4543c86762a7355eb1013bfc90d256710fb2bcbbd29f3e670bed52c147bf78ba

Analysis

max time kernel
867s
max time network
1234s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
11-02-2025 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

get_cookies.pyc
Size

10KB
MD5

b38f506528b3d6d5dbd851426c347b95
SHA1

e91bf4ef42128267934e21be0176e552480f5977
SHA256

85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b
SHA512

ab110dc92eba564fd0ec6c6a75e779f588518dc1aa461f072ab02b96bc11fbe25e09faa6a556dc6a127c3e8826382697b72037a0cefbdaf32fd70a723e746295
SSDEEP

192:TzOCIeinQfUF9LdwOEVOFc1mNe47+o+zEzzzzz1zz+HoowAE:TzOUiQccEe4KoOIAE

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
127	1644	firefox.exe

Executes dropped EXE 2 IoCs

pid	Process
4668	python-3.13.2-amd64.exe
4484	python-3.13.2-amd64.exe

Loads dropped DLL 1 IoCs

pid	Process
4484	python-3.13.2-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\python-3.13.2-amd64.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.13.2-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.13.2-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639250081-1078958410-2274150717-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2639250081-1078958410-2274150717-1000_Classes\pyc_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2639250081-1078958410-2274150717-1000_Classes\pyc_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2639250081-1078958410-2274150717-1000_Classes\pyc_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639250081-1078958410-2274150717-1000_Classes\pyc_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2639250081-1078958410-2274150717-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2639250081-1078958410-2274150717-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2639250081-1078958410-2274150717-1000_Classes\.pyc	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2639250081-1078958410-2274150717-1000_Classes\pyc_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639250081-1078958410-2274150717-1000_Classes\.pyc\ = "pyc_auto_file"	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\python-3.13.2-amd64.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3636	MicrosoftEdgeUpdate.exe
3636	MicrosoftEdgeUpdate.exe
3636	MicrosoftEdgeUpdate.exe
3636	MicrosoftEdgeUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4020	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	firefox.exe
Token: SeDebugPrivilege	1644	firefox.exe
Token: SeDebugPrivilege	1644	firefox.exe
Token: SeDebugPrivilege	1644	firefox.exe
Token: SeRestorePrivilege	2356	7zG.exe
Token: 35	2356	7zG.exe
Token: SeSecurityPrivilege	2356	7zG.exe
Token: SeSecurityPrivilege	2356	7zG.exe
Token: SeDebugPrivilege	1644	firefox.exe
Token: SeDebugPrivilege	1644	firefox.exe
Token: SeDebugPrivilege	1644	firefox.exe
Token: SeDebugPrivilege	1644	firefox.exe
Token: SeDebugPrivilege	1644	firefox.exe
Token: SeDebugPrivilege	3636	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
2356	7zG.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe
4020	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 4640	4020	OpenWith.exe	81
PID 4020 wrote to memory of 4640	4020	OpenWith.exe	81
PID 4640 wrote to memory of 1644	4640	firefox.exe	83
PID 4640 wrote to memory of 1644	4640	firefox.exe	83
PID 4640 wrote to memory of 1644	4640	firefox.exe	83
PID 4640 wrote to memory of 1644	4640	firefox.exe	83
PID 4640 wrote to memory of 1644	4640	firefox.exe	83
PID 4640 wrote to memory of 1644	4640	firefox.exe	83
PID 4640 wrote to memory of 1644	4640	firefox.exe	83
PID 4640 wrote to memory of 1644	4640	firefox.exe	83
PID 4640 wrote to memory of 1644	4640	firefox.exe	83
PID 4640 wrote to memory of 1644	4640	firefox.exe	83
PID 4640 wrote to memory of 1644	4640	firefox.exe	83
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 3608	1644	firefox.exe	84
PID 1644 wrote to memory of 2208	1644	firefox.exe	86
PID 1644 wrote to memory of 2208	1644	firefox.exe	86
PID 1644 wrote to memory of 2208	1644	firefox.exe	86
PID 1644 wrote to memory of 2208	1644	firefox.exe	86
PID 1644 wrote to memory of 2208	1644	firefox.exe	86
PID 1644 wrote to memory of 2208	1644	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc
1⤵
- Modifies registry class
PID:5112

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc
    3⤵
    - Downloads MZ/PE file
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - Checks processor information in registry
    - Modifies registry class
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1912 -prefsLen 27348 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {32a7799c-9c1b-4d73-b056-dbade4c82e93} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" gpu
      4⤵
      PID:3608
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2448 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 28268 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1616e9ad-dc41-4a6d-814c-9e882c92a985} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" socket
      4⤵
      PID:2208
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1484 -childID 1 -isForBrowser -prefsHandle 2688 -prefMapHandle 3064 -prefsLen 28409 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73deeea9-e3a9-48ab-ada0-140a0f5e618d} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" tab
      4⤵
      PID:220
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3640 -childID 2 -isForBrowser -prefsHandle 3520 -prefMapHandle 3632 -prefsLen 32758 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4b39e65-e63e-4446-b5ff-35e253ef3411} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" tab
      4⤵
      PID:4356
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5012 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5068 -prefMapHandle 5080 -prefsLen 32758 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52342879-5a13-4e1f-87d1-77c0ba23ca7c} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" utility
      4⤵
      Checks processor information in registry
      PID:3224
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5464 -childID 3 -isForBrowser -prefsHandle 5456 -prefMapHandle 5404 -prefsLen 26976 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ed61681-2deb-4501-b2d5-c15fced6cc27} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" tab
      4⤵
      PID:2008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 4 -isForBrowser -prefsHandle 5604 -prefMapHandle 5608 -prefsLen 26976 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7d2507c-7efd-48b9-8a53-0a18bc576ec0} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" tab
      4⤵
      PID:3016
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5792 -childID 5 -isForBrowser -prefsHandle 5800 -prefMapHandle 5804 -prefsLen 26976 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b01db456-a8c1-4782-b145-3da43dde77cd} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" tab
      4⤵
      PID:4292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6176 -childID 6 -isForBrowser -prefsHandle 6544 -prefMapHandle 6624 -prefsLen 27775 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af3769cb-6788-4b68-973d-006a1e38e9ef} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" tab
      4⤵
      PID:996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6916 -childID 7 -isForBrowser -prefsHandle 6908 -prefMapHandle 6904 -prefsLen 27775 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dfdddd93-ff3e-44ed-98ee-2224616bd80b} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" tab
      4⤵
      PID:2648
  - - C:\Users\Admin\Downloads\python-3.13.2-amd64.exe
      "C:\Users\Admin\Downloads\python-3.13.2-amd64.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4668
    - - C:\Windows\Temp\{E821A73E-93B4-4E27-B52D-9444B87A2020}\.cr\python-3.13.2-amd64.exe
        
        "C:\Windows\Temp\{E821A73E-93B4-4E27-B52D-9444B87A2020}\.cr\python-3.13.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.13.2-amd64.exe" -burn.filehandle.attached=584 -burn.filehandle.self=728
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4484

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\get_cookies.pyc"
1⤵
PID:5024
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\get_cookies.pyc
  2⤵
  - Checks processor information in registry
  PID:3952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4928

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\get_cookies(1)\" -ad -an -ai#7zMap21357:90:7zEvent11602
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2356

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\get_cookies(1).pyc"
1⤵
PID:1772
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\get_cookies(1).pyc
  2⤵
  - Checks processor information in registry
  PID:4968

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
9f9f1d281e8370aee4e6e777c7df6ece

SHA1
6117df5bc6abc460a7aad23a299639ec09560617

SHA256
1c4de59b224828713677523ef7ad52f6457718351b7a4e7b8ba49e697df3fa5a

SHA512
c0f3f627400fa06d648b95cd023d19cb15c9f8288576737a2ca744397722f96745a657e12b6e097f3f65cdbf9ff589d689757cc947cfea11cb6ad20982f1dcd0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0eftc0u8.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
a797f881ad05b10404e8e73602d2b047

SHA1
6a2d42353c14ca6bf9b646ff5e2e22fe24f3cac7

SHA256
19abe41f8a28233fe605bd64db41d790f290bd2024e1d06d05f2da9aa1d49e94

SHA512
1eb37be30cab17878ac704a81bc07d88dadcb00361e4bb117c52b064a26d1e02a3463b3361327ea5aa80cefec3bc79934218900e52a81f607b22751f74209a1f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0eftc0u8.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
265d85a246df913774df36ac234286fd

SHA1
e44d9fb403da8815ce59588e88cf172335deef17

SHA256
25ef8e633bf077ea4b50e72a91ebdbeaff41e0f02969b40eb892623c013e3471

SHA512
a75b8f3e11570ace2870f2d359e5a200494a3a5e2b7026d53535648d6742913e951187ff424c71c4e1ab8e90ecb44cb52dd11be339f3d3f4f35157ab8bde5cfc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0eftc0u8.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
13KB

MD5
27dcaa4b66a40ab6404819d20602ac0b

SHA1
6e65b3a79246fd77a8140c6452dcaaa78ff33719

SHA256
7f2c2a0b674eccd20db5e7e06ec07ac05a780b7e5360a9b5e3861c286e0bb274

SHA512
2a40e67427ad7d491ad08334f411c89de63bfb2243b22a8b30dd83151a583da093242180af28cad2253c64abca19ab2542f6ffb953554c9d621d76458cafe975

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UPF6K9AFCK1ENWVNDJ7J.temp

Filesize
17KB

MD5
7e1cf826b56164eeaf23872abdcb51dd

SHA1
bb832f67c894e6f9d4cbfe010d6956f49b145170

SHA256
97eb25c7fac922f32d01af88001cf6bd03502c47d2ead452a74a6058d4e7f90c

SHA512
0e29a7fbd5aee13a88f8833ae0407ea2cd52bdd0e7a941b23a1c6909e7df6db55e8b8d5a07745430f5d9d239e0aa702d174a4e777c4c575493b5761ac292b08c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\AlternateServices.bin

Filesize
8KB

MD5
818c0699d92370f74236587865c09460

SHA1
3cf3f577f1e4e1cb3de658680c3d197e408bcbe5

SHA256
16e3d1c344887b5e2435378d4804b997d15704305251a152dcdefcea33e2968f

SHA512
fa5c88b9ebd4531e661972cfbc7ab12bc3f1e5d791d2f8fe7de2969dc1d553bc171791900073a053890d0fd6099aecbce93e468f136a8d86524f1b0e9af4c691

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\bookmarkbackups\bookmarks-2025-02-11_11_+y1TUpBGOlnlHe8qSyOq9g==.jsonlz4

Filesize
1007B

MD5
78c4780d2c82182f6b6f3287d3cfdb4d

SHA1
2250a8178cc47b486798dbbd6b3c6f45ca1527c4

SHA256
76d5f297ce0b2e39205c418648913b8549efdd788b97bf59f52e78e9d8f60140

SHA512
6771821eadbf0823c26c53dd6ad9afea7c463211067ce7d2fa723e27f6189b9febdc4cda4497f70173a0bfadaad20b3bc4f5cde08f49c4d866481680549571b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\datareporting\glean\db\data.safe.tmp

Filesize
67KB

MD5
1c54528aa633064db8f7d6df22142338

SHA1
dc54859b8ab7dcc36778f00c9b683b64511dd7ae

SHA256
362c6e5c45f362510efb395f44e977cba272810e0d4fa9a9f9125fd730187aeb

SHA512
df5a7cc375a036a51b13874947d439d293867d7df449430f836114bac9beb4b802e0a5bc0d16e475a23590fc55874954f32710961e2e73c896aea62002be8f78

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
be529d99862ccf913793ebfe6513f855

SHA1
8b7edfc28f443f4ab805fc795e39adef319f99ee

SHA256
0a14b57209186641448f4a68de637a66ae9d81ecf7039f4a4e724159c87a12db

SHA512
77ab52cd83e29c309c63a257742a82ab308f78ec429bdef7a7a9dfd28f0b52609c401874f53ca5a1d0476cf2531668df98a11e928b79cd0fadcde84738d30e59

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
38483646c429b86d4a5a86b11ed23475

SHA1
f5caf44a249e371bfa9a160361b5ce5b567fdadc

SHA256
50b29b30e1998c04ed22ce1ec2dcd2ad634983c771b655a770ad5ea8ea78bfec

SHA512
583ca218a3180d171f18c29f6e5b745b803967840a2a32043ceacf6ad466144dd6084306866323837878d1675d1228e32840a38d03cd1313a2cf8bf2dbc5ead1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\datareporting\glean\db\data.safe.tmp

Filesize
67KB

MD5
79b484521dd0d38754489d16ca187bb0

SHA1
42ebd271d49ad7e91c7e68994b0f22c8a06259dc

SHA256
553b29bedb13cf848b6973dcb91295c8333b424ca482d318ab9990c944ca0690

SHA512
df203992193a60f8485522269f8b11e861d05d819883e540305234c5230feedff73f2262ea31f4353db664e064cb3be5e3cb61d031ae3698eebf42ed18cac4f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\datareporting\glean\pending_pings\60121251-9f7e-453b-9a39-61cc5da00336

Filesize
659B

MD5
f2d293edc2c83c0913152f86e86554d3

SHA1
c3f011a15a4c46fb7a90e0b7c9398bb3912b4af4

SHA256
59434f2ca24b299525fdd70d5f023fb91515081f54d0c34b67c8209a2d24f48f

SHA512
f2ff2afb38c47426702e6a09e7021ca0281001b97e4a3976fdda46993f68e6b7d2c1526320bdaf1d4c944f5995370a6dba8258850e932be372016604c05b2c39

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\datareporting\glean\pending_pings\8ea972cf-60a5-4e8c-b03e-5f93d833ddd1

Filesize
982B

MD5
7f1e61fcb997f95748f80177671d5e05

SHA1
a4a4165092729ce4ebef972509a56044210a1c28

SHA256
8aa5ffc50bfffe893211175f5bad6ad9e20d791b31344884f3746455d202cd67

SHA512
b87e559c5f6576446ec9ecb13ee34cdc329a6d66430b1a8e5fae234cb9dba9457978598b41094426cd0deddee20e5f6389151be9f41c005a27e3fa69e39b3e6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\prefs-1.js

Filesize
10KB

MD5
d0a2a19b1e6849dbfc4680b662971b17

SHA1
81719b5d7b407b897bd446cad45c22f54273ac70

SHA256
9de726a70c115202f20fed09eced98303cb060a9eadeb268765b55126d1030dc

SHA512
c3d9037c7cc7fd72c04d846f5512ab12e6c5cd6f74e124f8ca014fa32237f22667d334f4235fe24a38e372c526cdae9d9d25f300c61bfb76647e0c8329d102c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\prefs-1.js

Filesize
11KB

MD5
013a4281b2dedf919304ee90391248e3

SHA1
c524ba81290e0e8eb0438600f87d51e272ce1644

SHA256
367da1b24eda57446f29a7c69c043b1415c4698b122dcd48b03d72c3529f5b34

SHA512
1bc6d2ba382f6dfd1f27259a9a0055d2831fd77a22da7aa8bd4cabd9e4713b21e0d15c949bd4ed1a54ef05df36e56aac5e017a3510bd44026939938e11c57f86

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\prefs-1.js

Filesize
10KB

MD5
b2ac4de9e333e82081dcf084dace0782

SHA1
c58dd203b7fad0d7ca88904913bc1583f662b009

SHA256
fe33f33fc8beb893d8c3224bc9db159f8f41b1332ae7279992b38a402442dfe5

SHA512
9c3d5504370a3e95034694b2cad9f71a3f397a1e891994336a815870f162c306d2e404fb40f475353bf7a8d1ad662e3cc36af630947e50c9353ac4b14628e079

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\prefs-1.js

Filesize
11KB

MD5
32ff4d4d0889264116b22892c0d46831

SHA1
f3df8afc8a508e4191a95f8cfe85975491e5cb51

SHA256
8b8bfe737a9569096d86ff265ac190d05495fea1e48fb408c101e208308e79ce

SHA512
4bb972a2374e9b83b0310a6c7782a3521e04aea35a9e76c6d68a73dc8a19200a71bc1212aff0e2bbaf834c61ea53a430e0ae05af7020d14c4efd51ca616d511a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
36760e9b90eb03966f1ff771ca67b549

SHA1
63bb1489c448f7fbe794af6d537894d974bd0a8a

SHA256
de45abc003591e4a4039ccb4667d99268d2888e3bf8ab5d079d99ddefaa4692e

SHA512
9a04117b23ed794008a885f3370f365cdc5a603b996337852108bec05b8c1fc0978a8a496737d1599ffac551ac745daa19d455b1aa64c31bd4aaaebfe949e3a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
9bc9edd69630cb8ff3cee9e801f22bac

SHA1
6f0e60e2553a497e69ed4b2c104ddedc3c911b0c

SHA256
2714823bc3fd7a8b915d2dc8349862f865a95536ce6bce090960ae43e7e09ff8

SHA512
168f6cbd84a3ba0e03da309d1a09483447faba78a1a18496a5f69150167747b6f1ffaf6e79719f2d87fc7fc7fd9ec4923b5592603f4c709ed87ee844c469d36c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
e4bc5026776f732b0c4bbc9d6d97e27a

SHA1
2de6fbbb70c8daaf409059c2b8a3567eb11eb053

SHA256
3fcaaaa26cfb98938e76e049269b5005cf84bd7f7b0afb5a77c245a4cdc079aa

SHA512
ff6251c2de7723aa09fef301cd4133580db79823007027d5d45a9f98ce1a7bc7efce9e621396d4b572e0a1caeba3731b63ee21a584b93facb2956208c1369d4b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
579ac0d5aa55eb6a1304752d5f2c8dee

SHA1
950919508d672081be0eb31f2fe77d85f84ef470

SHA256
7c1c4444d0de770c015aaa2debeb0aeea1baf5e1e97af001a501134fdc1ac8d8

SHA512
671524693818a0a482462725b79d696954bb0061b2717d8daec365d07e1181caa7cd9b6aa973db7c0a7efa994d4b12aa2a4e608e5e5e10ee0e1b05d07ef67925

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
ccd51fd38fd806d8f453b55ea8fb192e

SHA1
02019e0f1e4492b3471e229691dc9a873af023ec

SHA256
765fa91494b8ecf82c2dfffb639f27fd3aa0c77ad51fb1ffb9418edc9784b7a1

SHA512
5dc2afa514c21b994a298247e4e0fb3f0e9ca47a6a1fbaf5dda9098bc2cd6c4ae5950eda09092643592863520ac2d78e01ac7fba217108e132473c92b24b5494

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0eftc0u8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
640KB

MD5
f9637cc26445e79538f7b43648b9110d

SHA1
1339b69fa4fe96c834cd503a9acb2827238051d9

SHA256
3fdf66241b7f416b2d4a1b540f6358d6fe31702f055f917135941cf5640472af

SHA512
f1a5a4db16135110cfd1655824aaad09d66dab06b59b8468ee5eb24d865edbdff9aa8550e97c0ff38d16a8fbd40927eb9ed323b3f51ba68de4d68a415908bd0a

Download Submit
C:\Users\Admin\Downloads\0jxTIjCF.pyc.part

Filesize
10KB

MD5
b38f506528b3d6d5dbd851426c347b95

SHA1
e91bf4ef42128267934e21be0176e552480f5977

SHA256
85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b

SHA512
ab110dc92eba564fd0ec6c6a75e779f588518dc1aa461f072ab02b96bc11fbe25e09faa6a556dc6a127c3e8826382697b72037a0cefbdaf32fd70a723e746295

Download Submit
C:\Users\Admin\Downloads\python-3.13.2-amd64.exe

Filesize
27.3MB

MD5
40d2c830eedee3dd78f4b707f04fd1d2

SHA1
e3bc24fbc7faa31a3533334f8e959e53f9564b9e

SHA256
9aaa1075d0bd3e8abd0623d2d05de692ff00780579e1b232f259028bac19bb51

SHA512
0f238f7f270810c1990b215925ded63e97f85858f3b14308c0c54308091c7448453c5a4026306cca2af3b54bff2d144e480bc5d3b99eec97568bdd4e5dbb1682

Download Submit
C:\Windows\Temp\{2D0ADC7E-5DBD-41BC-8189-861FB82C2369}\.ba\PythonBA.dll

Filesize
692KB

MD5
340f07086b36d94b974928197a259cbc

SHA1
efbec246b95dc818cb31bcf505a584a17fe27b69

SHA256
979b8ed7e4d682dbd4bcd4adf9ff8c4dea204ffeb9ad89aa1844c5f86ba8d1d9

SHA512
40c44f45ece306537db10d59806a1e85f5d08065509f089ea0f53ef0476f81453c58dd68695f5bf5ed9f8cd3d462ff41fc0afaa69e5b2fd4f273913b7d8a2e79

Download Submit
C:\Windows\Temp\{2D0ADC7E-5DBD-41BC-8189-861FB82C2369}\.ba\SideBar.png

Filesize
50KB

MD5
888eb713a0095756252058c9727e088a

SHA1
c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4

SHA256
79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067

SHA512
7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0

Download Submit
C:\Windows\Temp\{E821A73E-93B4-4E27-B52D-9444B87A2020}\.cr\python-3.13.2-amd64.exe

Filesize
877KB

MD5
e31453864ac4ebf06cfcae1faf4a9464

SHA1
1b4beb01aa9f7acb23f3e2b6cf30bf1f5eea2be8

SHA256
3f1c60f03213432eb0d93cabffa8c3dcbd3211d98ffda60a5b87ee432a2587d3

SHA512
ed665d0652d6e3f36d8fd5f09da3ca267420fb41d477ee727e383f658b97b4c46bf82c6ff6c6f6a942eae583f8a02be2cd890871fd5518c6e13263fea2e57515

Download Submit