloads\Guardian-Premium (2)\Guardian-Premium\checker.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe "C:\Users\Admin\Downloads\Guardian-Premium (2)\Guardian-Premium\checker.py"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Windows\system32\curl.exe
-
-
C:\Windows\py.exe"C:\Windows\py.exe" "C:\Users\Admin\Downloads\Guardian-Premium (2)\Guardian-Premium\checker.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe "C:\Users\Admin\Downloads\Guardian-Premium (2)\Guardian-Premium\checker.py"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\py.exe"C:\Windows\py.exe" "C:\Users\Admin\Downloads\Guardian-Premium (2)\Guardian-Premium\checker.py"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe "C:\Users\Admin\Downloads\Guardian-Premium (2)\Guardian-Premium\checker.py"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
2Query Registry
5System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e5bf925.rbs
e5bf92a.rbs
e5bf92f.rbs
e5bf934.rbs
e5bf939.rbs
e5bf93e.rbs
e5bf943.rbs
e5bf948.rbs
e5bf94d.rbs
e5bf952.rbs
03f90e06-93f9-47aa-ab43-97b65da36d49.tmp
08a10b22-7dce-4634-bf96-278fa9edf311.tmp
13df31e0-f86d-4804-a72d-938e83b624a0.tmp
29c98c56-d956-4ec6-a1dd-aab2bdc63759.tmp
52eeaa50-eb50-4f46-abce-398c08a11efd.tmp
settings.dat
01ed5f61-0e6d-4cd5-b15a-391be779dfaf.tmp
0744a790-7081-4d22-92e0-8588b0ea072b.tmp
111134c9-b973-47ca-9215-5ec8b682e48f.tmp
22b92e13-7428-4deb-9a30-59a2aad0ae6f.tmp
50956f82-72c2-423c-b621-d29dad63bad9.tmp
5fde8e85-ed02-460f-b394-6d48d3a528d0.tmp
6c4f089e-1b6c-418c-81a4-f7861230e18e.tmp
86cafcbc-62d1-44db-b3fc-cf82d17fd644.tmp
8cf6d358-566f-46dd-b5a5-5fa27a629f7c.tmp
8fb06176-d8ee-4a6a-be11-29ca97cc1c65.tmp
BookmarkMergedSurfaceOrdering
f_000004
f_000015
f_00001b
f_00001d
f_00001e
f_000020
f_000021
f_000022
f_000023
f_000024
f_000025
f_000026
f_00002c
f_00002d
f_00002e
f_000040
f_000042
f_000043
f_000045
f_000048
f_00004a
f_00004b
f_00005a
f_00005e
f_00005f
f_000060
f_000061
f_000062
f_000065
f_000069
ce122ff32c2b1953_0
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
messages.json
craw_background.js
CURRENT
MANIFEST-000001
12b7e29b-997a-47a9-94b5-7f30c9a799e4.tmp
22319d17-04bd-4b1c-be39-d3171a6821f7.tmp
36fac711-1b7d-4d3f-94b9-e9d1833c913f.tmp
3a7a6383-71f2-4c22-b201-728d37fd8b0e.tmp
51175d28-cbd4-44bc-9964-22c62e33de73.tmp
5a3b6ddd-1d97-43d8-93d1-658de1b73a3d.tmp
70ca41fc-00ea-40af-8a96-ba4ed4cec0d8.tmp
Network Persistent State
ae39b311-a113-4939-9b5e-7bafcdca87d1.tmp
c006d41a-68e4-4218-b4ac-e62f480e02bd.tmp
dbf81057-349c-483f-b2ce-583f715a235f.tmp
ea5c7df2-008c-44ce-b6f9-6a8822464870.tmp
temp-index
temp-index
the-real-index
data_0
data_1
data_2
data_3
260b0914-0393-459d-a183-fd704afa3efb.tmp
Network Persistent State
a20f7185-32f0-49d3-a541-6a0ee155e7dd.tmp
b176383d-7834-4984-9453-18766347f0f9.tmp
b466f4be-206a-42bc-9d6a-4fbc87c73d70.tmp
c09bac0b-1eb9-4551-b219-cdd19a03b903.tmp
d50b23cb-b557-4ed8-8e76-ffebd00232a3.tmp
d73150d8-70af-4a7b-a547-38f679cac691.tmp
fe45aa09-8a97-471f-b645-830f3ec6446c.tmp
Local State
Local State
bb2cb6b7-94ba-43ef-b1b7-b0549869c736.tmp
d8454b21-9052-4f21-8ca0-d49a27475582.tmp
f965bb74-793e-4edf-8b54-cdc57bc88ff8.tmp
doc_JustForMe
lib_JustForMe
tcltk_JustForMe
pip.msi
path.msi
dev.msi
core.msi
test.msi
exe.msi
state.rsm
RECORD
RECORD
WHEEL
RECORD
RECORD
RECORD
LICENSE
RECORD
__main__.py
intranges.py
py.typed
RECORD
RECORD
RECORD
INSTALLER
RECORD
LICENSE
LICENSE
RECORD
RECORD
console.py
filter.py
_mapping.py
modeline.py
scanner.py
token.py
unistring.py
RECORDscqby00w.tmp
RECORD
_emoji_codes.py
_export_format.py
_fileno.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_wrap.py
ansi.py
bar.py
color.py
color_triplet.py
columns.py
constrain.py
containers.py
control.py
default_styles.py
errors.py
file_proxy.py
filesize.py
json.py
live.py
markup.py
measure.py
padding.py
pager.py
panel.py
progress.py
progress_bar.py
prompt.py
region.py
rule.py
spinner.py
status.py
terminal_theme.py
text.py
themes.py
tree.py
RECORD
__init__.py
__main__.py
test_foo.py
pip3.15.exe
python.exe
Python 3.15.0 (64-bit)_20261012182900_000_core_JustForMe.log
Python 3.15.0 (64-bit)_20261012182900_001_exe_JustForMe.log
Python 3.15.0 (64-bit)_20261012182900_002_dev_JustForMe.log
Python 3.15.0 (64-bit)_20261012182900_003_lib_JustForMe.log
acc1f732-f3d7-4f47-9ad7-feb138bc5c71.tmp
messages.json
tmp0bk6po2d
tmp4gvoz9r6
tmp5k6_r2lw
tmp5pm1qzdt
tmp6bejq1pb
tmp6jzygr8c
tmp73v21w6z
tmp7b7nl82o
tmp8fa8ewx_
tmp903ib3xo
tmp_7v4gdku
tmpa_ovxddh
tmpajtjfhnp
tmpb2x87l3q
tmpbizp1nlp
tmpbzhc1ipr
tmpciig9zuj
tmpelb1al2c
tmpeq9q3qm_
tmpevs4uesp
tmpg609u04w
tmpgbvt19pp
tmpgwz9f5o_
tmpixzub3ki
tmpji_f26wb
tmpjz_yz004
tmpk4ipf86s
tmpk9yoyysm
tmplaabj2n9
tmplouyuurb
tmpmjoby9zf
tmpmk6bdigq
tmpmlkn1_hx
tmponrytab_
tmpop76hjz8
tmpp17qlg4k
tmppej2ash1
tmpq63_u2n8
tmps640zy0c
tmpskcu4af_
tmpux12ssq5
tmpvl69k6_1
tmpwk1ouqt7
default.exc
Guardian-Premium (2).zip.crdownload
c8048d4f-d26c-4e41-bbfe-541ee540d5be.tmp
f9823e2e-a084-4a69-8592-87673cc6c874.tmp
python-3.15.0-amd64.exe
PythonBA.dll
SideBar.png
python-3.15.0-amd64.exe
BootstrapperApplicationData.xml
Default.thm
Default.wxl
launcher_AllUsers