Analysis

  • max time kernel
    682s
  • max time network
    692s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15/03/2024, 13:58

General

  • Target
    otpbulderzerodayexploitware.rar
  • Size 11.7MB
  • Sample240315-rablsacd25
  • SHA256 3023f261abee740b0f8c8866adb0751d7b8c51b7e3eeb1d8f6d3ef5219d745e9
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • asyncrat

Botnet
  • Default

C2
  • 127.0.0.1:6606

  • 127.0.0.1:7707

  • 127.0.0.1:8808

  • https://api.telegram.org/bot6381067446:AAEZEWH8wbF7Q1Kou81_S0sE6VwJZGJKneM/sendMessage?chat_id=5901231421

Mutex
  • AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 2 IoCs
  • Async RAT payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 8 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\otpbulderzerodayexploitware.rar
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\otpbulderzerodayexploitware.rar"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1364
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:568
    • C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\OTP BULDER @ZerodayExploitware.exe
      "C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\OTP BULDER @ZerodayExploitware.exe"
      1⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4112
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          3⤵
            PID:776
          • C:\Windows\SysWOW64\netsh.exe
            netsh wlan show profile
            3⤵
              PID:4008
            • C:\Windows\SysWOW64\findstr.exe
              findstr All
              3⤵
                PID:916
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:696
              • C:\Windows\SysWOW64\chcp.com
                chcp 65001
                3⤵
                  PID:2724
                • C:\Windows\SysWOW64\netsh.exe
                  netsh wlan show networks mode=bssid
                  3⤵
                    PID:4236
              • C:\Windows\system32\taskmgr.exe
                "C:\Windows\system32\taskmgr.exe" /0
                1⤵
                • Checks SCSI registry key(s)
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:4564

              Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    Bookmarks.txt

                    • Path C:\Users\Admin\AppData\Local\79c33c6b0e99e526a1b13feb15eb201a\Admin@RFQKXVFU_en-US\Browsers\Firefox\Bookmarks.txt
                    • Size 105B
                    • SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
                    • MD5 SHA1 SHA512

                    __init__.py

                    • Path C:\Users\Admin\AppData\Local\79c33c6b0e99e526a1b13feb15eb201a\Admin@RFQKXVFU_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Lib\concurrent\__init__.py
                    • Size 38B
                    • SHA256 87ad5c8954dd56fbbca04517bf87477ff4dce575170c7dd1281d7ef1f4214ac8
                    • MD5 SHA1 SHA512

                    cp949-utf8.txt

                    • Path C:\Users\Admin\AppData\Local\79c33c6b0e99e526a1b13feb15eb201a\Admin@RFQKXVFU_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Lib\test\cjkencodings\cp949-utf8.txt
                    • Size 478B
                    • SHA256 175e984c0c7bd073f037b0aaa6df4d8aadacb6f1b8898484a567b5e70f5a5837
                    • MD5 SHA1 SHA512

                    euc_jisx0213-utf8.txt

                    • Path C:\Users\Admin\AppData\Local\79c33c6b0e99e526a1b13feb15eb201a\Admin@RFQKXVFU_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Lib\test\cjkencodings\euc_jisx0213-utf8.txt
                    • Size 1KB
                    • SHA256 21cb011018b58c87f2c824e08085d24f9379244bcde6fbb6b46da2f6431540c7
                    • MD5 SHA1 SHA512

                    util.py

                    • Path C:\Users\Admin\AppData\Local\79c33c6b0e99e526a1b13feb15eb201a\Admin@RFQKXVFU_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Lib\test\test_import\data\circular_imports\util.py
                    • Size 21B
                    • SHA256 60f11f6f1c53b1e906df7819fd26fee3ee1e169741435ef6dddf9ad6dee31e48
                    • MD5 SHA1 SHA512

                    one.py

                    • Path C:\Users\Admin\AppData\Local\79c33c6b0e99e526a1b13feb15eb201a\Admin@RFQKXVFU_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Lib\test\test_importlib\namespace_pkgs\not_a_namespace_pkg\foo\one.py
                    • Size 26B
                    • SHA256 de46da9948a760db50b2abcc66b858f5b0bcc48f364f483f60721c75c13df51c
                    • MD5 SHA1 SHA512

                    empty_object.json

                    • Path C:\Users\Admin\AppData\Local\79c33c6b0e99e526a1b13feb15eb201a\Admin@RFQKXVFU_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Modules\_xxtestfuzz\fuzz_json_loads_corpus\empty_object.json
                    • Size 3B
                    • SHA256 ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
                    • MD5 SHA1 SHA512

                    colors.css

                    • Path C:\Users\Admin\AppData\Local\79c33c6b0e99e526a1b13feb15eb201a\Admin@RFQKXVFU_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Python\ThirdParty\parallel-hashmap\css\colors.css
                    • Size 3KB
                    • SHA256 75fe5c7acedf36d2a4d450f2c1b30782fefb72d1933385dc50dbc323135ea633
                    • MD5 SHA1 SHA512

                    full_implicit_test.py

                    • Path C:\Users\Admin\AppData\Local\79c33c6b0e99e526a1b13feb15eb201a\Admin@RFQKXVFU_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\RuntimeTests\StrictModules\Tests\comparison_tests\imports\full_implicit_test.py
                    • Size 134B
                    • SHA256 2d3b06fb5ef1cb6da85b74f5ce5c99045b493475531e54500defbf3ccb494d36
                    • MD5 SHA1 SHA512

                    Process.txt

                    • Path C:\Users\Admin\AppData\Local\79c33c6b0e99e526a1b13feb15eb201a\Admin@RFQKXVFU_en-US\System\Process.txt
                    • Size 4KB
                    • SHA256 2036a13dbed08c880b49985bec0f5c5e34c77de5daa818a6fce4dcf6a47c97c2
                    • MD5 SHA1 SHA512 SSDEEP

                    msgid.dat

                    • Path C:\Users\Admin\AppData\Local\7d2049c6753df02856b257b77fe0d222\msgid.dat
                    • Size 1B
                    • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
                    • MD5 SHA1 SHA512

                    shift_jis-utf8.txt

                    • Path C:\Users\Admin\AppData\Local\Temp\7zE455531DD\OTP BULDER @ZerodayExploitware\.github\Lib\test\cjkencodings\shift_jis-utf8.txt
                    • Size 1KB
                    • SHA256 a6bbfb8ecb911d13581f7713391f8c0ceea1edd41537fdb300bbb4d62dd72e9b
                    • MD5 SHA1 SHA512

                    bar.py

                    • Path C:\Users\Admin\AppData\Local\Temp\7zE455531DD\OTP BULDER @ZerodayExploitware\.github\Lib\test\lazyimports\data\module_same_name_var_order2\bar.py
                    • Size 12B
                    • SHA256 38f1d816d667c230ba71b157eca7bdf543deff3f0e5b751e722c7530a016ef6e
                    • MD5 SHA1 SHA512

                    __main__.py

                    • Path C:\Users\Admin\AppData\Local\Temp\7zE455531DD\OTP BULDER @ZerodayExploitware\.github\Lib\test\test_compiler\__main__.py
                    • Size 82B
                    • SHA256 6bcb5e28f18a600d16d803f16bbf9b8d8bbdb792768e0741766e54b4c67f9036
                    • MD5 SHA1 SHA512

                    __main__.py

                    • Path C:\Users\Admin\AppData\Local\Temp\7zE455531DD\OTP BULDER @ZerodayExploitware\.github\Lib\test\test_importlib\builtin\__main__.py
                    • Size 58B
                    • SHA256 cb9a3ce8f18e7d0a0cadb73cc9264772462de953499534736998d3c54f8c7c3c
                    • MD5 SHA1 SHA512

                    __init__.py

                    • Path C:\Users\Admin\AppData\Local\Temp\7zE455531DD\OTP BULDER @ZerodayExploitware\.github\Lib\test\test_importlib\frozen\__init__.py
                    • Size 142B
                    • SHA256 8962a375442bddd8d49865f3bf601c2c7a741fe947d8ec667358bb640cd0d19b
                    • MD5 SHA1 SHA512

                    __init__.py

                    • Path C:\Users\Admin\AppData\Local\Temp\7zE455531DD\OTP BULDER @ZerodayExploitware\.github\RuntimeTests\StrictModules\Tools\pynche\__init__.py
                    • Size 47B
                    • SHA256 836cdb388117cf81e78d9fa2a141cca1b14b0179733322e710067749a1b16fe9
                    • MD5 SHA1 SHA512

                    Cinder-Logo-Dark.svg

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\CinderDoc\images\Cinder-Logo-Dark.svg
                    • Size 1KB
                    • SHA256 5f88e1302977661e04a013e627b5158252f1664660fb9b75a637ec75879cd2b7
                    • MD5 SHA1 SHA512

                    Cinder-Logo-White.svg

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\CinderDoc\images\Cinder-Logo-White.svg
                    • Size 1KB
                    • SHA256 06a140aa7928d80f157bc9939b22d429366430794ac25a6297707b3366ba6627
                    • MD5 SHA1 SHA512

                    bootstrap.sh

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Cinder\module\bootstrap.sh
                    • Size 1KB
                    • SHA256 959d78b75bb6c4b82e861f6f7d4234cfac7f3a4d2f2fe1d0052ff6dcb266ce1c
                    • MD5 SHA1 SHA512

                    build.sh

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Cinder\module\build.sh
                    • Size 590B
                    • SHA256 146a03a19072099f4ea50c61e2871745ffa9d6be7dbe9f728b317e2612908b83
                    • MD5 SHA1 SHA512

                    cinder.cpp

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Cinder\module\cinder.cpp
                    • Size 884B
                    • SHA256 9655473f55f78c78d3e96f85c75b8508077dcfa34c604259925029257ee672cd
                    • MD5 SHA1 SHA512

                    make-current-symbols.sh

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Cinder\module\make-current-symbols.sh
                    • Size 621B
                    • SHA256 ffae12089b9eeb61c811e2b8fb03ee972a6aae9c93a67d0475cdd73f47c63161
                    • MD5 SHA1 SHA512

                    python-video-icon.png

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\faq\python-video-icon.png
                    • Size 2KB
                    • SHA256 4f395910793ab07158609755b4c4c401380243757e08b680b411bf7d14a88e12
                    • MD5 SHA1 SHA512

                    custom.c

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\custom.c
                    • Size 987B
                    • SHA256 cdc84760992058d9148c03fba44c44ae596531b8ca1e5fe7d16a15fd7072b300
                    • MD5 SHA1 SHA512

                    custom2.c

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\custom2.c
                    • Size 3KB
                    • SHA256 5d1667f55a6e7610ec530236513311a690aa728e8a1b873e611562e1f1d01969
                    • MD5 SHA1 SHA512

                    custom3.c

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\custom3.c
                    • Size 4KB
                    • SHA256 dd0eaabd1a73a6e54309f7120240bfac48ad88c71b6685d5fd0791c5b67008cc
                    • MD5 SHA1 SHA512 SSDEEP

                    custom4.c

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\custom4.c
                    • Size 4KB
                    • SHA256 e9bb866d72ad739c943f6d4c92a2f8c7e0b6b553438a3891fe06c821ab0ef13f
                    • MD5 SHA1 SHA512 SSDEEP

                    dbpickle.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\dbpickle.py
                    • Size 2KB
                    • SHA256 e61a6e2427b65d5e625ba774c02770ca1ad6f255686d8c23638921ad7e2fd5f7
                    • MD5 SHA1 SHA512

                    email-alternative.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\email-alternative.py
                    • Size 1KB
                    • SHA256 6edf145c11146d1e38ea6e61d226bc01d5e8acd00c4547d8ea040dcd74dfcde2
                    • MD5 SHA1 SHA512

                    email-dir.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\email-dir.py
                    • Size 2KB
                    • SHA256 f5a7fcd91ec64fa147054ea76593ceb494386b2cabb32acc9b2fa1fef5307047
                    • MD5 SHA1 SHA512

                    email-headers.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\email-headers.py
                    • Size 950B
                    • SHA256 38bd0ef031a3055f3875a203dfd7b33f8c80e27c3f9577a94ac785cf07dc6885
                    • MD5 SHA1 SHA512

                    email-mime.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\email-mime.py
                    • Size 930B
                    • SHA256 a2428437d1bc880df13824bbafa36bb0d7b15b18f848fd8ea27e7cc7c1bb8abb
                    • MD5 SHA1 SHA512

                    email-read-alternative.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\email-read-alternative.py
                    • Size 2KB
                    • SHA256 04573ffa91daf00ad5e9674afd91d6f9588c5a950bfb6a0d201d17dd0ab1244f
                    • MD5 SHA1 SHA512

                    email-simple.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\email-simple.py
                    • Size 585B
                    • SHA256 277c1418aed64b6c19eac30a8347147ceff49a76e4eeac88827b3af8a366e039
                    • MD5 SHA1 SHA512

                    email-unpack.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\email-unpack.py
                    • Size 1KB
                    • SHA256 456413857f8d18f7d341b9c588e104d1c86e8d984961bf96c21c72ba06790583
                    • MD5 SHA1 SHA512

                    minidom-example.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\minidom-example.py
                    • Size 1KB
                    • SHA256 19937259eee701ca6be3bef55a74e6b28ae3443800922c11b8398e293e20dfa2
                    • MD5 SHA1 SHA512

                    mp_newtype.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\mp_newtype.py
                    • Size 1KB
                    • SHA256 f1bd392d4f308810ef36ff58bde4f9909e454458a3066809f31130fd024cb87b
                    • MD5 SHA1 SHA512

                    mp_pool.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\mp_pool.py
                    • Size 3KB
                    • SHA256 23d6ec5e99afc1adee261d4bc2928018ec76acdbad7a69ebb53c010a2a5f7c1e
                    • MD5 SHA1 SHA512

                    mp_workers.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\mp_workers.py
                    • Size 1KB
                    • SHA256 4d7a036632e5e74aa0852750ab3077bdbb06524968a1b03aa3aef34bdc26bd1c
                    • MD5 SHA1 SHA512

                    run-func.c

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\run-func.c
                    • Size 1KB
                    • SHA256 5fee1a713ec02eba39404a4def96ca0afee9c0b1308a22119865ea52f9aaa661
                    • MD5 SHA1 SHA512

                    setup.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\setup.py
                    • Size 329B
                    • SHA256 0e997efe0642f5a74d549fb9d0cef77b35eec3601fa79b0decbcdad8d7533515
                    • MD5 SHA1 SHA512

                    adapter_datetime.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\adapter_datetime.py
                    • Size 323B
                    • SHA256 42f99849cff074a70c16e667ffb642a575f9d65eddb1d97691330f4a924e6be1
                    • MD5 SHA1 SHA512

                    adapter_point_1.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\adapter_point_1.py
                    • Size 365B
                    • SHA256 01ec04e16d66c66c6ed1794f449055a32fa6e5eb994cf09dbf54c98521d0bce2
                    • MD5 SHA1 SHA512

                    adapter_point_2.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\adapter_point_2.py
                    • Size 344B
                    • SHA256 5674c0afaad2a2c8463a6b3b04cbe25ce2de0f4b4c8aa9fbebe2cbedc743340a
                    • MD5 SHA1 SHA512

                    collation_reverse.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\collation_reverse.py
                    • Size 484B
                    • SHA256 120689a4e96a450f4a7cc8dfae4df70377b20a4bdb0679861c02e4f6c3870754
                    • MD5 SHA1 SHA512

                    complete_statement.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\complete_statement.py
                    • Size 672B
                    • SHA256 5c405cd5bdc8edea751da53284c9183e18bcf44eb51526f7fac0d1b0a1d8682b
                    • MD5 SHA1 SHA512

                    converter_point.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\converter_point.py
                    • Size 1KB
                    • SHA256 e5984c88de30fa85388bc2f92798299d046b027968924dffc9ebce317cc9db6f
                    • MD5 SHA1 SHA512

                    ctx_manager.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\ctx_manager.py
                    • Size 705B
                    • SHA256 52478a41521671e68721a3ae4cca7c8f03e94a2060275e00f2f6b4bc57ef6587
                    • MD5 SHA1 SHA512

                    execute_1.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\execute_1.py
                    • Size 540B
                    • SHA256 3a4f401871000174f0960cff4c025f0efaf97934da1b65d205ce3008122b9fb5
                    • MD5 SHA1 SHA512

                    executemany_1.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\executemany_1.py
                    • Size 565B
                    • SHA256 59a57b08818d1fad2ce2a14e8ef71294543a6c53e180fd00d5d26ccfd4d74157
                    • MD5 SHA1 SHA512

                    executemany_2.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\executemany_2.py
                    • Size 355B
                    • SHA256 bd6019bbcba92d2cf517df42c159a722f6bbde641fab4e1939b7f15effdd1405
                    • MD5 SHA1 SHA512

                    executescript.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\executescript.py
                    • Size 431B
                    • SHA256 352d30def840bddd4d6701dfd6d9b69f3366e1344d050d7841545d1896c22630
                    • MD5 SHA1 SHA512

                    load_extension.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\load_extension.py
                    • Size 1019B
                    • SHA256 2a27a76f6b1239e8207fc20591ed3eef3cfde801d14d13ded087c124c72fba5c
                    • MD5 SHA1 SHA512

                    md5func.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\md5func.py
                    • Size 254B
                    • SHA256 92f4ca7d2478c151a1cb6a2047360dac4b2530bd6440fd08f1a3fb382f086213
                    • MD5 SHA1 SHA512

                    mysumaggr.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\mysumaggr.py
                    • Size 484B
                    • SHA256 e26eada6a6921b4b10cca5fcf42b57869b05972c7de5d4dffaffe05a94ee6ce4
                    • MD5 SHA1 SHA512

                    pysqlite_datetime.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\pysqlite_datetime.py
                    • Size 685B
                    • SHA256 22256acd748faa7adaaf126e20f0ba60c53926596e52485a6f9b35cff6e1543d
                    • MD5 SHA1 SHA512

                    row_factory.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\row_factory.py
                    • Size 305B
                    • SHA256 dbb86a052cbdfe13691f02505db5ba1c102f83a4844d90ae868014b285f0c056
                    • MD5 SHA1 SHA512

                    rowclass.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\rowclass.py
                    • Size 312B
                    • SHA256 bd4edbb17a0efd5e1a925b355cb82e1e77d21a878da5a76c43fa845c22cec0e6
                    • MD5 SHA1 SHA512

                    shortcut_methods.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\shortcut_methods.py
                    • Size 598B
                    • SHA256 7b4c8d538341d0d3d8cbe10e1ddeae1e54934b2022ec648443447b467ab098ae
                    • MD5 SHA1 SHA512

                    text_factory.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sqlite3\text_factory.py
                    • Size 775B
                    • SHA256 d094b69d27640e12af82b4beb0345f33ef5b3601b33c262e579b4d006c20bc2c
                    • MD5 SHA1 SHA512

                    sublist.c

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\sublist.c
                    • Size 1KB
                    • SHA256 d27049a86e581248f577bef644073d574ecc88c14fc1fdcef0cf76161230d2a0
                    • MD5 SHA1 SHA512

                    test.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\test.py
                    • Size 3KB
                    • SHA256 283a2bc1a2028192c1844b08a59b72bc8115dbcf3fd3b279e13f761fa14fc164
                    • MD5 SHA1 SHA512

                    turtle-star.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\includes\turtle-star.py
                    • Size 155B
                    • SHA256 7c331c34f9ef3c1f6f30167df7475bf696072d947d8c96f63e892ef7d6167cf9
                    • MD5 SHA1 SHA512

                    turtle-star.pdf

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\library\turtle-star.pdf
                    • Size 4KB
                    • SHA256 8bb6e7f1d5cfe281d46519e6578e9edf9e4c37e0d65e64f74fa56767b1cb2bff
                    • MD5 SHA1 SHA512 SSDEEP

                    requirements.txt

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\requirements.txt
                    • Size 647B
                    • SHA256 74b8d7ccb25acd7f536c56fd0da6d01f5d5574e1b4bbd88f52122df58d8fc724
                    • MD5 SHA1 SHA512

                    runtime.txt

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\runtime.txt
                    • Size 3B
                    • SHA256 b1133c6354aaff809f802709e53dacce82e609f9dc426c2da77dc68cf6fe64a0
                    • MD5 SHA1 SHA512

                    asdl_highlight.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\tools\extensions\asdl_highlight.py
                    • Size 1KB
                    • SHA256 5b1a9310722e42cb7330c25731efe9eb7f1d3ee6b393cc93105fab407a172bfb
                    • MD5 SHA1 SHA512

                    escape4chm.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\tools\extensions\escape4chm.py
                    • Size 1KB
                    • SHA256 5fb01a0ea6cb4e3987053a479ca71f40689862737858362d543eea6989e500a1
                    • MD5 SHA1 SHA512

                    glossary_search.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\tools\extensions\glossary_search.py
                    • Size 1KB
                    • SHA256 a136dcff914aa9048831752128d5f1f8d7a54f21d985fd782aa42cb02a8c889f
                    • MD5 SHA1 SHA512

                    patchlevel.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\tools\extensions\patchlevel.py
                    • Size 1KB
                    • SHA256 d48ff4ea95e9aac907b8ac3323275e48153fe986b4fa0564d608cf327ef55219
                    • MD5 SHA1 SHA512

                    peg_highlight.py

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\tools\extensions\peg_highlight.py
                    • Size 2KB
                    • SHA256 3375f2c4f0ffb7dc51505677f30e5e8d94a3d4bc4256c808758d603f0920f842
                    • MD5 SHA1 SHA512

                    changelog_search.js

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\tools\static\changelog_search.js
                    • Size 1KB
                    • SHA256 d5cae8d8abe8a32ebd9a01374bb520640353c89e0d8a23d52d21fbbc7b04f600
                    • MD5 SHA1 SHA512

                    customsourcelink.html

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\tools\templates\customsourcelink.html
                    • Size 489B
                    • SHA256 f5087c7b35834e790551e7532f1705616687c56e17df672cdbb0cc7d4b3d31f9
                    • MD5 SHA1 SHA512

                    download.html

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\tools\templates\download.html
                    • Size 2KB
                    • SHA256 47e32834566648f3ee26f64adbcceb19373c5a2239063c38b7cf315ae03fc954
                    • MD5 SHA1 SHA512

                    dummy.html

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\tools\templates\dummy.html
                    • Size 637B
                    • SHA256 7652b12aa9174ce3ebb85370c66ab9d56ec48e1a46894c60dcf3d5c6ade1a6fe
                    • MD5 SHA1 SHA512

                    indexsidebar.html

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\tools\templates\indexsidebar.html
                    • Size 1KB
                    • SHA256 4f32b379cb010aff32ba6db8f32d706dc355caf378966aeaf0b775f126d6fce1
                    • MD5 SHA1 SHA512

                    layout.html

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\.github\Doc\tools\templates\layout.html
                    • Size 1KB
                    • SHA256 f039322013539d91fe820c26e442e0aba1ad12c9b26998ce41af3e47443f0489
                    • MD5 SHA1 SHA512

                    OTP BULDER @ZerodayExploitware.exe

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\OTP BULDER @ZerodayExploitware.exe
                    • Size 175KB
                    • SHA256 e1df166da9ba07ad1a5b1a105eac585f04ea67a023cca16f54bdbfa97bb39dd2
                    • MD5 SHA1 SHA512 SSDEEP

                    ReadMe.txt

                    • Path C:\Users\Admin\Desktop\OTP BULDER @ZerodayExploitware\ReadMe.txt
                    • Size 12B
                    • SHA256 e7d3e1f7e7c809eaf557df31d8c4fd3347baa8efa3439b0fbe4e06072b01e829
                    • MD5 SHA1 SHA512

                    memory/4112-5499-0x00000000059D0000-0x00000000059E0000-memory.dmp

                    memory/4112-7289-0x00000000059D0000-0x00000000059E0000-memory.dmp

                    memory/4112-3536-0x0000000000E40000-0x0000000000E72000-memory.dmp

                    memory/4112-5494-0x0000000006870000-0x0000000006902000-memory.dmp

                    memory/4112-5495-0x0000000075200000-0x00000000759B1000-memory.dmp

                    memory/4112-5496-0x00000000059D0000-0x00000000059E0000-memory.dmp

                    memory/4112-5497-0x0000000006EC0000-0x0000000007466000-memory.dmp

                    memory/4112-3538-0x00000000059D0000-0x00000000059E0000-memory.dmp

                    memory/4112-5502-0x0000000006980000-0x000000000698A000-memory.dmp

                    memory/4112-3539-0x0000000005A50000-0x0000000005AB6000-memory.dmp

                    memory/4112-5508-0x0000000006E60000-0x0000000006E72000-memory.dmp

                    memory/4112-3537-0x0000000075200000-0x00000000759B1000-memory.dmp

                    memory/4564-7292-0x000001E55F2C0000-0x000001E55F2C1000-memory.dmp

                    memory/4564-7291-0x000001E55F2C0000-0x000001E55F2C1000-memory.dmp

                    memory/4564-7293-0x000001E55F2C0000-0x000001E55F2C1000-memory.dmp

                    memory/4564-7298-0x000001E55F2C0000-0x000001E55F2C1000-memory.dmp

                    memory/4564-7297-0x000001E55F2C0000-0x000001E55F2C1000-memory.dmp

                    memory/4564-7300-0x000001E55F2C0000-0x000001E55F2C1000-memory.dmp

                    memory/4564-7299-0x000001E55F2C0000-0x000001E55F2C1000-memory.dmp

                    memory/4564-7301-0x000001E55F2C0000-0x000001E55F2C1000-memory.dmp

                    memory/4564-7303-0x000001E55F2C0000-0x000001E55F2C1000-memory.dmp

                    memory/4564-7302-0x000001E55F2C0000-0x000001E55F2C1000-memory.dmp