From bbf17080384721ed97405534914d1a612d05fa97 Mon Sep 17 00:00:00 2001 From: onurmerdogan Date: Wed, 23 Sep 2026 16:13:56 +0200 Subject: [PATCH 1/2] Attack Data for Renamed Binary Detections --- .../renamed_3rd_party_software.log | 2 ++ .../renamed_3rd_party_software.yml | 13 +++++++++++++ .../renamed_command_interpreter.log | 4 ++++ .../renamed_command_interpreter.yml | 13 +++++++++++++ .../renamed_python_binary/renamed_python_binary.log | 2 ++ .../renamed_python_binary/renamed_python_binary.yml | 13 +++++++++++++ 6 files changed, 47 insertions(+) create mode 100644 datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.log create mode 100644 datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.yml create mode 100644 datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.log create mode 100644 datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.yml create mode 100644 datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.log create mode 100644 datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.yml diff --git a/datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.log b/datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.log new file mode 100644 index 000000000..ea8c1a88b --- /dev/null +++ b/datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.log @@ -0,0 +1,2 @@ +154100x8000000000000000434198Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 15:11:09.674{1b43529b-9a8d-6ab2-f01f-050000006600}6792C:\Users\Administrator\Downloads\7z2603-extra\7zabc.exe26.037-Zip Standalone Console7-ZipIgor Pavlov7za.exe..\Downloads\7z2603-extra\7zabc.exe a -t7z -m0=lzma -mx=9 -mfb=64 -md=32m -ms=on archive.7z node-v26.8.2-win-x64C:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=60C82C4D7BE69C1CF6E06758EBD4A024,SHA256=E0B1D095D464C1051381A775A166E9650E74A95529DC4274A5ADFD5515B406B0,IMPHASH=3FC9509D7EC21F1FABEA4EF0129B7A72{1b43529b-9660-6ab2-4c1f-050000006600}1188C:\Users\Administrator\Desktop\smthelse.exe"C:\Users\Administrator\Desktop\smthelse.exe" /K whoamiEC2AMAZ-FKEOM7G\Administrator +154100x8000000000000000434188Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 15:09:49.471{1b43529b-9a3d-6ab2-e91f-050000006600}6140C:\Users\Administrator\Downloads\7z2603-extra\mza.exe26.037-Zip Standalone Console7-ZipIgor Pavlov7za.exe..\Downloads\7z2603-extra\mza.exe a -t7z -m0=lzma -mx=9 -mfb=64 -md=32m -ms=on archive.7z node-v26.8.2-win-x64C:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=60C82C4D7BE69C1CF6E06758EBD4A024,SHA256=E0B1D095D464C1051381A775A166E9650E74A95529DC4274A5ADFD5515B406B0,IMPHASH=3FC9509D7EC21F1FABEA4EF0129B7A72{1b43529b-9660-6ab2-4c1f-050000006600}1188C:\Users\Administrator\Desktop\smthelse.exe"C:\Users\Administrator\Desktop\smthelse.exe" /K whoamiEC2AMAZ-FKEOM7G\Administrator diff --git a/datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.yml b/datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.yml new file mode 100644 index 000000000..c23dc1b5c --- /dev/null +++ b/datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: 46057aa5-4909-43f6-8628-79cf2687c4ba +date: '2025-09-23' +description: Generated datasets for renamed 3rd party software in attack range. +environment: attack_range +directory: renamed_3rd_party_software +mitre_technique: +- T1036.003 +datasets: +- name: renamed_3rd_party_software + path: /datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file diff --git a/datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.log b/datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.log new file mode 100644 index 000000000..47680c0f2 --- /dev/null +++ b/datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.log @@ -0,0 +1,4 @@ +154100x8000000000000000433935Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 14:54:13.343{1b43529b-9695-6ab2-591f-050000006600}5532C:\Users\Administrator\Desktop\cmd32.exe10.0.26100.7309 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe.\cmd32.exe /c whoamiC:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=6D109A3A00F210C1AB89C3B08399ED48,SHA256=64AFC6DB3AAD1289533662E2D79E27DD55C7DCDB8CD918B08E145AD82AD5ACB4,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{1b43529b-9660-6ab2-4c1f-050000006600}1188C:\Users\Administrator\Desktop\smthelse.exe"C:\Users\Administrator\Desktop\smthelse.exe" /K whoamiEC2AMAZ-FKEOM7G\Administrator +154100x8000000000000000433928Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 14:54:00.089{1b43529b-9688-6ab2-571f-050000006600}5180C:\Users\Administrator\Desktop\32cmd.exe10.0.26100.7309 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe.\32cmd.exe /c whoamiC:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=6D109A3A00F210C1AB89C3B08399ED48,SHA256=64AFC6DB3AAD1289533662E2D79E27DD55C7DCDB8CD918B08E145AD82AD5ACB4,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{1b43529b-9660-6ab2-4c1f-050000006600}1188C:\Users\Administrator\Desktop\smthelse.exe"C:\Users\Administrator\Desktop\smthelse.exe" /K whoamiEC2AMAZ-FKEOM7G\Administrator +154100x8000000000000000433918Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 14:53:33.641{1b43529b-966d-6ab2-4f1f-050000006600}5724C:\Users\Administrator\Desktop\smthelse.exe10.0.26100.7309 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe.\smthelse.exe /c whoamiC:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=6D109A3A00F210C1AB89C3B08399ED48,SHA256=64AFC6DB3AAD1289533662E2D79E27DD55C7DCDB8CD918B08E145AD82AD5ACB4,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{1b43529b-9660-6ab2-4c1f-050000006600}1188C:\Users\Administrator\Desktop\smthelse.exe"C:\Users\Administrator\Desktop\smthelse.exe" /K whoamiEC2AMAZ-FKEOM7G\Administrator +154100x8000000000000000433911Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 14:53:20.765{1b43529b-9660-6ab2-4c1f-050000006600}1188C:\Users\Administrator\Desktop\smthelse.exe10.0.26100.7309 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe"C:\Users\Administrator\Desktop\smthelse.exe" /K whoamiC:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=6D109A3A00F210C1AB89C3B08399ED48,SHA256=64AFC6DB3AAD1289533662E2D79E27DD55C7DCDB8CD918B08E145AD82AD5ACB4,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{1b43529b-9653-6ab2-4b1f-050000006600}6768C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeEC2AMAZ-FKEOM7G\Administrator diff --git a/datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.yml b/datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.yml new file mode 100644 index 000000000..016151638 --- /dev/null +++ b/datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: bf88b359-6f72-4f6f-99da-14053ac7e39c +date: '2025-09-23' +description: Generated datasets for renamed command interpreter in attack range. +environment: attack_range +directory: renamed_command_interpreter +mitre_technique: +- T1036.003 +datasets: +- name: renamed_command_interpreter + path: /datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file diff --git a/datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.log b/datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.log new file mode 100644 index 000000000..af2fa0ffa --- /dev/null +++ b/datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.log @@ -0,0 +1,2 @@ +154100x8000000000000000434416Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 15:34:14.065{1b43529b-9ff6-6ab2-9b20-050000006600}6004C:\Users\Administrator\AppData\Local\Programs\Python\Python313\python.exe3.13.12PythonPythonPython Software Foundationpython.exeredpy\redpy-env\Scripts\mypon.exe -c "print('hello')"C:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=E1997259B673D2DC48827EC195F6A675,SHA256=A2A4EFF8D0B0C845284C607D50A3B5B966AC5A3121736A2E38E165BD6644D9FE,IMPHASH=D233964EAA90E1B69B31D0C96B47B8D3{1b43529b-9ff6-6ab2-9a20-050000006600}7184C:\Users\Administrator\Desktop\redpy\redpy-env\Scripts\mypon.exeredpy\redpy-env\Scripts\mypon.exe -c "print('hello')"EC2AMAZ-FKEOM7G\Administrator +154100x8000000000000000434408Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 15:34:04.966{1b43529b-9fec-6ab2-9920-050000006600}7088C:\Users\Administrator\AppData\Local\Programs\Python\Python313\python.exe3.13.12PythonPythonPython Software Foundationpython.exeredpy\redpy-env\Scripts\mypon.exe "print('hello')"C:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=E1997259B673D2DC48827EC195F6A675,SHA256=A2A4EFF8D0B0C845284C607D50A3B5B966AC5A3121736A2E38E165BD6644D9FE,IMPHASH=D233964EAA90E1B69B31D0C96B47B8D3{1b43529b-9fec-6ab2-9820-050000006600}8720C:\Users\Administrator\Desktop\redpy\redpy-env\Scripts\mypon.exeredpy\redpy-env\Scripts\mypon.exe "print('hello')"EC2AMAZ-FKEOM7G\Administrator diff --git a/datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.yml b/datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.yml new file mode 100644 index 000000000..86bd91079 --- /dev/null +++ b/datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: 620c34ae-aff8-41d0-9831-9b21b4f90d34 +date: '2025-09-23' +description: Generated datasets for renamed python binary in attack range. +environment: attack_range +directory: renamed_python_binary +mitre_technique: +- T1036.003 +datasets: +- name: renamed_python_binary + path: /datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file From 5966142d590748a54a24a7abc8e106b74033834c Mon Sep 17 00:00:00 2001 From: onurmerdogan Date: Wed, 23 Sep 2026 16:20:53 +0200 Subject: [PATCH 2/2] added through lfs --- .../renamed_3rd_party_software.log | 5 +++-- .../renamed_command_interpreter.log | 7 +++---- .../renamed_python_binary/renamed_python_binary.log | 5 +++-- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.log b/datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.log index ea8c1a88b..d5d2936b4 100644 --- a/datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.log +++ b/datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.log @@ -1,2 +1,3 @@ -154100x8000000000000000434198Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 15:11:09.674{1b43529b-9a8d-6ab2-f01f-050000006600}6792C:\Users\Administrator\Downloads\7z2603-extra\7zabc.exe26.037-Zip Standalone Console7-ZipIgor Pavlov7za.exe..\Downloads\7z2603-extra\7zabc.exe a -t7z -m0=lzma -mx=9 -mfb=64 -md=32m -ms=on archive.7z node-v26.8.2-win-x64C:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=60C82C4D7BE69C1CF6E06758EBD4A024,SHA256=E0B1D095D464C1051381A775A166E9650E74A95529DC4274A5ADFD5515B406B0,IMPHASH=3FC9509D7EC21F1FABEA4EF0129B7A72{1b43529b-9660-6ab2-4c1f-050000006600}1188C:\Users\Administrator\Desktop\smthelse.exe"C:\Users\Administrator\Desktop\smthelse.exe" /K whoamiEC2AMAZ-FKEOM7G\Administrator -154100x8000000000000000434188Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 15:09:49.471{1b43529b-9a3d-6ab2-e91f-050000006600}6140C:\Users\Administrator\Downloads\7z2603-extra\mza.exe26.037-Zip Standalone Console7-ZipIgor Pavlov7za.exe..\Downloads\7z2603-extra\mza.exe a -t7z -m0=lzma -mx=9 -mfb=64 -md=32m -ms=on archive.7z node-v26.8.2-win-x64C:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=60C82C4D7BE69C1CF6E06758EBD4A024,SHA256=E0B1D095D464C1051381A775A166E9650E74A95529DC4274A5ADFD5515B406B0,IMPHASH=3FC9509D7EC21F1FABEA4EF0129B7A72{1b43529b-9660-6ab2-4c1f-050000006600}1188C:\Users\Administrator\Desktop\smthelse.exe"C:\Users\Administrator\Desktop\smthelse.exe" /K whoamiEC2AMAZ-FKEOM7G\Administrator +version https://git-lfs.github.com/spec/v1 +oid sha256:ce82892b197330266afe57e650841d9cd4fb83675943725386f114ea944d0957 +size 4094 diff --git a/datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.log b/datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.log index 47680c0f2..80abdce4e 100644 --- a/datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.log +++ b/datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.log @@ -1,4 +1,3 @@ -154100x8000000000000000433935Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 14:54:13.343{1b43529b-9695-6ab2-591f-050000006600}5532C:\Users\Administrator\Desktop\cmd32.exe10.0.26100.7309 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe.\cmd32.exe /c whoamiC:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=6D109A3A00F210C1AB89C3B08399ED48,SHA256=64AFC6DB3AAD1289533662E2D79E27DD55C7DCDB8CD918B08E145AD82AD5ACB4,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{1b43529b-9660-6ab2-4c1f-050000006600}1188C:\Users\Administrator\Desktop\smthelse.exe"C:\Users\Administrator\Desktop\smthelse.exe" /K whoamiEC2AMAZ-FKEOM7G\Administrator -154100x8000000000000000433928Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 14:54:00.089{1b43529b-9688-6ab2-571f-050000006600}5180C:\Users\Administrator\Desktop\32cmd.exe10.0.26100.7309 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe.\32cmd.exe /c whoamiC:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=6D109A3A00F210C1AB89C3B08399ED48,SHA256=64AFC6DB3AAD1289533662E2D79E27DD55C7DCDB8CD918B08E145AD82AD5ACB4,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{1b43529b-9660-6ab2-4c1f-050000006600}1188C:\Users\Administrator\Desktop\smthelse.exe"C:\Users\Administrator\Desktop\smthelse.exe" /K whoamiEC2AMAZ-FKEOM7G\Administrator -154100x8000000000000000433918Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 14:53:33.641{1b43529b-966d-6ab2-4f1f-050000006600}5724C:\Users\Administrator\Desktop\smthelse.exe10.0.26100.7309 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe.\smthelse.exe /c whoamiC:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=6D109A3A00F210C1AB89C3B08399ED48,SHA256=64AFC6DB3AAD1289533662E2D79E27DD55C7DCDB8CD918B08E145AD82AD5ACB4,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{1b43529b-9660-6ab2-4c1f-050000006600}1188C:\Users\Administrator\Desktop\smthelse.exe"C:\Users\Administrator\Desktop\smthelse.exe" /K whoamiEC2AMAZ-FKEOM7G\Administrator -154100x8000000000000000433911Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 14:53:20.765{1b43529b-9660-6ab2-4c1f-050000006600}1188C:\Users\Administrator\Desktop\smthelse.exe10.0.26100.7309 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe"C:\Users\Administrator\Desktop\smthelse.exe" /K whoamiC:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=6D109A3A00F210C1AB89C3B08399ED48,SHA256=64AFC6DB3AAD1289533662E2D79E27DD55C7DCDB8CD918B08E145AD82AD5ACB4,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{1b43529b-9653-6ab2-4b1f-050000006600}6768C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeEC2AMAZ-FKEOM7G\Administrator +version https://git-lfs.github.com/spec/v1 +oid sha256:9e53987a2828fe0cce719abee62df2eca8da92625fc29448f7a59825f50dbda7 +size 8138 diff --git a/datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.log b/datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.log index af2fa0ffa..51fa0612c 100644 --- a/datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.log +++ b/datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.log @@ -1,2 +1,3 @@ -154100x8000000000000000434416Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 15:34:14.065{1b43529b-9ff6-6ab2-9b20-050000006600}6004C:\Users\Administrator\AppData\Local\Programs\Python\Python313\python.exe3.13.12PythonPythonPython Software Foundationpython.exeredpy\redpy-env\Scripts\mypon.exe -c "print('hello')"C:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=E1997259B673D2DC48827EC195F6A675,SHA256=A2A4EFF8D0B0C845284C607D50A3B5B966AC5A3121736A2E38E165BD6644D9FE,IMPHASH=D233964EAA90E1B69B31D0C96B47B8D3{1b43529b-9ff6-6ab2-9a20-050000006600}7184C:\Users\Administrator\Desktop\redpy\redpy-env\Scripts\mypon.exeredpy\redpy-env\Scripts\mypon.exe -c "print('hello')"EC2AMAZ-FKEOM7G\Administrator -154100x8000000000000000434408Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-22 15:34:04.966{1b43529b-9fec-6ab2-9920-050000006600}7088C:\Users\Administrator\AppData\Local\Programs\Python\Python313\python.exe3.13.12PythonPythonPython Software Foundationpython.exeredpy\redpy-env\Scripts\mypon.exe "print('hello')"C:\Users\Administrator\Desktop\EC2AMAZ-FKEOM7G\Administrator{1b43529b-5c95-6a84-1d1b-090000000000}0x91b1d2HighMD5=E1997259B673D2DC48827EC195F6A675,SHA256=A2A4EFF8D0B0C845284C607D50A3B5B966AC5A3121736A2E38E165BD6644D9FE,IMPHASH=D233964EAA90E1B69B31D0C96B47B8D3{1b43529b-9fec-6ab2-9820-050000006600}8720C:\Users\Administrator\Desktop\redpy\redpy-env\Scripts\mypon.exeredpy\redpy-env\Scripts\mypon.exe "print('hello')"EC2AMAZ-FKEOM7G\Administrator +version https://git-lfs.github.com/spec/v1 +oid sha256:e0337002000da2c37fef5a69b2cf43804e327c93dc9fca3a99dcbf7e63b0e3b1 +size 4056