Analysis
- user interaction
yes - max time kernel
654s - max time network
1416s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
24/10/2026, 23:11
General
- Target https://gofile.io/d/X8C76V9k
- Sample261024-26ptdscy71
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 50 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 51 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 62 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 10 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 26 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 11 IoCs
- Modifies registry class 64 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 25 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/X8C76V9k1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffe3a81c728,0x7ffe3a81c734,0x7ffe3a81c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,4571808885327290509,16542911522960789846,262144 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2020 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,4586813337724075321,14608615807734478005,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,13606081442379652092,15893122483764679454,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2576 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,12682296145341029927,11641839712315785307,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3224 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,9296414310671427577,5371998997503829770,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3296 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5076,i,10972894795190199995,18097467101643750707,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4944 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1104,i,3008201377301258171,10731275685270402713,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5188 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3148,i,14933107087075216427,11493850761744436279,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5596 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4528,i,12650025330561144008,17120474677623903698,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=500 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,4446062308161261876,14296262428893393150,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5664 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4952,i,6455451275203409773,7286756919943869571,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5688 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,11515781603056635006,5979883118643690224,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5736 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,14859006580251443125,14643947126235997567,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5776 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5792,i,789814196947408432,13510240492898828183,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5652,i,7087230404560765676,11872595890355358712,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5104 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5796,i,5350139798759410463,6686712982843116751,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1104 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6088,i,8448118502358426383,16433692236002985085,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3412 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5728,i,7801619440630324555,15285082254755806749,262144 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5740 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3388,i,4538741868207638190,13562463595675120043,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6284,i,16416208095320350721,16510462677039490218,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5836 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\OBS-Studio-32.2.2-Windows-x64-Installer.exe"C:\Users\Admin\Downloads\OBS-Studio-32.2.2-Windows-x64-Installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsaCC0.tmp\check_for_64bit_visual_studio_2022_runtimes.exeC:\Users\Admin\AppData\Local\Temp\nsaCC0.tmp\check_for_64bit_visual_studio_2022_runtimes.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\nsaCC0.tmp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\nsaCC0.tmp\VC_redist.x64.exe" /quiet /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{3CE7EAC7-4054-4630-B22A-63374E3A5E64}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{3CE7EAC7-4054-4630-B22A-63374E3A5E64}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsaCC0.tmp\VC_redist.x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=576 /quiet /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{F040D91D-3856-4E1E-98C7-826A3ADCCB20}\.be\VC_redist.x64.exe"C:\Windows\Temp\{F040D91D-3856-4E1E-98C7-826A3ADCCB20}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D0F3FABE-DB9D-4557-80D4-6EE427BA0741} {32578DD5-07DB-4055-96DF-93A6882F7CB7} 35845⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1068 -burn.embedded BurnPipe.{9AE11116-1760-4A75-91C4-B10975DFC60B} {01D7F61C-3D31-4E94-A1D9-8073AAD363FF} 6326⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=568 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1068 -burn.embedded BurnPipe.{9AE11116-1760-4A75-91C4-B10975DFC60B} {01D7F61C-3D31-4E94-A1D9-8073AAD363FF} 6327⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{42ED5079-32C7-42B5-9B4B-E00F10CE733B} {D46E1A20-60A6-4167-8A58-DB39ABCA67E4} 50808⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module32.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio.lnk"3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6380,i,14263715645982075377,983715609044015309,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6408 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6504,i,1263158700072078156,4487432697758147057,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6632,i,1766973111331827647,11264025948256013719,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6764,i,3600342535339197087,14614081799335881208,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6780 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6824,i,8748230923871538608,3707823513059161814,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6964 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,14023193682641713171,7607478899160227802,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6400 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\python-3.15.1-amd64.exe"C:\Users\Admin\Downloads\python-3.15.1-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{4244D820-AB5F-4EB3-9AF0-64AF5F39EE01}\.cr\python-3.15.1-amd64.exe"C:\Windows\Temp\{4244D820-AB5F-4EB3-9AF0-64AF5F39EE01}\.cr\python-3.15.1-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.15.1-amd64.exe" -burn.filehandle.attached=720 -burn.filehandle.self=7283⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5128,i,3869616288719390962,17426896228106567664,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7064,i,8697424427724595628,8424266045149301908,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7140 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7136,i,8217453488115562543,4961794147346582990,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6196 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3356,i,17479897797695533282,5063837688014347709,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6200 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3284,i,6123861899970041818,11702787466686558300,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5160 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6576,i,4212885482338318280,16134619055655156228,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6584 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6996,i,9974915335718665243,18204674084575785809,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5880,i,11722592420214290656,5694996240970175588,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7092 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7108,i,13949520743989240854,1672232715716467390,2097152 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6700 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,10834130299004731710,5540206443958999041,524288 --field-trial-handle=2032,i,18125768015554485665,17539019811679251704,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7096 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Helios\Helios.exe"C:\Users\Admin\Downloads\Helios\Helios.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Helios\versions\1.4.1.0\lib\HeliosApp.exe"C:\Users\Admin\Downloads\Helios\versions\1.4.1.0\lib\HeliosApp.exe"2⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe -E -s -u -X utf8 -c " import importlib import json import os import sys print(f\"HELIOS_PYTHON_PROBE_VERSION={sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}\", flush=True) helios_py = os.environ.get(\"HELIOS_PY\", \"\") _helios_dll_dir = os.add_dll_directory(helios_py) if helios_py and hasattr(os, \"add_dll_directory\") else None if helios_py: sys.path.insert(0, helios_py) module_specs = [] if os.environ.get(\"HELIOS_VALIDATE_CV_HOST\") == \"1\": module_specs.append((\"cvpython_host\", \"cvpython_host\")) module_specs.extend([ (\"numpy\", \"numpy\"), (\"opencv\", \"cv2\"), (\"pywin32\", \"win32api\"), ]) modules = {} for key, module_name in module_specs: print(f\"HELIOS_PYTHON_PROBE_IMPORT={key}\", flush=True) try: module = importlib.import_module(module_name) except BaseException as error: modules[key] = { \"ok\": False, \"error\": f\"{type(error).__name__}: {error}\", } else: modules[key] = { \"ok\": True, \"path\": str(getattr(module, \"__file__\", \"\") or \"\"), \"version\": str(getattr(module, \"__version__\", \"\") or \"\"), } print(\"HELIOS_PYTHON_PROBE_RESULT=\" + json.dumps({\"modules\": modules}, separators=(\",\", \":\")), flush=True) "3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe -E -s -u -X utf8 -c " import importlib import json import os import sys print(f\"HELIOS_PYTHON_PROBE_VERSION={sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}\", flush=True) helios_py = os.environ.get(\"HELIOS_PY\", \"\") _helios_dll_dir = os.add_dll_directory(helios_py) if helios_py and hasattr(os, \"add_dll_directory\") else None if helios_py: sys.path.insert(0, helios_py) module_specs = [] if os.environ.get(\"HELIOS_VALIDATE_CV_HOST\") == \"1\": module_specs.append((\"cvpython_host\", \"cvpython_host\")) module_specs.extend([ (\"numpy\", \"numpy\"), (\"opencv\", \"cv2\"), (\"pywin32\", \"win32api\"), ]) modules = {} for key, module_name in module_specs: print(f\"HELIOS_PYTHON_PROBE_IMPORT={key}\", flush=True) try: module = importlib.import_module(module_name) except BaseException as error: modules[key] = { \"ok\": False, \"error\": f\"{type(error).__name__}: {error}\", } else: modules[key] = { \"ok\": True, \"path\": str(getattr(module, \"__file__\", \"\") or \"\"), \"version\": str(getattr(module, \"__version__\", \"\") or \"\"), } print(\"HELIOS_PYTHON_PROBE_RESULT=\" + json.dumps({\"modules\": modules}, separators=(\",\", \":\")), flush=True) "3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe -E -s -u -X utf8 -c " import importlib import json import os import sys print(f\"HELIOS_PYTHON_PROBE_VERSION={sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}\", flush=True) helios_py = os.environ.get(\"HELIOS_PY\", \"\") _helios_dll_dir = os.add_dll_directory(helios_py) if helios_py and hasattr(os, \"add_dll_directory\") else None if helios_py: sys.path.insert(0, helios_py) module_specs = [] if os.environ.get(\"HELIOS_VALIDATE_CV_HOST\") == \"1\": module_specs.append((\"cvpython_host\", \"cvpython_host\")) module_specs.extend([ (\"numpy\", \"numpy\"), (\"opencv\", \"cv2\"), (\"pywin32\", \"win32api\"), ]) modules = {} for key, module_name in module_specs: print(f\"HELIOS_PYTHON_PROBE_IMPORT={key}\", flush=True) try: module = importlib.import_module(module_name) except BaseException as error: modules[key] = { \"ok\": False, \"error\": f\"{type(error).__name__}: {error}\", } else: modules[key] = { \"ok\": True, \"path\": str(getattr(module, \"__file__\", \"\") or \"\"), \"version\": str(getattr(module, \"__version__\", \"\") or \"\"), } print(\"HELIOS_PYTHON_PROBE_RESULT=\" + json.dumps({\"modules\": modules}, separators=(\",\", \":\")), flush=True) "3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "param([string]$zip,[string]$dest) Expand-Archive -LiteralPath $zip -DestinationPath $dest -Force" C:\Users\Admin\AppData\Local\Temp\uv_download_b8a114bf-04bf-4bdc-b53e-77ababbe85cc.zip C:\Users\Admin\AppData\Local\Temp\uv_extract_13c4ea19-4765-43cf-8ede-f31444fa9fef3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\tar.exetar.exe -xf C:/Users/Admin/AppData/Local/Temp/uv_download_b8a114bf-04bf-4bdc-b53e-77ababbe85cc.zip -C C:/Users/Admin/AppData/Local/Temp/uv_extract_13c4ea19-4765-43cf-8ede-f31444fa9fef3⤵
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exe --version3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exe venv --python 3.14 --python-preference only-managed C:/Users/Admin/AppData/Local/HeliosProject/Helios/python/cv/.henv3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14.9-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14.9-windows-x86_64-none\python.exe" -I -B -c "import sys; sys.path = [\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\.tmpXltdpX\"] + sys.path; from python.get_interpreter_info import main; main()"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe --version3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" --version4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe --version3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" --version4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exe --version3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exe pip list --format json --python C:/Users/Admin/AppData/Local/HeliosProject/Helios/python/cv/.henv/Scripts/python.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe"C:/Users/Admin/AppData/Local/HeliosProject/Helios/python/cv/.henv/Scripts/python.exe" -I -B -c "import sys; sys.path = [\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\.tmp9K9p6a\"] + sys.path; from python.get_interpreter_info import main; main()"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -I -B -c "import sys; sys.path = [\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\.tmp9K9p6a\"] + sys.path; from python.get_interpreter_info import main; main()"5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exe --version3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exe pip install -r C:/Users/Admin/AppData/Local/HeliosProject/Helios/python/cv/requirements.txt --python C:/Users/Admin/AppData/Local/HeliosProject/Helios/python/cv/.henv/Scripts/python.exe3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe"C:/Users/Admin/AppData/Local/HeliosProject/Helios/python/cv/.henv/Scripts/python.exe" -I -B -c "import sys; sys.path = [\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\.tmpuxsJAP\"] + sys.path; from python.get_interpreter_info import main; main()"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -I -B -c "import sys; sys.path = [\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\.tmpuxsJAP\"] + sys.path; from python.get_interpreter_info import main; main()"5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpE5euck\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpE5euck\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json get_requires_for_build = getattr(backend, \"get_requires_for_build_wheel\", None) if get_requires_for_build: requires = get_requires_for_build({}) else: requires = [] with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpE5euck\\get_requires_for_build_wheel.txt\", \"w\") as fp: json.dump(requires, fp) "4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpE5euck\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json get_requires_for_build = getattr(backend, \"get_requires_for_build_wheel\", None) if get_requires_for_build: requires = get_requires_for_build({}) else: requires = [] with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpE5euck\\get_requires_for_build_wheel.txt\", \"w\") as fp: json.dump(requires, fp) "5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpxPFFIz\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpxPFFIz\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json get_requires_for_build = getattr(backend, \"get_requires_for_build_wheel\", None) if get_requires_for_build: requires = get_requires_for_build({}) else: requires = [] with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpxPFFIz\\get_requires_for_build_wheel.txt\", \"w\") as fp: json.dump(requires, fp) "4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpxPFFIz\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json get_requires_for_build = getattr(backend, \"get_requires_for_build_wheel\", None) if get_requires_for_build: requires = get_requires_for_build({}) else: requires = [] with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpxPFFIz\\get_requires_for_build_wheel.txt\", \"w\") as fp: json.dump(requires, fp) "5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpE5euck\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpE5euck\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json prepare_metadata_for_build = getattr(backend, \"prepare_metadata_for_build_wheel\", None) if prepare_metadata_for_build: dirname = prepare_metadata_for_build(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpE5euck\\metadata_directory\", {}) else: dirname = None with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpE5euck\\prepare_metadata_for_build_wheel.txt\", \"w\") as fp: fp.write(dirname or \"\") "4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpE5euck\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json prepare_metadata_for_build = getattr(backend, \"prepare_metadata_for_build_wheel\", None) if prepare_metadata_for_build: dirname = prepare_metadata_for_build(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpE5euck\\metadata_directory\", {}) else: dirname = None with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpE5euck\\prepare_metadata_for_build_wheel.txt\", \"w\") as fp: fp.write(dirname or \"\") "5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpxPFFIz\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpxPFFIz\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json prepare_metadata_for_build = getattr(backend, \"prepare_metadata_for_build_wheel\", None) if prepare_metadata_for_build: dirname = prepare_metadata_for_build(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpxPFFIz\\metadata_directory\", {}) else: dirname = None with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpxPFFIz\\prepare_metadata_for_build_wheel.txt\", \"w\") as fp: fp.write(dirname or \"\") "4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpxPFFIz\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json prepare_metadata_for_build = getattr(backend, \"prepare_metadata_for_build_wheel\", None) if prepare_metadata_for_build: dirname = prepare_metadata_for_build(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpxPFFIz\\metadata_directory\", {}) else: dirname = None with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpxPFFIz\\prepare_metadata_for_build_wheel.txt\", \"w\") as fp: fp.write(dirname or \"\") "5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpE5euck\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpE5euck\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend wheel_filename = backend.build_wheel(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpa4RByC\", {}, \"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpE5euck\\metadata_directory\\imutils-0.5.4.dist-info\") with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpE5euck\\build_wheel.txt\", \"w\") as fp: fp.write(wheel_filename) "4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpE5euck\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend wheel_filename = backend.build_wheel(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpa4RByC\", {}, \"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpE5euck\\metadata_directory\\imutils-0.5.4.dist-info\") with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpE5euck\\build_wheel.txt\", \"w\") as fp: fp.write(wheel_filename) "5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpxPFFIz\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpxPFFIz\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend wheel_filename = backend.build_wheel(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmp5rB7ul\", {}, \"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpxPFFIz\\metadata_directory\\pywinusb-0.4.2.dist-info\") with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpxPFFIz\\build_wheel.txt\", \"w\") as fp: fp.write(wheel_filename) "4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpxPFFIz\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend wheel_filename = backend.build_wheel(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmp5rB7ul\", {}, \"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpxPFFIz\\metadata_directory\\pywinusb-0.4.2.dist-info\") with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpxPFFIz\\build_wheel.txt\", \"w\") as fp: fp.write(wheel_filename) "5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe -c "import os, sys, traceback _helios_dll_dir = None helios_py = os.environ.get('HELIOS_PY') if helios_py and hasattr(os, 'add_dll_directory'): _helios_dll_dir = os.add_dll_directory(helios_py) failed = [] for mod in ['cv2', 'win32api']: try: __import__(mod) except Exception: failed.append(mod + ':\n' + traceback.format_exc().strip()) if failed: print('\n\n'.join(failed)) sys.exit(1) sys.exit(0) "3⤵
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -c "import os, sys, traceback _helios_dll_dir = None helios_py = os.environ.get('HELIOS_PY') if helios_py and hasattr(os, 'add_dll_directory'): _helios_dll_dir = os.add_dll_directory(helios_py) failed = [] for mod in ['cv2', 'win32api']: try: __import__(mod) except Exception: failed.append(mod + ':\n' + traceback.format_exc().strip()) if failed: print('\n\n'.join(failed)) sys.exit(1) sys.exit(0) "4⤵
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exe --version3⤵
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exe cache prune --ci3⤵
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\uv.exe pip list --format json --python C:/Users/Admin/AppData/Local/HeliosProject/Helios/python/cv/.henv/Scripts/python.exe3⤵
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe --version3⤵
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" --version4⤵
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe -E -s -u -X utf8 -c " import importlib import json import os import sys print(f\"HELIOS_PYTHON_PROBE_VERSION={sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}\", flush=True) helios_py = os.environ.get(\"HELIOS_PY\", \"\") _helios_dll_dir = os.add_dll_directory(helios_py) if helios_py and hasattr(os, \"add_dll_directory\") else None if helios_py: sys.path.insert(0, helios_py) module_specs = [] if os.environ.get(\"HELIOS_VALIDATE_CV_HOST\") == \"1\": module_specs.append((\"cvpython_host\", \"cvpython_host\")) module_specs.extend([ (\"numpy\", \"numpy\"), (\"opencv\", \"cv2\"), (\"pywin32\", \"win32api\"), ]) modules = {} for key, module_name in module_specs: print(f\"HELIOS_PYTHON_PROBE_IMPORT={key}\", flush=True) try: module = importlib.import_module(module_name) except BaseException as error: modules[key] = { \"ok\": False, \"error\": f\"{type(error).__name__}: {error}\", } else: modules[key] = { \"ok\": True, \"path\": str(getattr(module, \"__file__\", \"\") or \"\"), \"version\": str(getattr(module, \"__version__\", \"\") or \"\"), } print(\"HELIOS_PYTHON_PROBE_RESULT=\" + json.dumps({\"modules\": modules}, separators=(\",\", \":\")), flush=True) "3⤵
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -E -s -u -X utf8 -c " import importlib import json import os import sys print(f\"HELIOS_PYTHON_PROBE_VERSION={sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}\", flush=True) helios_py = os.environ.get(\"HELIOS_PY\", \"\") _helios_dll_dir = os.add_dll_directory(helios_py) if helios_py and hasattr(os, \"add_dll_directory\") else None if helios_py: sys.path.insert(0, helios_py) module_specs = [] if os.environ.get(\"HELIOS_VALIDATE_CV_HOST\") == \"1\": module_specs.append((\"cvpython_host\", \"cvpython_host\")) module_specs.extend([ (\"numpy\", \"numpy\"), (\"opencv\", \"cv2\"), (\"pywin32\", \"win32api\"), ]) modules = {} for key, module_name in module_specs: print(f\"HELIOS_PYTHON_PROBE_IMPORT={key}\", flush=True) try: module = importlib.import_module(module_name) except BaseException as error: modules[key] = { \"ok\": False, \"error\": f\"{type(error).__name__}: {error}\", } else: modules[key] = { \"ok\": True, \"path\": str(getattr(module, \"__file__\", \"\") or \"\"), \"version\": str(getattr(module, \"__version__\", \"\") or \"\"), } print(\"HELIOS_PYTHON_PROBE_RESULT=\" + json.dumps({\"modules\": modules}, separators=(\",\", \":\")), flush=True) "4⤵
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe -E -s -u -X utf8 -c " import importlib import json import os import sys print(f\"HELIOS_PYTHON_PROBE_VERSION={sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}\", flush=True) helios_py = os.environ.get(\"HELIOS_PY\", \"\") _helios_dll_dir = os.add_dll_directory(helios_py) if helios_py and hasattr(os, \"add_dll_directory\") else None if helios_py: sys.path.insert(0, helios_py) module_specs = [] if os.environ.get(\"HELIOS_VALIDATE_CV_HOST\") == \"1\": module_specs.append((\"cvpython_host\", \"cvpython_host\")) module_specs.extend([ (\"numpy\", \"numpy\"), (\"opencv\", \"cv2\"), (\"pywin32\", \"win32api\"), ]) modules = {} for key, module_name in module_specs: print(f\"HELIOS_PYTHON_PROBE_IMPORT={key}\", flush=True) try: module = importlib.import_module(module_name) except BaseException as error: modules[key] = { \"ok\": False, \"error\": f\"{type(error).__name__}: {error}\", } else: modules[key] = { \"ok\": True, \"path\": str(getattr(module, \"__file__\", \"\") or \"\"), \"version\": str(getattr(module, \"__version__\", \"\") or \"\"), } print(\"HELIOS_PYTHON_PROBE_RESULT=\" + json.dumps({\"modules\": modules}, separators=(\",\", \":\")), flush=True) "3⤵
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -E -s -u -X utf8 -c " import importlib import json import os import sys print(f\"HELIOS_PYTHON_PROBE_VERSION={sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}\", flush=True) helios_py = os.environ.get(\"HELIOS_PY\", \"\") _helios_dll_dir = os.add_dll_directory(helios_py) if helios_py and hasattr(os, \"add_dll_directory\") else None if helios_py: sys.path.insert(0, helios_py) module_specs = [] if os.environ.get(\"HELIOS_VALIDATE_CV_HOST\") == \"1\": module_specs.append((\"cvpython_host\", \"cvpython_host\")) module_specs.extend([ (\"numpy\", \"numpy\"), (\"opencv\", \"cv2\"), (\"pywin32\", \"win32api\"), ]) modules = {} for key, module_name in module_specs: print(f\"HELIOS_PYTHON_PROBE_IMPORT={key}\", flush=True) try: module = importlib.import_module(module_name) except BaseException as error: modules[key] = { \"ok\": False, \"error\": f\"{type(error).__name__}: {error}\", } else: modules[key] = { \"ok\": True, \"path\": str(getattr(module, \"__file__\", \"\") or \"\"), \"version\": str(getattr(module, \"__version__\", \"\") or \"\"), } print(\"HELIOS_PYTHON_PROBE_RESULT=\" + json.dumps({\"modules\": modules}, separators=(\",\", \":\")), flush=True) "4⤵
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe -E -s -c "import json,site,sys;print('HELIOS_PYTHON_LAYOUT='+json.dumps({'prefix':sys.prefix,'paths':sys.path,'sites':site.getsitepackages()}))"3⤵
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -E -s -c "import json,site,sys;print('HELIOS_PYTHON_LAYOUT='+json.dumps({'prefix':sys.prefix,'paths':sys.path,'sites':site.getsitepackages()}))"4⤵
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe -E -s -u -X utf8 -c "import os, sys; helios_py = os.environ['HELIOS_PY']; _helios_dll_dir = os.add_dll_directory(helios_py) if hasattr(os, 'add_dll_directory') else None; sys.path.insert(0, helios_py); import cvpython_host; raise SystemExit(cvpython_host.run_argv(sys.argv[1:]))" --helios-launch-pipe \\.\pipe\Helios-d566445adf331169c7b302b8adb934a399dd23d252b65e4cb97244c31ce418c63⤵
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -E -s -u -X utf8 -c "import os, sys; helios_py = os.environ['HELIOS_PY']; _helios_dll_dir = os.add_dll_directory(helios_py) if hasattr(os, 'add_dll_directory') else None; sys.path.insert(0, helios_py); import cvpython_host; raise SystemExit(cvpython_host.run_argv(sys.argv[1:]))" --helios-launch-pipe \\.\pipe\Helios-d566445adf331169c7b302b8adb934a399dd23d252b65e4cb97244c31ce418c64⤵
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe -E -s -c "import json,site,sys;print('HELIOS_PYTHON_LAYOUT='+json.dumps({'prefix':sys.prefix,'paths':sys.path,'sites':site.getsitepackages()}))"3⤵
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -E -s -c "import json,site,sys;print('HELIOS_PYTHON_LAYOUT='+json.dumps({'prefix':sys.prefix,'paths':sys.path,'sites':site.getsitepackages()}))"4⤵
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe -E -s -u -X utf8 -c "import os, sys; helios_py = os.environ['HELIOS_PY']; _helios_dll_dir = os.add_dll_directory(helios_py) if hasattr(os, 'add_dll_directory') else None; sys.path.insert(0, helios_py); import cvpython_host; raise SystemExit(cvpython_host.run_argv(sys.argv[1:]))" --helios-launch-pipe \\.\pipe\Helios-95912621c381dea3fc62c1f0ebd855c44d2880ed22d08b6ecb01b593a5dfacd13⤵
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -E -s -u -X utf8 -c "import os, sys; helios_py = os.environ['HELIOS_PY']; _helios_dll_dir = os.add_dll_directory(helios_py) if hasattr(os, 'add_dll_directory') else None; sys.path.insert(0, helios_py); import cvpython_host; raise SystemExit(cvpython_host.run_argv(sys.argv[1:]))" --helios-launch-pipe \\.\pipe\Helios-95912621c381dea3fc62c1f0ebd855c44d2880ed22d08b6ecb01b593a5dfacd14⤵
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe -E -s -c "import json,site,sys;print('HELIOS_PYTHON_LAYOUT='+json.dumps({'prefix':sys.prefix,'paths':sys.path,'sites':site.getsitepackages()}))"3⤵
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -E -s -c "import json,site,sys;print('HELIOS_PYTHON_LAYOUT='+json.dumps({'prefix':sys.prefix,'paths':sys.path,'sites':site.getsitepackages()}))"4⤵
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe -E -s -u -X utf8 -c "import os, sys; helios_py = os.environ['HELIOS_PY']; _helios_dll_dir = os.add_dll_directory(helios_py) if hasattr(os, 'add_dll_directory') else None; sys.path.insert(0, helios_py); import cvpython_host; raise SystemExit(cvpython_host.run_argv(sys.argv[1:]))" --helios-launch-pipe \\.\pipe\Helios-d66e951e40b963e083be213e6f8e434bda6f362d032bfc3ae4decd24fd1ea7b23⤵
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -E -s -u -X utf8 -c "import os, sys; helios_py = os.environ['HELIOS_PY']; _helios_dll_dir = os.add_dll_directory(helios_py) if hasattr(os, 'add_dll_directory') else None; sys.path.insert(0, helios_py); import cvpython_host; raise SystemExit(cvpython_host.run_argv(sys.argv[1:]))" --helios-launch-pipe \\.\pipe\Helios-d66e951e40b963e083be213e6f8e434bda6f362d032bfc3ae4decd24fd1ea7b24⤵
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe -E -s -c "import json,site,sys;print('HELIOS_PYTHON_LAYOUT='+json.dumps({'prefix':sys.prefix,'paths':sys.path,'sites':site.getsitepackages()}))"3⤵
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -E -s -c "import json,site,sys;print('HELIOS_PYTHON_LAYOUT='+json.dumps({'prefix':sys.prefix,'paths':sys.path,'sites':site.getsitepackages()}))"4⤵
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe -E -s -u -X utf8 -c "import os, sys; helios_py = os.environ['HELIOS_PY']; _helios_dll_dir = os.add_dll_directory(helios_py) if hasattr(os, 'add_dll_directory') else None; sys.path.insert(0, helios_py); import cvpython_host; raise SystemExit(cvpython_host.run_argv(sys.argv[1:]))" --helios-launch-pipe \\.\pipe\Helios-81674bac8b9d1b56d6f9b149a445bd2efd9a93d1c95b6f837552f214b892f3943⤵
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -E -s -u -X utf8 -c "import os, sys; helios_py = os.environ['HELIOS_PY']; _helios_dll_dir = os.add_dll_directory(helios_py) if hasattr(os, 'add_dll_directory') else None; sys.path.insert(0, helios_py); import cvpython_host; raise SystemExit(cvpython_host.run_argv(sys.argv[1:]))" --helios-launch-pipe \\.\pipe\Helios-81674bac8b9d1b56d6f9b149a445bd2efd9a93d1c95b6f837552f214b892f3944⤵
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe -E -s -c "import json,site,sys;print('HELIOS_PYTHON_LAYOUT='+json.dumps({'prefix':sys.prefix,'paths':sys.path,'sites':site.getsitepackages()}))"3⤵
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -E -s -c "import json,site,sys;print('HELIOS_PYTHON_LAYOUT='+json.dumps({'prefix':sys.prefix,'paths':sys.path,'sites':site.getsitepackages()}))"4⤵
-
-
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exeC:\Users\Admin\AppData\Local\HeliosProject\Helios\python\cv\.henv\Scripts\python.exe -E -s -u -X utf8 -c "import os, sys; helios_py = os.environ['HELIOS_PY']; _helios_dll_dir = os.add_dll_directory(helios_py) if hasattr(os, 'add_dll_directory') else None; sys.path.insert(0, helios_py); import cvpython_host; raise SystemExit(cvpython_host.run_argv(sys.argv[1:]))" --helios-launch-pipe \\.\pipe\Helios-a31ca611ef6c5ce29cd9ff547ba73e83b9ccf34172672f57102c9033f61a23883⤵
-
C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe"C:\Users\Admin\AppData\Local\HeliosProject\Helios\python\managed-python\cpython-3.14-windows-x86_64-none\python.exe" -E -s -u -X utf8 -c "import os, sys; helios_py = os.environ['HELIOS_PY']; _helios_dll_dir = os.add_dll_directory(helios_py) if hasattr(os, 'add_dll_directory') else None; sys.path.insert(0, helios_py); import cvpython_host; raise SystemExit(cvpython_host.run_argv(sys.argv[1:]))" --helios-launch-pipe \\.\pipe\Helios-a31ca611ef6c5ce29cd9ff547ba73e83b9ccf34172672f57102c9033f61a23884⤵
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 87831C9F8A870071A31D64F9A5A1A3DE2⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe" -I -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python315\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpf_b0zes8\\pip-26.2.2-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpf_b0zes8', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
-
C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261025001639.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261025001639.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D08ACA5C-08BF-438F-8DC0-DF965587CB02} {9492A629-C246-4E16-8683-7E668B3F3CCF} 21644⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1164 -burn.embedded BurnPipe.{C74B2027-6F88-4FC7-B8E9-15A9B25A2CA6} {EDD40D3B-C1A6-42F3-8FB4-63FE72C7F8FA} 43685⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=548 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1164 -burn.embedded BurnPipe.{C74B2027-6F88-4FC7-B8E9-15A9B25A2CA6} {EDD40D3B-C1A6-42F3-8FB4-63FE72C7F8FA} 43686⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\obs-studio\bin\64bit\obs64.exe"C:\Program Files\obs-studio\bin\64bit\obs64.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\obs-studio\bin\64bit\obs-qsv-test.exe"C:/Program Files/obs-studio/bin/64bit/obs-qsv-test.exe" 508e 513a3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\obs-studio\data\obs-plugins\win-capture\get-graphics-offsets64.exe"../../data/obs-plugins/win-capture/get-graphics-offsets64.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\obs-studio\data\obs-plugins\win-capture\get-graphics-offsets32.exe"../../data/obs-plugins/win-capture/get-graphics-offsets32.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b0 0x4e41⤵
-
C:\Users\Admin\AppData\Local\Package Cache\{282cf187-a021-420e-8c80-5d74141ed8f6}\python-3.15.1-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{282cf187-a021-420e-8c80-5d74141ed8f6}\python-3.15.1-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{282cf187-a021-420e-8c80-5d74141ed8f6}\python-3.15.1-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{282cf187-a021-420e-8c80-5d74141ed8f6}\python-3.15.1-amd64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.15.1 (64-bit)_20261025002005.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{282cf187-a021-420e-8c80-5d74141ed8f6}\python-3.15.1-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{282cf187-a021-420e-8c80-5d74141ed8f6}\python-3.15.1-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{282cf187-a021-420e-8c80-5d74141ed8f6}\python-3.15.1-amd64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=548 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.15.1 (64-bit)_20261025002005.log"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\f.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5d4be5.rbs
e5d4bf1.rbs
e5d4bf8.rbs
e5d4c07.rbs
e5d4c0b.rbs
e5d4c0f.rbs
e5d4c14.rbs
e5d4c19.rbs
e5d4c1e.rbs
e5d4c25.rbs
e5d4c2a.rbs
e5d4c2f.rbs
e5d4c34.rbs
e5d4c39.rbs
avcodec-62.dll
libcurl.dll
obs64.exe
th-TH.ini
oc-FR.ini
color.effect
nn-NO.ini
get-graphics-offsets32.exe
package-schema.json
obs-virtualcam-module32.dll
obs-virtualcam-module64.dll
headphones.svg
media_pause.svg
media.svg
media_pause.svg
mute.svg
media.svg
checkbox_checked_focus.png
sizegrip.png
OBS Studio.lnk
state.rsm
state.rsm
vc_runtimeMinimum_x64.msi
graphics-hook32.dll
graphics-hook64.dll
obs-vulkan32.json
obs-vulkan64.json
1ab7aa1b854459a7.v2
4545d6ee7b176b7d.v2
62281a72182c4ba6.v2
6a755cdc9e6092ae.v2
7a6e3fecabdd460d.v2
7f0084f9c4106e16.v2
8d390f4ad08d5c53.v2
9ea4a251d7aa3c18.v2
cd9cfd09db70c3cd.v2
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
2f191d8f-2138-4477-bef3-e9a73e7de04f.tmp
31ebb6ab-7ea3-4caf-8656-7f18644e0638.tmp
9f0514e2-5ae7-4947-b7d7-6e5a054cf0e4.tmp
016a35d3-813e-49c4-af1b-31dc2606b42b.tmp
04ec6f12-dd83-4f0b-9c90-1881f5cab3b8.tmp
0f53681c-2460-473b-bf42-cc5d0c4009d4.tmp
129efb28-27fd-4d24-9141-89999418711a.tmp
1b86d5df-6d55-4dcc-bf48-5d41b974e100.tmp
1d8b0206-7351-403a-8933-606f2e8f6251.tmp
33557e98-2cf8-4f0f-b6f5-233479cd74bb.tmp
3471916b-fa0b-4ced-81b5-c31b2633f0b5.tmp
374a3781-413b-44bb-8a5e-dc86bee80931.tmp
428e11a6-dcd2-4ff6-9a97-2eb3ffa0fcb8.tmp
628fabed-798c-46c2-97b0-949c0edbcd6e.tmp
630ccd5c-be23-4269-900b-b39886961bc9.tmp
646071e7-6a87-44e4-8f3b-00fb7fe305ab.tmp
67117408-31a0-4a96-ab40-207e65acd480.tmp
8596ae14-e9a5-464a-b0ae-640bc6a91edc.tmp
892ca542-1831-4940-8ab4-9a9af4b10c74.tmp
f_000004
f_000005
f_000006
f_000007
f_000008
f_00000c
f_00000e
f_000011
f_000012
f_000013
f_00001f
f_000020
f_000021
f_000029
f_000034
f_000035
f_000045
045dbe8dd6b49c1b_0
0511d0df96ed172d_0
07d57ece73420f44_0
09eef06a89264f55_0
0a46f4e73994264e_0
0da0b34df8106c6b_0
0e7079608d2a8ca5_0
1d03f7830ffa7c42_0
2145d71114613b45_0
2265164b8561c261_0
237f5a6fdb67d60b_0
246f0e6ecf4533ea_0
2ef29fb7fde9620d_0
3479a431e1411a10_0
3502f60aec7ccfc2_0
3eb03b7decf08b4a_0
4015da15741663a8_0
48960c23b33f4235_0
48dced266d11b12f_0
4b680a112d8f810d_0
521100516546a527_0
5db0e8c09b080329_0
666520e60eaf5819_0
69c0433101754df3_0
69e7839ad90f6647_0
78f04de0238373ef_0
7e4a553ee73a371a_0
80237b08591c5917_0
8cbbcefa58b25136_0
8d6a02d59614c805_0
9aa5910825fa4724_0
9d211e086b095374_0
a40d52c5c6f8f87b_0
ada3a73627c776b8_0
afd94b6980618555_0
b48658eee9781fe3_0
b7186eb12028a182_0
bc0fd9f3b7734362_0
c0f67d671d49a2ac_0
c878bd3e3099ad22_0
db50d860ef77b24d_0
e4fbbdc312bd656c_0
e86c263179dad06a_0
eece8fd79ff6f131_0
eff46b7169386c2b_0
f37f88677ab65424_0
f666ddcd29ff0a0c_0
f9994709cb446227_0
fea8ca3b5de69361_0
fff132b6ccea4668_0
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
the-real-index
021ad5ba-c0f7-4ac9-9fe3-7b545d563f0f.tmp
0d0b9106-88ee-46f2-b9d7-6edb1c8374df.tmp
1bb1638e-8e52-4cdc-b5ce-6deba6e1a1c0.tmp
38d2dd19-d927-42d9-be61-89f335034f81.tmp
4a86b95a-40a6-4a0f-9a37-882880b4812c.tmp
5b5a00f2-3977-4c4c-85d2-b1ee19f2b674.tmp
76a0ac5d-c1b5-4b82-bbbe-88b06b50abbe.tmp
8a9a5d76-8e79-4809-854c-ad8587dc0395.tmp
SCT Auditing Pending Reports
b947fee8-5022-434f-953a-ec35b8a2dd50.tmp
e0e3214c-2f8c-4576-b92b-091a3defc898.tmp
fe680a79-2f87-4d20-a0d6-7cea5fa7d2e7.tmp
cc3f49d022fd55ad_0
temp-index
c5740fcf-93c7-4f31-bce2-87c7e69e730e.tmp
d7e89bbf-3d4e-4998-9fe5-cf5aa11fbc7a.tmp
dd533827-b971-474e-92d8-3d31eaaed48e.tmp
de7e3612-0dc7-42d4-809a-7011fcbedf62.tmp
e3ba4687-4689-4b64-9549-ded1406f8d47.tmp
f71ffbaa-eec5-4ecd-90a8-f425bbe73921.tmp
f95b5b05-fe53-419f-a690-e13ff8013fc4.tmp
b55e2f53-115d-4800-90c8-f8e20e8c56bf.tmp
b98761a4-9fc6-4457-bb4c-69d24555ba81.tmp
d38b3c48-cea4-49b2-b61c-37a2de9d8d10.tmp
d9abc3a2-425d-4a33-adf9-0e65887115e9.tmp
dcb7acba-482a-404c-aa33-26a6e0e4952e.tmp
e4598f2a-ee4d-455c-93ee-877e03ce08be.tmp
e668db50-5ec1-48a6-8989-263988c62ce2.tmp
f9a35c62-a71f-47b5-92c8-ac3749772773.tmp
chevron-down-disabled.svg
chevron-right-disabled.svg
combobox-arrow-disabled.svg
combobox-arrow.svg
radio-dot.svg
uv_build.json
cffi-gen-src.exe
f2py.exe
idna.exe
mss.exe
normalizer.exe
python.exe
pythonw.exe
pywin32_postinstall.exe
pywin32_testall.exe
range-detector
idle.ico
annotationlib.cpython-314.pyc.1738297944816
ast.cpython-314.pyc.2362996056560
copy.cpython-314.pyc.2362996050032
enum.cpython-314.pyc.2362980605872
glob.cpython-314.pyc.1738299668208
inspect.cpython-314.pyc.2362996050800
locale.cpython-314.pyc.1738299917296
lzma.cpython-314.pyc.2362997248368
ssl.cpython-314.pyc.1738302983024
subprocess.cpython-314.pyc.1738299918640
tempfile.cpython-314.pyc.1738299931312
textwrap.cpython-314.pyc.2362996048688
threading.cpython-314.pyc.1738299654576
typing.cpython-314.pyc.2362980598000
__init__.cpython-314.pyc.1738298916128
_zstdfile.cpython-314.pyc.1738300785104
__init__.cpython-314.pyc.1738288633584
__init__.cpython-314.pyc.2362996776928
_os.cpython-314.pyc.2362996895024
_compiler.cpython-314.pyc.2362980606064
__init__.cpython-314.pyc.2362995058480
__init__.cpython-314.pyc.1738300788848
request.cpython-314.pyc.1738301463536
__init__.cpython-314.pyc.2362997919648
glob.cpython-314.pyc.2362997920688
python.exe
doc_JustForMe
lib_JustForMe
tcltk_JustForMe
INSTALLER
RECORD
LICENSE
LICENSE
__init__.py
__main__.py
__pip-runner__.py
__init__.cpython-315.pyc
__main__.cpython-315.pyc
__pip-runner__.cpython-315.pyc
__init__.py
__init__.cpython-315.pyc
cache.cpython-315.pyc
configuration.cpython-315.pyc
exceptions.cpython-315.pyc
main.cpython-315.pyc
pyproject.cpython-315.pyc
self_outdated_check.cpython-315.pyc
wheel_builder.cpython-315.pyc
__init__.py
__init__.cpython-315.pyc
base.cpython-315.pyc
installer.cpython-315.pyc
noop.cpython-315.pyc
venv.cpython-315.pyc
virtual.cpython-315.pyc
base.py
installer.py
noop.py
venv.py
virtual.py
cache.py
__init__.py
__init__.cpython-315.pyc
autocompletion.cpython-315.pyc
base_command.cpython-315.pyc
cmdoptions.cpython-315.pyc
command_context.cpython-315.pyc
index_command.cpython-315.pyc
main.cpython-315.pyc
main_parser.cpython-315.pyc
parser.cpython-315.pyc
progress_bars.cpython-315.pyc
req_command.cpython-315.pyc
spinners.cpython-315.pyc
status_codes.cpython-315.pyc
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
index_command.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
__init__.cpython-315.pyc
cache.cpython-315.pyc
check.cpython-315.pyc
completion.cpython-315.pyc
configuration.cpython-315.pyc
debug.cpython-315.pyc
download.cpython-315.pyc
freeze.cpython-315.pyc
hash.cpython-315.pyc
help.cpython-315.pyc
index.cpython-315.pyc
inspect.cpython-315.pyc
install.cpython-315.pyc
list.cpython-315.pyc
lock.cpython-315.pyc
search.cpython-315.pyc
show.cpython-315.pyc
uninstall.cpython-315.pyc
wheel.cpython-315.pyc
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
lock.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
__init__.cpython-315.pyc
base.cpython-315.pyc
installed.cpython-315.pyc
sdist.cpython-315.pyc
wheel.cpython-315.pyc
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
__init__.cpython-315.pyc
collector.cpython-315.pyc
package_finder.cpython-315.pyc
sources.cpython-315.pyc
collector.py
package_finder.py
sources.py
__init__.py
__init__.cpython-315.pyc
_distutils.cpython-315.pyc
_sysconfig.cpython-315.pyc
base.cpython-315.pyc
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
__init__.cpython-315.pyc
_json.cpython-315.pyc
base.cpython-315.pyc
pkg_resources.cpython-315.pyc
_json.py
base.py
__init__.py
__init__.cpython-315.pyc
_compat.cpython-315.pyc
_dists.cpython-315.pyc
_envs.cpython-315.pyc
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
__init__.cpython-315.pyc
candidate.cpython-315.pyc
direct_url.cpython-315.pyc
format_control.cpython-315.pyc
index.cpython-315.pyc
installation_report.cpython-315.pyc
link.cpython-315.pyc
release_control.cpython-315.pyc
scheme.cpython-315.pyc
search_scope.cpython-315.pyc
selection_prefs.cpython-315.pyc
target_python.cpython-315.pyc
wheel.cpython-315.pyc
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
release_control.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
__init__.cpython-315.pyc
auth.cpython-315.pyc
cache.cpython-315.pyc
download.cpython-315.pyc
lazy_wheel.cpython-315.pyc
session.cpython-315.pyc
utils.cpython-315.pyc
xmlrpc.cpython-315.pyc
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
__init__.cpython-315.pyc
check.cpython-315.pyc
freeze.cpython-315.pyc
prepare.cpython-315.pyc
__init__.cpython-315.pyc
build_tracker.cpython-315.pyc
metadata.cpython-315.pyc
metadata_editable.cpython-315.pyc
wheel.cpython-315.pyc
wheel_editable.cpython-315.pyc
build_tracker.py
metadata.py
metadata_editable.py
wheel.py
wheel_editable.py
check.py
freeze.py
__init__.py
__init__.cpython-315.pyc
wheel.cpython-315.pyc
wheel.py
prepare.py
pyproject.py
__init__.py
__init__.cpython-315.pyc
constructors.cpython-315.pyc
pep723.cpython-315.pyc
req_dependency_group.cpython-315.pyc
req_file.cpython-315.pyc
req_install.cpython-315.pyc
req_set.cpython-315.pyc
req_uninstall.cpython-315.pyc
constructors.py
pep723.py
req_dependency_group.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
__init__.cpython-315.pyc
base.cpython-315.pyc
base.py
__init__.cpython-315.pyc
resolver.cpython-315.pyc
resolver.py
__init__.cpython-315.pyc
base.cpython-315.pyc
candidates.cpython-315.pyc
factory.cpython-315.pyc
found_candidates.cpython-315.pyc
provider.cpython-315.pyc
reporter.cpython-315.pyc
requirements.cpython-315.pyc
resolver.cpython-315.pyc
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
__init__.cpython-315.pyc
_jaraco_text.cpython-315.pyc
_log.cpython-315.pyc
appdirs.cpython-315.pyc
compat.cpython-315.pyc
compatibility_tags.cpython-315.pyc
datetime.cpython-315.pyc
deprecation.cpython-315.pyc
direct_url_helpers.cpython-315.pyc
egg_link.cpython-315.pyc
entrypoints.cpython-315.pyc
filesystem.cpython-315.pyc
filetypes.cpython-315.pyc
glibc.cpython-315.pyc
hashes.cpython-315.pyc
logging.cpython-315.pyc
misc.cpython-315.pyc
packaging.cpython-315.pyc
pylock.cpython-315.pyc
retry.cpython-315.pyc
subprocess.cpython-315.pyc
temp_dir.cpython-315.pyc
unpacking.cpython-315.pyc
urls.cpython-315.pyc
virtualenv.cpython-315.pyc
wheel.cpython-315.pyc
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
packaging.py
pylock.py
retry.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
__init__.cpython-315.pyc
bazaar.cpython-315.pyc
git.cpython-315.pyc
mercurial.cpython-315.pyc
subversion.cpython-315.pyc
versioncontrol.cpython-315.pyc
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.cpython-315.pyc
LICENSE.txt
__init__.py
__init__.cpython-315.pyc
_cmd.cpython-315.pyc
adapter.cpython-315.pyc
cache.cpython-315.pyc
controller.cpython-315.pyc
filewrapper.cpython-315.pyc
heuristics.cpython-315.pyc
serialize.cpython-315.pyc
wrapper.cpython-315.pyc
_cmd.py
adapter.py
cache.py
__init__.py
__init__.cpython-315.pyc
file_cache.cpython-315.pyc
redis_cache.cpython-315.pyc
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
LICENSE
__init__.py
__main__.py
__init__.cpython-315.pyc
__main__.cpython-315.pyc
core.cpython-315.pyc
cacert.pem
core.py
__init__.cpython-315.pyc
test_certify.cpython-315.pyc
test_certify.py
LICENSE.txt
__init__.py
__init__.cpython-315.pyc
compat.cpython-315.pyc
resources.cpython-315.pyc
scripts.cpython-315.pyc
util.cpython-315.pyc
compat.py
resources.py
scripts.py
util.py
LICENSE
__init__.py
__main__.py
__init__.cpython-315.pyc
__main__.cpython-315.pyc
distro.cpython-315.pyc
distro.py
LICENSE.md
__init__.py
__main__.py
__init__.cpython-315.pyc
__main__.cpython-315.pyc
cli.cpython-315.pyc
codec.cpython-315.pyc
compat.cpython-315.pyc
core.cpython-315.pyc
idnadata.cpython-315.pyc
intranges.cpython-315.pyc
package_data.cpython-315.pyc
uts46data.cpython-315.pyc
cli.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
COPYING
__init__.py
__init__.cpython-315.pyc
exceptions.cpython-315.pyc
ext.cpython-315.pyc
fallback.cpython-315.pyc
exceptions.py
ext.py
fallback.py
LICENSE
LICENSE.BSD
__init__.py
__init__.cpython-315.pyc
_elffile.cpython-315.pyc
_manylinux.cpython-315.pyc
_musllinux.cpython-315.pyc
_parser.cpython-315.pyc
_structures.cpython-315.pyc
_tokenizer.cpython-315.pyc
dependency_groups.cpython-315.pyc
direct_url.cpython-315.pyc
errors.cpython-315.pyc
markers.cpython-315.pyc
metadata.cpython-315.pyc
pylock.cpython-315.pyc
requirements.cpython-315.pyc
specifiers.cpython-315.pyc
tags.cpython-315.pyc
utils.cpython-315.pyc
version.cpython-315.pyc
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
dependency_groups.py
direct_url.py
errors.py
__init__.py
__init__.cpython-315.pyc
_spdx.cpython-315.pyc
_spdx.py
markers.py
metadata.py
pylock.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
LICENSE
__init__.py
__init__.cpython-315.pyc
LICENSE
__init__.py
__main__.py
__init__.cpython-315.pyc
__main__.cpython-315.pyc
_xdg.cpython-315.pyc
android.cpython-315.pyc
api.cpython-315.pyc
macos.cpython-315.pyc
unix.cpython-315.pyc
version.cpython-315.pyc
windows.cpython-315.pyc
_xdg.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
LICENSE
__init__.py
__main__.py
__init__.cpython-315.pyc
__main__.cpython-315.pyc
console.cpython-315.pyc
filter.cpython-315.pyc
formatter.cpython-315.pyc
lexer.cpython-315.pyc
modeline.cpython-315.pyc
plugin.cpython-315.pyc
regexopt.cpython-315.pyc
scanner.cpython-315.pyc
sphinxext.cpython-315.pyc
style.cpython-315.pyc
token.cpython-315.pyc
unistring.cpython-315.pyc
util.cpython-315.pyc
console.py
filter.py
__init__.py
__init__.cpython-315.pyc
formatter.py
__init__.py
__init__.cpython-315.pyc
_mapping.cpython-315.pyc
_mapping.py
lexer.py
__init__.py
__init__.cpython-315.pyc
_mapping.cpython-315.pyc
python.cpython-315.pyc
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
__init__.cpython-315.pyc
_mapping.cpython-315.pyc
_mapping.py
token.py
unistring.py
util.py
LICENSE
__init__.py
__init__.cpython-315.pyc
_impl.cpython-315.pyc
_impl.py
__init__.py
__init__.cpython-315.pyc
_in_process.cpython-315.pyc
_in_process.py
__init__.py
__init__.cpython-315.pyc
__version__.cpython-315.pyc
_internal_utils.cpython-315.pyc
_types.cpython-315.pyc
adapters.cpython-315.pyc
api.cpython-315.pyc
auth.cpython-315.pyc
certs.cpython-315.pyc
compat.cpython-315.pyc
cookies.cpython-315.pyc
exceptions.cpython-315.pyc
help.cpython-315.pyc
hooks.cpython-315.pyc
models.cpython-315.pyc
packages.cpython-315.pyc
sessions.cpython-315.pyc
status_codes.cpython-315.pyc
structures.cpython-315.pyc
utils.cpython-315.pyc
__version__.py
_internal_utils.py
_types.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
LICENSE
__init__.py
__init__.cpython-315.pyc
providers.cpython-315.pyc
reporters.cpython-315.pyc
structs.cpython-315.pyc
providers.py
reporters.py
__init__.py
__init__.cpython-315.pyc
abstract.cpython-315.pyc
criterion.cpython-315.pyc
exceptions.cpython-315.pyc
resolution.cpython-315.pyc
abstract.py
criterion.py
exceptions.py
resolution.py
structs.py
LICENSE
__init__.py
__main__.py
__init__.cpython-315.pyc
__main__.cpython-315.pyc
_cell_widths.cpython-315.pyc
_emoji_codes.cpython-315.pyc
_emoji_replace.cpython-315.pyc
_export_format.cpython-315.pyc
_extension.cpython-315.pyc
_fileno.cpython-315.pyc
_inspect.cpython-315.pyc
_log_render.cpython-315.pyc
_loop.cpython-315.pyc
_null_file.cpython-315.pyc
_palettes.cpython-315.pyc
_pick.cpython-315.pyc
_ratio.cpython-315.pyc
_spinners.cpython-315.pyc
_stack.cpython-315.pyc
_timer.cpython-315.pyc
_win32_console.cpython-315.pyc
_windows.cpython-315.pyc
_windows_renderer.cpython-315.pyc
_wrap.cpython-315.pyc
abc.cpython-315.pyc
align.cpython-315.pyc
ansi.cpython-315.pyc
bar.cpython-315.pyc
box.cpython-315.pyc
cells.cpython-315.pyc
color.cpython-315.pyc
color_triplet.cpython-315.pyc
columns.cpython-315.pyc
console.cpython-315.pyc
constrain.cpython-315.pyc
containers.cpython-315.pyc
control.cpython-315.pyc
default_styles.cpython-315.pyc
diagnose.cpython-315.pyc
emoji.cpython-315.pyc
errors.cpython-315.pyc
file_proxy.cpython-315.pyc
filesize.cpython-315.pyc
highlighter.cpython-315.pyc
json.cpython-315.pyc
jupyter.cpython-315.pyc
layout.cpython-315.pyc
live.cpython-315.pyc
live_render.cpython-315.pyc
logging.cpython-315.pyc
markup.cpython-315.pyc
measure.cpython-315.pyc
padding.cpython-315.pyc
pager.cpython-315.pyc
palette.cpython-315.pyc
panel.cpython-315.pyc
pretty.cpython-315.pyc
progress.cpython-315.pyc
progress_bar.cpython-315.pyc
prompt.cpython-315.pyc
protocol.cpython-315.pyc
region.cpython-315.pyc
repr.cpython-315.pyc
rule.cpython-315.pyc
scope.cpython-315.pyc
screen.cpython-315.pyc
segment.cpython-315.pyc
spinner.cpython-315.pyc
status.cpython-315.pyc
style.cpython-315.pyc
styled.cpython-315.pyc
syntax.cpython-315.pyc
table.cpython-315.pyc
terminal_theme.cpython-315.pyc
text.cpython-315.pyc
theme.cpython-315.pyc
themes.cpython-315.pyc
traceback.cpython-315.pyc
tree.cpython-315.pyc
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
__init__.py
__init__.cpython-315.pyc
_parser.cpython-315.pyc
_re.cpython-315.pyc
_types.cpython-315.pyc
_parser.py
_re.py
_types.py
__init__.py
__init__.cpython-315.pyc
_writer.cpython-315.pyc
_writer.py
py.typed
LICENSE
__init__.py
__init__.cpython-315.pyc
_api.cpython-315.pyc
_macos.cpython-315.pyc
_openssl.cpython-315.pyc
_ssl_constants.cpython-315.pyc
_windows.cpython-315.pyc
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
LICENSE.txt
__init__.py
__init__.cpython-315.pyc
_base_connection.cpython-315.pyc
_collections.cpython-315.pyc
_request_methods.cpython-315.pyc
_version.cpython-315.pyc
connection.cpython-315.pyc
connectionpool.cpython-315.pyc
exceptions.cpython-315.pyc
fields.cpython-315.pyc
filepost.cpython-315.pyc
poolmanager.cpython-315.pyc
response.cpython-315.pyc
_base_connection.py
_collections.py
_request_methods.py
_version.py
connection.py
connectionpool.py
__init__.cpython-315.pyc
pyopenssl.cpython-315.pyc
socks.cpython-315.pyc
__init__.py
__init__.cpython-315.pyc
connection.cpython-315.pyc
fetch.cpython-315.pyc
request.cpython-315.pyc
response.cpython-315.pyc
connection.py
fetch.py
request.py
response.py
pyopenssl.py
socks.py
exceptions.py
fields.py
filepost.py
__init__.py
__init__.cpython-315.pyc
connection.cpython-315.pyc
probe.cpython-315.pyc
connection.py
probe.py
poolmanager.py
response.py
__init__.py
__init__.cpython-315.pyc
connection.cpython-315.pyc
proxy.cpython-315.pyc
request.cpython-315.pyc
response.cpython-315.pyc
retry.cpython-315.pyc
ssl_.cpython-315.pyc
ssl_match_hostname.cpython-315.pyc
ssltransport.cpython-315.pyc
timeout.cpython-315.pyc
url.cpython-315.pyc
util.cpython-315.pyc
wait.cpython-315.pyc
connection.py
proxy.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
util.py
wait.py
__init__.py
__main__.py
test_foo.py
pip3.exe
python.exe
MSId6c59.LOG
__PSScriptPolicyTest_vrqqk4ny.tsi.ps1
dd_vcredist_amd64_20261025001639_000_vcRuntimeMinimum_x64.log
dd_vcredist_amd64_20261025001639_001_vcRuntimeAdditional_x64.log
InstallOptions.dll
OBSInstallerUtils.dll
System.dll
VC_redist.x64.exe
check_for_64bit_visual_studio_2022_runtimes.exe
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
modern-wizard.bmp
pywinusb-0.4.2-py3.14-nspkg.pth
License.txt
__init__.py
__init__.py
_imagingtk.pyi
INSTALLER
WHEEL
WHEEL
emscripten_fetch_worker.js
py.typed
METADATA
RECORD
WHEEL
entry_points.txt
py.typed
RECORD
RECORD
RECORD
_text.py
diagnose.py
RECORD
top_level.txt
RECORD
RECORD
RECORD
RECORD
RECORD
RECORD
RECORD
RECORD
LICENSE
cli.exe
gui.exe
RECORD
WHEEL
RECORD
RECORD
RECORD
WHEEL
LICENSE.txt
LICENSE
LICENSE.md
__init__.py
RECORD
demoutils.py
RECORD
license.txt
License.txt
README.txt
License.txt
LICENSE.txt
pywin32_postinstall.py
pywin32_testall.py
__init__.py
pycom_blowing.gif
MAPIStubLibrary-License.txt
LICENSE-3RD-PARTY.txt
LICENSE.txt
RECORD
RECORD
RECORD
RECORD
RECORD
RECORD
RECORD
RECORD
RECORD
RECORD
.gitignore
CACHEDIR.TAG
text_file.cpython-314.pyc.2363030663984
more.cpython-314.pyc.2362996063856
_spdx.cpython-314.pyc.2363026389872
LICENSE.txt
pyvenv.cfg
021373281c6fd678.msgpack
0988dff75d6cb327.msgpack
imutils-0.5.4-py3-none-any.whl
metadata.msgpack
__init__.py
contours.py
convenience.py
encodings.py
__init__.py
facealigner.py
helpers.py
__init__.py
dense.py
factories.py
gftt.py
harris.py
helpers.py
rootsift.py
__init__.py
tempfile.py
meta.py
object_detection.py
paths.py
perspective.py
text.py
__init__.py
count_frames.py
filevideostream.py
fps.py
pivideostream.py
videostream.py
webcamvideostream.py
range-detector
PKG-INFO
SOURCES.txt
top_level.txt
revision.http
revision.http
metadata.msgpack
pywinusb-0.4.2-py3-none-any.whl
__init__.py
core.py
helpers.py
hid_pnp_mixin.py
tools.py
usage_pages.py
winapi.py
wnd_hook_mixin.py
PKG-INFO
SOURCES.txt
top_level.txt
certifi.rkyv
cffi.rkyv
charset-normalizer.rkyv
cryptography.rkyv
idna.rkyv
imutils.rkyv
mss.rkyv
numpy.rkyv
opencv-python.rkyv
pillow.rkyv
pycparser.rkyv
pywin32.rkyv
pywinusb.rkyv
requests.rkyv
scipy.rkyv
setuptools.rkyv
urllib3.rkyv
2026.10.23-py3-none-any.http
2026.10.23-py3-none-any.msgpack
2.1.1-cp314-cp314-win_amd64.http
2.1.1-cp314-cp314-win_amd64.msgpack
3.5.2-cp314-cp314-win_amd64.http
3.5.2-cp314-cp314-win_amd64.msgpack
50.0.2-cp311-abi3-win_amd64.http
50.0.2-cp311-abi3-win_amd64.msgpack
3.20-py3-none-any.http
3.20-py3-none-any.msgpack
10.2.0-py3-none-any.http
10.2.0-py3-none-any.msgpack
2.5.4-cp314-cp314-win_amd64.http
2.5.4-cp314-cp314-win_amd64.msgpack
5.0.0.93-cp37-abi3-win_amd64.http
5.0.0.93-cp37-abi3-win_amd64.msgpack
13.0.0-cp314-cp314-win_amd64.http
13.0.0-cp314-cp314-win_amd64.msgpack
3.12-py3-none-any.http
3.12-py3-none-any.msgpack
312-cp314-cp314-win_amd64.http
312-cp314-cp314-win_amd64.msgpack
2.34.2-py3-none-any.http
2.34.2-py3-none-any.msgpack
1.18.1-cp314-cp314-win_amd64.http
1.18.1-cp314-cp314-win_amd64.msgpack
84.2.1-py3-none-any.http
84.2.1-py3-none-any.msgpack
2.8.0-py3-none-any.http
2.8.0-py3-none-any.msgpack
basic.ini.tmp
Untitled.json.tmp
amazon_ivs_ingests.new.json
services.json
user.ini
user.ini.tmp
user.ini.tmp
0e966c1c-8ae2-4dbf-ac39-92903998ed64.tmp
Plugged-Vision-1.0.4-keyauth-2k-clean.zip.crdownload
PythonBA.dll
SideBar.png
python-3.15.1-amd64.exe
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
BootstrapperApplicationData.xml
VC_redist.x64.exe
BootstrapperApplicationData.xml
Default.thm
Default.wxl
BootstrapperApplicationData.xml
license.rtf
thm.wxl
thm.xml
logo.png
wixstdba.dll
cab2C04DDC374BD96EB5C8EB8208F2C7C92
cab5046A8AB272BF37297BB7928664C9503
vcRuntimeAdditional_x64
memory/820-38504-0x00007FFDF3EA0000-0x00007FFDF524D000-memory.dmp
memory/1724-210-0x00000159AED70000-0x00000159AED71000-memory.dmp
memory/1724-209-0x00000159AED70000-0x00000159AED71000-memory.dmp
memory/1724-38863-0x00000159AFF00000-0x00000159AFFA8000-memory.dmp
memory/1724-202-0x00007FF764710000-0x00007FF764B31000-memory.dmp
memory/1724-203-0x00007FFE24E10000-0x00007FFE253F0000-memory.dmp
memory/1724-211-0x00000159AED70000-0x00000159AED71000-memory.dmp
memory/1724-216-0x00000159AED70000-0x00000159AED71000-memory.dmp
memory/1724-221-0x00000159AED70000-0x00000159AED71000-memory.dmp
memory/1724-220-0x00000159AED70000-0x00000159AED71000-memory.dmp
memory/1724-219-0x00000159AED70000-0x00000159AED71000-memory.dmp
memory/1724-218-0x00000159AED70000-0x00000159AED71000-memory.dmp
memory/1724-217-0x00000159AED70000-0x00000159AED71000-memory.dmp
memory/1724-10033-0x00000159AFF00000-0x00000159AFFA8000-memory.dmp
memory/1724-215-0x00000159AED70000-0x00000159AED71000-memory.dmp
memory/2096-9202-0x00007FFE087F0000-0x00007FFE08800000-memory.dmp
memory/2096-9201-0x00007FF74C8D0000-0x00007FF74CE2B000-memory.dmp
memory/2096-9200-0x00007FF74C8D0000-0x00007FF74CE2B000-memory.dmp
memory/2096-9199-0x00007FFE1B830000-0x00007FFE1BE74000-memory.dmp
memory/2532-4818-0x0000000000260000-0x00000000002D7000-memory.dmp
memory/2820-4769-0x0000000000260000-0x00000000002D7000-memory.dmp
memory/4152-34167-0x00007FFDF3EA0000-0x00007FFDF524D000-memory.dmp
memory/4236-4777-0x0000000000260000-0x00000000002D7000-memory.dmp
memory/4624-4803-0x0000000000260000-0x00000000002D7000-memory.dmp
memory/5080-4776-0x0000000000260000-0x00000000002D7000-memory.dmp
memory/5408-13439-0x0000000000550000-0x00000000005DC000-memory.dmp
memory/5408-15234-0x0000000000550000-0x00000000005DC000-memory.dmp
memory/5840-15270-0x0000000000550000-0x00000000005DC000-memory.dmp
memory/5840-13438-0x0000000000550000-0x00000000005DC000-memory.dmp
memory/6752-20688-0x000002C11AC10000-0x000002C11AC32000-memory.dmp
memory/7144-38279-0x00007FFDF3EA0000-0x00007FFDF524D000-memory.dmp
memory/7352-38427-0x00007FFDF3EA0000-0x00007FFDF524D000-memory.dmp
memory/11904-34037-0x00007FFDF3EA0000-0x00007FFDF524D000-memory.dmp
memory/13596-34081-0x00007FFDF3EA0000-0x00007FFDF524D000-memory.dmp
memory/13704-34082-0x00007FFDF3EA0000-0x00007FFDF524D000-memory.dmp
memory/14060-34146-0x00007FFDF3EA0000-0x00007FFDF524D000-memory.dmp