Overview

overview

8

Static

static

1

message(1).txt

windows10-2004-x64

8

message(1).txt

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    310s
  • max time network
    385s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 15:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    message(1).txt
  • Size 2KB
  • Sample260709-spwe6sdw6v
  • SHA256 09df5e75824251cf4eff9f18f2301cba0a8d823f89f4e888e5d111ac726c1aa8
  • MD5 SHA1 SHA512 TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 45 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 23 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 61 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\message(1).txt
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:608
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5828
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2436
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1160
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe"
          4⤵
          • Downloads MZ/PE file
          • Subvert Trust Controls: Mark-of-the-Web Bypass
          • Checks processor information in registry
          • Modifies registry class
          • NTFS ADS
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3276
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2032 -initialChannelId {53b487dc-d290-4a5b-883b-d5ad39072b74} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            5⤵
              PID:3676
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2404 -prefsLen 27133 -prefMapHandle 2408 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {054f38b4-8235-4afa-83c2-11791d01cf22} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
              5⤵
                PID:4704
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3740 -prefsLen 27323 -prefMapHandle 3744 -prefMapSize 270279 -jsInitHandle 3748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3756 -initialChannelId {19a38cf2-312a-4f29-8372-eab9cc1aa3fc} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                5⤵
                • Checks processor information in registry
                PID:4732
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3908 -prefsLen 27323 -prefMapHandle 3912 -prefMapSize 270279 -ipcHandle 4012 -initialChannelId {de288479-4b99-4dd4-bb20-eade980434cd} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                5⤵
                  PID:2044
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 34822 -prefMapHandle 4372 -prefMapSize 270279 -jsInitHandle 4376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4384 -initialChannelId {7757b643-28f8-44fa-824b-a3b12d13e135} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                  5⤵
                  • Checks processor information in registry
                  PID:616
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5044 -prefsLen 35010 -prefMapHandle 5048 -prefMapSize 270279 -ipcHandle 5052 -initialChannelId {a2ff2345-8cf8-47a7-ac3a-8d4c85baedbb} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                  5⤵
                  • Checks processor information in registry
                  PID:2000
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5524 -prefsLen 32952 -prefMapHandle 2800 -prefMapSize 270279 -jsInitHandle 2804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4820 -initialChannelId {1d1a235e-e0a4-4377-b194-0f9554ee3e1e} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                  5⤵
                  • Checks processor information in registry
                  PID:2768
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5552 -prefsLen 32952 -prefMapHandle 5556 -prefMapSize 270279 -jsInitHandle 5560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5488 -initialChannelId {63458578-68d4-4720-a20c-b983987880a7} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                  5⤵
                  • Checks processor information in registry
                  PID:6092
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 32952 -prefMapHandle 5856 -prefMapSize 270279 -jsInitHandle 5860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5868 -initialChannelId {a4526716-2e0a-4172-9168-aa20776042b7} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                  5⤵
                  • Checks processor information in registry
                  PID:5384
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6448 -prefsLen 33071 -prefMapHandle 6452 -prefMapSize 270279 -jsInitHandle 6456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6464 -initialChannelId {baf1426d-21f8-45ac-910a-7542e2f15f0e} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                  5⤵
                  • Checks processor information in registry
                  PID:4720
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1160 -prefsLen 33071 -prefMapHandle 4352 -prefMapSize 270279 -jsInitHandle 2992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2680 -initialChannelId {1e28cbdc-845f-4749-bb4b-24b36991d095} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
                  5⤵
                  • Checks processor information in registry
                  PID:5836
                • C:\Users\Admin\Downloads\python-3.13.14-amd64.exe
                  "C:\Users\Admin\Downloads\python-3.13.14-amd64.exe"
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4544
                  • C:\Windows\Temp\{F1952913-E1BF-4CEC-B155-7349419E4121}\.cr\python-3.13.14-amd64.exe
                    "C:\Windows\Temp\{F1952913-E1BF-4CEC-B155-7349419E4121}\.cr\python-3.13.14-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.13.14-amd64.exe" -burn.filehandle.attached=756 -burn.filehandle.self=760
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    PID:2640
            • C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
              "C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\virus).py"
              3⤵
                PID:6860
                • C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe
                  C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe "C:\Users\Admin\Downloads\virus).py"
                  4⤵
                    PID:7032
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SystemMaintenance" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe" "C:\ProgramData\SystemMaintenance\system_check.py"" /f"
                      5⤵
                        PID:7088
                        • C:\Windows\system32\reg.exe
                          reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SystemMaintenance" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe" "C:\ProgramData\SystemMaintenance\system_check.py"" /f
                          6⤵
                            PID:7092
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SystemMaintenance" /tr ""C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe" "C:\ProgramData\SystemMaintenance\system_check.py"" /sc onlogon /ru SYSTEM /f"
                          5⤵
                            PID:7040
                            • C:\Windows\system32\schtasks.exe
                              schtasks /create /tn "SystemMaintenance" /tr ""C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe" "C:\ProgramData\SystemMaintenance\system_check.py"" /sc onlogon /ru SYSTEM /f
                              6⤵
                              • Scheduled Task/Job: Scheduled Task
                              PID:1720
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
                            5⤵
                              PID:1792
                              • C:\Windows\system32\taskkill.exe
                                taskkill /f /im explorer.exe
                                6⤵
                                • Kills process with taskkill
                                PID:6224
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe" /v Debugger /t REG_SZ /d "systray.exe" /f"
                              5⤵
                                PID:2812
                                • C:\Windows\system32\reg.exe
                                  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe" /v Debugger /t REG_SZ /d "systray.exe" /f
                                  6⤵
                                    PID:6360
                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:5404
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:4604
                        • C:\Windows\system32\msiexec.exe
                          C:\Windows\system32\msiexec.exe /V
                          1⤵
                          • Enumerates connected drives
                          • Drops file in Windows directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of SetWindowsHookEx
                          PID:4976
                          • C:\Windows\syswow64\MsiExec.exe
                            C:\Windows\syswow64\MsiExec.exe -Embedding 713A7D58922497D50A1EAC01CB710B6C
                            2⤵
                              PID:8
                              • C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe
                                "C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe" -I -m ensurepip -U --default-pip
                                3⤵
                                  PID:4636
                                  • C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe
                                    C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp7wmsibme\\pip-26.1.2-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp7wmsibme', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
                                    4⤵
                                      PID:5728
                              • C:\Windows\System32\rundll32.exe
                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                1⤵
                                  PID:3312
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k GPSvcGroup
                                  1⤵
                                    PID:6408

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        2
                                        T1547

                                        Active Setup

                                        1
                                        T1547.014

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Privilege Escalation

                                        Boot or Logon Autostart Execution

                                        2
                                        T1547

                                        Active Setup

                                        1
                                        T1547.014

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Defense Evasion

                                        Modify Registry

                                        3
                                        T1112

                                        Subvert Trust Controls

                                        1
                                        T1553

                                        SIP and Trust Provider Hijacking

                                        1
                                        T1553.003

                                        Credential Access

                                        Discovery

                                        Peripheral Device Discovery

                                        2
                                        T1120

                                        Query Registry

                                        5
                                        T1012

                                        System Information Discovery

                                        3
                                        T1082

                                        System Location Discovery

                                        1
                                        T1614

                                        System Language Discovery

                                        1
                                        T1614.001

                                        Lateral Movement

                                        Collection

                                        Command and Control

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        e5d4fcb.rbs
                                        • Path C:\Config.Msi\e5d4fcb.rbs
                                        • Size 8KB
                                        • SHA256 629f99191ba6e4b2252ebfc115115556ee9e17cc91dc32212ca288fd77f75990
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        e5d4fd0.rbs
                                        • Path C:\Config.Msi\e5d4fd0.rbs
                                        • Size 12KB
                                        • SHA256 6334e788fe3b46f8e83a41765d277c7ac9529e2187dd1fb0568728518f68c639
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        e5d4fd5.rbs
                                        • Path C:\Config.Msi\e5d4fd5.rbs
                                        • Size 60KB
                                        • SHA256 3ce98cc0f6839757359f5ffe7926997041e3afbde26c919cd9867bb4cb603ef9
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        e5d4fda.rbs
                                        • Path C:\Config.Msi\e5d4fda.rbs
                                        • Size 127KB
                                        • SHA256 fdc10b9387932ebd8cb45f81f96dc28c4144b6c4fcfaa4ed988fff541f1d85a9
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        e5d4fdf.rbs
                                        • Path C:\Config.Msi\e5d4fdf.rbs
                                        • Size 352KB
                                        • SHA256 43edd424980ba95beef2f40834520cdcd73dbbc4f490891bc43827d44ad21d0b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        e5d4fe4.rbs
                                        • Path C:\Config.Msi\e5d4fe4.rbs
                                        • Size 139KB
                                        • SHA256 cfd12519b03ae68411e15301fcbb7accb233046c7e892b3365436e2cfcde0034
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        e5d4fe9.rbs
                                        • Path C:\Config.Msi\e5d4fe9.rbs
                                        • Size 262KB
                                        • SHA256 77a82aaf9b1b34dd14f521688397af99beef90fd8451db7da94b9d605a6471af
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        e5d4fee.rbs
                                        • Path C:\Config.Msi\e5d4fee.rbs
                                        • Size 14KB
                                        • SHA256 229b697ecee61819e594367491082363dc63e295d3ed826169a58e911c095630
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        e5d4ff3.rbs
                                        • Path C:\Config.Msi\e5d4ff3.rbs
                                        • Size 8KB
                                        • SHA256 c674f682afa579833850f92033bd69d41efb454db47de92e888570b16d04386c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        9512A4488B00CC053350DAC32D417B4A35C11513
                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6088y0oq.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
                                        • Size 15KB
                                        • SHA256 08893cce919261c4d73e1693650a59458010e97cad709277ffc798946d0dafd0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        doc_JustForMe
                                        • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\doc_JustForMe
                                        • Size 7.5MB
                                        • SHA256 d54ed050275d52090f3a74183a5e2012808979f8d92dee9d3d2cb09218ef8fca
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        lib_JustForMe
                                        • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe
                                        • Size 6.9MB
                                        • SHA256 62738ace04a575bac5c04d04e1174a7fa3dd9ec169c8c3678c1c69abe6beabb1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        tcltk_JustForMe
                                        • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\tcltk_JustForMe
                                        • Size 3.1MB
                                        • SHA256 74972be1ae71eeb219b9f5d68158040bf395bb0e92f8bc02288991231475bbef
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        core.msi
                                        • Path C:\Users\Admin\AppData\Local\Package Cache\{1E897E54-A9F8-4146-A531-9B4E7093AC92}v3.13.14150.0\core.msi
                                        • Size 2.0MB
                                        • SHA256 24d1bac7c022c69a626c92f1ba3ed924ff36ccfef091144dca1567973e14b33e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        launcher.msi
                                        • Path C:\Users\Admin\AppData\Local\Package Cache\{3122B179-860E-45B2-8AE2-A80B9B0E8D3C}v3.13.14150.0\launcher.msi
                                        • Size 552KB
                                        • SHA256 d71f46e3bf2cc9aca4c7a02891d7826c4559a09803ff45b63e04974cd08afad5
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        exe.msi
                                        • Path C:\Users\Admin\AppData\Local\Package Cache\{377B613A-310E-45FF-9E16-63876BF37A30}v3.13.14150.0\exe.msi
                                        • Size 812KB
                                        • SHA256 14252c10aa6f5acaacc9a57347a4461c9ff4c7962044fb0464d766a118602e9a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        test.msi
                                        • Path C:\Users\Admin\AppData\Local\Package Cache\{81624098-AE39-415B-A02F-3647169A0A13}v3.13.14150.0\test.msi
                                        • Size 6.0MB
                                        • SHA256 12304109675caf4b8fd19a21084b3ef8526653a3b2fb7a821245af539b508ec6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        dev.msi
                                        • Path C:\Users\Admin\AppData\Local\Package Cache\{D22E5A19-BCA7-4438-904E-54CEB910C054}v3.13.14150.0\dev.msi
                                        • Size 480KB
                                        • SHA256 b60dc392e34de3ca850c618fe2e9623ee226d467a61e076a5e89da7388453647
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        prep_Activatable Class_Hermes_perf.cache
                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                        • Size 599B
                                        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        prep_Activatable Class_Hermes_perf.cache
                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                        • Size 607B
                                        • SHA256 7c21835f01895c1ee4e12f81e71ef06a0f6e2b9281de493ff8ec95f913e9680d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        microsoftwindows.client[1].xml
                                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MBF293VK\microsoftwindows.client[1].xml
                                        • Size 1KB
                                        • SHA256 fa854fd8e8739bb363d83b18fddd3c0cc164ba2b84213f46d9f8060be2208d81
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        _weakrefset.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\_weakrefset.py
                                        • Size 5KB
                                        • SHA256 cf8031a6e21150438f3d2964c4152615b91a03894616d5b6930e0f14f44dabda
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        __init__.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\collections\__init__.py
                                        • Size 52KB
                                        • SHA256 1544f4bff93cfc4e90b92861a6d372a657da7f9a67ffd609fe4ea0aa83c9f74a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        contextlib.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\contextlib.py
                                        • Size 27KB
                                        • SHA256 ca6071e379d65e1ed13fea5206fb4cee35fdb6b3063fa4a47254acf10e42b764
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        copyreg.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\copyreg.py
                                        • Size 7KB
                                        • SHA256 ea2363638fe83e8e5b007013a821841371a615d99414b3c2f8f19152ca109a07
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        __init__.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\encodings\__init__.py
                                        • Size 6KB
                                        • SHA256 f5386daf877e1b48c0bb1daf06822dfc459d2a4da7303ca025c1390603794b00
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        aliases.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\encodings\aliases.py
                                        • Size 16KB
                                        • SHA256 93335a7851c6c3d2c232b389be9db729d6d460f36ab0de5ba023f1dcb390e3cc
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cp1252.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\encodings\cp1252.py
                                        • Size 13KB
                                        • SHA256 7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        utf_8.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\encodings\utf_8.py
                                        • Size 1KB
                                        • SHA256 9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        __init__.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\ensurepip\__init__.py
                                        • Size 8KB
                                        • SHA256 cac73a7d5f1c08722aa2176a6ee9ea68d98ed8b075ce242d2d8ba3b723f6b6e8
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        enum.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\enum.py
                                        • Size 85KB
                                        • SHA256 ef73b4f4d123a78f1b808c7a4360fc3934bca63c3aa63fb3d65ce71ee9c2b419
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        fnmatch.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\fnmatch.py
                                        • Size 6KB
                                        • SHA256 f6bffb8506a5789658def5818c0e657003a4a39f5035d73662d439695acce42a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        functools.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\functools.py
                                        • Size 39KB
                                        • SHA256 587ba6a69f57c2f3710aea3f2ee308f13889231e16b32ef62c42def7f496ec6f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        __init__.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\importlib\__init__.py
                                        • Size 4KB
                                        • SHA256 b9db2f9b696913507da9fd83ecfc1f73cf6215d4c5a5cf4b4848688a8c710dc0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _abc.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\importlib\_abc.py
                                        • Size 1KB
                                        • SHA256 795157b91862d662ae681c0521daa1311b34b763b955e01505a27c865d848eae
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        keyword.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\keyword.py
                                        • Size 1KB
                                        • SHA256 1f28f509383273238ad86eda04a96343fa0dc10eeaf3189439959d75cdac0a0b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        locale.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\locale.py
                                        • Size 87KB
                                        • SHA256 1ccb7987ecb37f507a1efbcf6706abcea6d507ea3091fe706a7f40931210b37b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        operator.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\operator.py
                                        • Size 11KB
                                        • SHA256 67913d932dac8b13318940921d45a3f7788d063435abeba40201a620d09014f1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        __init__.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\re\__init__.py
                                        • Size 17KB
                                        • SHA256 af6b51360592d5b38a256a19e717061fa2656d80c112fac578b742b4773edd76
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _casefix.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\re\_casefix.py
                                        • Size 5KB
                                        • SHA256 b0dee234e5f8096fc9c1b035ec52d0b1b50cc1f3aea20b360b8be902e53ac752
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _compiler.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\re\_compiler.py
                                        • Size 26KB
                                        • SHA256 d7ef020125816e25ef2ca687267c620e4662b8f0845ad118dbadbf0154a65543
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _constants.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\re\_constants.py
                                        • Size 6KB
                                        • SHA256 ef5f6b04831fcff51f1637316b832d28af860d6d67736edad036ad3ffb059858
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _parser.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\re\_parser.py
                                        • Size 41KB
                                        • SHA256 b133abc2964b936e0aed859dc3e315cac8b5cb05d48e44ac0acfdbcb40971271
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        reprlib.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\reprlib.py
                                        • Size 8KB
                                        • SHA256 e3da8bc1dc78e91b0a8f78abda2312fa07f03fd3f83c07286aa9219fe7653706
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        shutil.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\shutil.py
                                        • Size 57KB
                                        • SHA256 adf48ad360319b5b80fba955ab8537f6c6a0910e13eefc584250f1f18b4ced34
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        signal.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\signal.py
                                        • Size 2KB
                                        • SHA256 0b7e3d3d39a120142dbf4875d7d79579cad8fee662add30c2375a797f0d2386e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        subprocess.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\subprocess.py
                                        • Size 90KB
                                        • SHA256 7b58820104e7243c80ced7ad4081bf971fed0a4099850bcfb50261625645ed20
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        __init__.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\sysconfig\__init__.py
                                        • Size 27KB
                                        • SHA256 46515babbd34f2d2ffdb638f1a756c2b66c4d88ca0ca264888cfeeff3699d58a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        tempfile.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\tempfile.py
                                        • Size 32KB
                                        • SHA256 453adcf948ed79370ca115db592b7ce46cb1cf6d356b1439b4a78783443babf3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        __init__.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\test\test_importlib\frozen\__init__.py
                                        • Size 147B
                                        • SHA256 6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        __main__.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\test\test_importlib\frozen\__main__.py
                                        • Size 62B
                                        • SHA256 b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        threading.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\threading.py
                                        • Size 55KB
                                        • SHA256 4aed0d27bf0b573c1ea45c76ca961575a084612d76832420d8ca2c1a52a09536
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        types.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\types.py
                                        • Size 11KB
                                        • SHA256 96919d554410eba9ab752cd8cc5bb845d7f263a08bfeb8fe5ab94bc3d4c1aaab
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        warnings.py
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\warnings.py
                                        • Size 27KB
                                        • SHA256 00de170abadda128ee79946e37f694cf0a550c3a3d7d42fe89db70039282ae42
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        pip.exe
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\Scripts\pip.exe
                                        • Size 105KB
                                        • SHA256 4ca5ead05f0c0fe9e2a5ba12262979f2c2da428ddd1b1f09cfc0663299fbf112
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        python.exe
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe
                                        • Size 103KB
                                        • SHA256 ef8f51028ac5329641985112f8efb1c2d4c47c86b8011ddf7e6fae21e2b4e5a1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        python313.dll
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\python313.dll
                                        • Size 5.8MB
                                        • SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        vcruntime140.dll
                                        • Path C:\Users\Admin\AppData\Local\Programs\Python\Python313\vcruntime140.dll
                                        • Size 117KB
                                        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Python 3.13.14 (64-bit)_20260709162332_000_core_JustForMe.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.14 (64-bit)_20260709162332_000_core_JustForMe.log
                                        • Size 3KB
                                        • SHA256 4cdda74cc0060e5aba118dd987f27877a5ada9c981f44459f5002b362ed66b9b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Python 3.13.14 (64-bit)_20260709162332_001_exe_JustForMe.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.14 (64-bit)_20260709162332_001_exe_JustForMe.log
                                        • Size 3KB
                                        • SHA256 f0eaed1879c80b471a154562621b230fc61ad9cbb83cd102654df34f2ed9323e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Python 3.13.14 (64-bit)_20260709162332_002_dev_JustForMe.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.14 (64-bit)_20260709162332_002_dev_JustForMe.log
                                        • Size 107KB
                                        • SHA256 085fc19254a8c4847ac08cb66a72af727facbbb4fa5d08187dfec2b9dafdd925
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Python 3.13.14 (64-bit)_20260709162332_003_lib_JustForMe.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.14 (64-bit)_20260709162332_003_lib_JustForMe.log
                                        • Size 3KB
                                        • SHA256 be0dd1e829b3db011820f87e16f6322b9092a3bc16c3c983a5fd83933dd0da0f
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Python 3.13.14 (64-bit)_20260709162332_004_test_JustForMe.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.14 (64-bit)_20260709162332_004_test_JustForMe.log
                                        • Size 1KB
                                        • SHA256 3f6f4f5ed4c7e39d731e858e7148d799ccf685b5cb1a4dfeec13d3b04e345f43
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Python 3.13.14 (64-bit)_20260709162332_005_doc_JustForMe.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.14 (64-bit)_20260709162332_005_doc_JustForMe.log
                                        • Size 1KB
                                        • SHA256 7d64e196aa66b61c2f487b8af4bbe2f5fbf6daab1456c55605482013967a9537
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Python 3.13.14 (64-bit)_20260709162332_006_tcltk_JustForMe.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.14 (64-bit)_20260709162332_006_tcltk_JustForMe.log
                                        • Size 1KB
                                        • SHA256 3611c0544a98520946965ddbbebe05e16c95dd3cd4c31a4eea2a6708f11be22f
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Python 3.13.14 (64-bit)_20260709162332_007_launcher_JustForMe.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.14 (64-bit)_20260709162332_007_launcher_JustForMe.log
                                        • Size 1KB
                                        • SHA256 25986b23bff8ad5d8b8fae2ba0ec634ac38e4be1482440e059acbea5e2b72733
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Python 3.13.14 (64-bit)_20260709162332_008_pip_JustForMe.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.13.14 (64-bit)_20260709162332_008_pip_JustForMe.log
                                        • Size 1KB
                                        • SHA256 d0c8667808f66f0b48bf97b6c8c263b197cb0e630623edf7649537a34b9a11eb
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        tmpaddon
                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                        • Size 11KB
                                        • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        tmpaddon
                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                        • Size 502KB
                                        • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        5f7b5f1e01b83767.automaticDestinations-ms
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms
                                        • Size 14KB
                                        • SHA256 df00454fef12a00be4ab42428bceed86d8c7c068e983f17ba10f6f8367639840
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        f01b4d95cf55d32a.automaticDestinations-ms
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                                        • Size 7KB
                                        • SHA256 683a985575dbf7c46470b7360068b2ec736198926f1b39b3e523742a5e5aaf8a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        f01b4d95cf55d32a.automaticDestinations-ms
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                                        • Size 7KB
                                        • SHA256 b813d0b824d9b5404362b784cf3e2a5529c3d820111b07b0bd79ffbd0adc08c5
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Python 3.13 (64-bit).lnk
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.13\Python 3.13 (64-bit).lnk
                                        • Size 1KB
                                        • SHA256 00cf6d2c6d1a12cdfa5e37ef0f5e51a7872c7bbeef79f54c8f5c90f98b6325e0
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Python 3.13 Manuals (64-bit).lnk
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.13\Python 3.13 Manuals (64-bit).lnk
                                        • Size 1KB
                                        • SHA256 3c7312f6cba655b10a0a0c0ca68fb987f15f7cc32d567c06f207293011d1b698
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        AlternateServices.bin
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\AlternateServices.bin
                                        • Size 18KB
                                        • SHA256 b498c957df4ed7acbd7215ae364416ebf80542d1f70eb8603b36c160e60a6205
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        AlternateServices.bin
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\AlternateServices.bin
                                        • Size 7KB
                                        • SHA256 6f75c8f31dc512f5976609609a490f7cb6a6351dbf820e3795d00a1587f71ae8
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        data.safe.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
                                        • Size 6KB
                                        • SHA256 f341fcd36f5f001055327b5a0014954489afe98788eaae8040a1df20fabc6380
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        data.safe.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
                                        • Size 7KB
                                        • SHA256 9013fef89209a348ecc9ebb2c78585b7a93e6bf0e58cd5f247851aa3ba7c2123
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        events
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\events\events
                                        • Size 5KB
                                        • SHA256 2b6816a8ba69846c80d5a4c7d90d1664f21df2b0cc0a97bf627f11034f053cc7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        events
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\events\events
                                        • Size 1KB
                                        • SHA256 8ee2d9bf50ef51124b6b1c46b02c7e1db606352a42aa7d78eb1122d1b410b5de
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        1d64df59-741f-4e2a-a620-b5400b218fb6
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\1d64df59-741f-4e2a-a620-b5400b218fb6
                                        • Size 16KB
                                        • SHA256 608eff22042ba11b0c9559cfbd1c7f656268dc0a872c0eb375dfb9abf4c3b416
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        358765e4-236e-4676-984b-baa5b69fcd04
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\358765e4-236e-4676-984b-baa5b69fcd04
                                        • Size 883B
                                        • SHA256 6e7cf3e4dc9f566d79e4540b0c99d5e53ef5207fddeae004a4260847fdd39f14
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        52fcb51d-e5dc-490d-9b9e-5c552a171aad
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\52fcb51d-e5dc-490d-9b9e-5c552a171aad
                                        • Size 235B
                                        • SHA256 348a89110c355430512a2f65db61f4f73fafc2e2d1181d3a11fbf2549a49bbca
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        88db30f5-b101-4497-9e1a-7ed9384fa950
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\88db30f5-b101-4497-9e1a-7ed9384fa950
                                        • Size 235B
                                        • SHA256 17ec987797c1829e9579dbb63879a86c649b0c0fbfe7556d14b2af6162b35517
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        971ae61a-1c19-4b99-83af-f3029829be58
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\971ae61a-1c19-4b99-83af-f3029829be58
                                        • Size 886B
                                        • SHA256 1a6faa5d65173474f6b03d9ce6ea5fb028b1c19e878d8786abd0234db24cbe82
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        b9f0df1b-50cb-44f9-a675-49236383d0c9
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\b9f0df1b-50cb-44f9-a675-49236383d0c9
                                        • Size 2KB
                                        • SHA256 826edd1094e74601f48523ebb81b45a22bde0c1d21b729683e6fc1acaaea77f5
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        extensions.json
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\extensions.json
                                        • Size 16KB
                                        • SHA256 6c8a8d26211e89e24f5efaed7e5fd83e5f235f9aea4722dea0c1c52e016c73dd
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        gmpopenh264.dll
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                        • Size 1.1MB
                                        • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        gmpopenh264.info
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                        • Size 116B
                                        • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        manifest.json
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                        • Size 1002B
                                        • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        widevinecdm.dll
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                        • Size 21.6MB
                                        • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        prefs-1.js
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs-1.js
                                        • Size 8KB
                                        • SHA256 294aa62ad975ea8d932e07985aa7e6b3ebe426c19e5cd8eddb2ab352c5d5229b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        prefs-1.js
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs-1.js
                                        • Size 6KB
                                        • SHA256 aa194e0133cb078b8bbaec3811012a0a2294b05123cd8ce5861304c353ca7b53
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        prefs-1.js
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs-1.js
                                        • Size 6KB
                                        • SHA256 8d68fa5bcd0ce4f793cae47d41b9928c6b5406379d5fa1179f2576d799b90325
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        prefs.js
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs.js
                                        • Size 7KB
                                        • SHA256 57609e9558d05d281c5b54426d9bcc87fc3465d925c2d65368b39b573c244aee
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        prefs.js
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs.js
                                        • Size 6KB
                                        • SHA256 d3b974c582bc4d92e98095254ac4dfd647dc1a9b8d4807e2a288dfd0c4b0b659
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        prefs.js
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs.js
                                        • Size 7KB
                                        • SHA256 73544b136787f10dd39831201da4dad232669124b78d3ab819bbc74924db6cd8
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        recovery.baklz4
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\sessionstore-backups\recovery.baklz4
                                        • Size 9KB
                                        • SHA256 1700ea5b753ad9f04c7cf96636130d0770833a64f51c9cd52a1c0360b6dd2d83
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        3870112724rsegmnoittet-es.sqlite
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                        • Size 6.4MB
                                        • SHA256 363e46512593ae912d3b71555c44cb4c211cd057d0d909e3b3e86a134754af7b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        python-3.13.14-amd64.exe
                                        • Path C:\Users\Admin\Downloads\python-3.13.14-amd64.exe
                                        • Size 27.9MB
                                        • SHA256 c54d9b9bbb8a36e6489363ddd01139707fd781d72f1f9e90c7ec65d0061368e0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        MSIF633.tmp
                                        • Path C:\Windows\Installer\MSIF633.tmp
                                        • Size 234KB
                                        • SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        PythonBA.dll
                                        • Path C:\Windows\Temp\{326F7A97-BBC9-4AA7-8971-6A6AE9D88E50}\.ba\PythonBA.dll
                                        • Size 701KB
                                        • SHA256 3d9d569ed086f4f2d98349c86c45e4475df727c567800c391ad995881cfaecaf
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        SideBar.png
                                        • Path C:\Windows\Temp\{326F7A97-BBC9-4AA7-8971-6A6AE9D88E50}\.ba\SideBar.png
                                        • Size 50KB
                                        • SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        pip_JustForMe
                                        • Path C:\Windows\Temp\{326F7A97-BBC9-4AA7-8971-6A6AE9D88E50}\pip_JustForMe
                                        • Size 288KB
                                        • SHA256 59e9a8f2303bb088c5bddeda23185ac78b020cf0c277e50312749ea69e9321f7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        python-3.13.14-amd64.exe
                                        • Path C:\Windows\Temp\{F1952913-E1BF-4CEC-B155-7349419E4121}\.cr\python-3.13.14-amd64.exe
                                        • Size 881KB
                                        • SHA256 d13115fe7f60f3a04130f25132dab2f2917ab21f0959055a2e07cb3d49695cd1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        memory/2436-1476-0x000000000DFE0000-0x000000000E85B000-memory.dmp
                                        Download

                                        memory/2436-8526-0x000000000DFE0000-0x000000000E85B000-memory.dmp
                                        Download

                                        memory/2436-8704-0x000000000DFE0000-0x000000000E85B000-memory.dmp
                                        Download

                                        memory/2436-533-0x000000000DFE0000-0x000000000E85B000-memory.dmp
                                        Download

                                        memory/2436-8688-0x000000000DFE0000-0x000000000E85B000-memory.dmp
                                        Download

                                        memory/2436-920-0x000000000DFE0000-0x000000000E85B000-memory.dmp
                                        Download

                                        memory/2436-187-0x000000000DFE0000-0x000000000E85B000-memory.dmp
                                        Download

                                        memory/5404-8350-0x00000173270A0000-0x00000173271A0000-memory.dmp
                                        Download

                                        memory/5404-40-0x0000016B04080000-0x0000016B04180000-memory.dmp
                                        Download

                                        memory/5404-8348-0x00000173270A0000-0x00000173271A0000-memory.dmp
                                        Download

                                        memory/5404-19-0x0000016B001E0000-0x0000016B002E0000-memory.dmp
                                        Download

                                        memory/5404-7815-0x0000016B06260000-0x0000016B06360000-memory.dmp
                                        Download

                                        memory/5404-52-0x0000016B04460000-0x0000016B04480000-memory.dmp
                                        Download

                                        memory/5404-66-0x0000016B04420000-0x0000016B04440000-memory.dmp
                                        Download

                                        memory/5404-39-0x0000016B03CC0000-0x0000016B03CE0000-memory.dmp
                                        Download