hxxps://github[.]com/SydneyBTW17320/-Discord-Nitro-Generator-

Analysis

max time kernel
71s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/SydneyBTW17320/-Discord-Nitro-Generator-

Score

7^/10

spyware

Malware Config

Signatures

Loads dropped DLL 44 IoCs

pid	Process
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe
5392	Discord Nitro Generator.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
101	discord.com
90	discord.com
95	discord.com
96	discord.com
99	discord.com
100	discord.com
89	discord.com
97	discord.com
98	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
81	api.ipify.org
83	api.ipify.org

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
1816	msedge.exe
1816	msedge.exe
2236	identity_helper.exe
2236	identity_helper.exe
2540	msedge.exe
2540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1316	1816	msedge.exe	84
PID 1816 wrote to memory of 1316	1816	msedge.exe	84
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 2088	1816	msedge.exe	85
PID 1816 wrote to memory of 3500	1816	msedge.exe	86
PID 1816 wrote to memory of 3500	1816	msedge.exe	86
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87
PID 1816 wrote to memory of 3912	1816	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/SydneyBTW17320/-Discord-Nitro-Generator-
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c0e46f8,0x7ffa5c0e4708,0x7ffa5c0e4718
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13753116471316114175,8991951153380573155,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,13753116471316114175,8991951153380573155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,13753116471316114175,8991951153380573155,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13753116471316114175,8991951153380573155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13753116471316114175,8991951153380573155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13753116471316114175,8991951153380573155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13753116471316114175,8991951153380573155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13753116471316114175,8991951153380573155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13753116471316114175,8991951153380573155,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13753116471316114175,8991951153380573155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13753116471316114175,8991951153380573155,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13753116471316114175,8991951153380573155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,13753116471316114175,8991951153380573155,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,13753116471316114175,8991951153380573155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4304

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2632

C:\Users\Admin\Downloads\-Discord-Nitro-Generator--main\-Discord-Nitro-Generator--main\Discord Nitro Generator.exe
"C:\Users\Admin\Downloads\-Discord-Nitro-Generator--main\-Discord-Nitro-Generator--main\Discord Nitro Generator.exe"
1⤵
PID:3052
- C:\Users\Admin\Downloads\-Discord-Nitro-Generator--main\-Discord-Nitro-Generator--main\Discord Nitro Generator.exe
  "C:\Users\Admin\Downloads\-Discord-Nitro-Generator--main\-Discord-Nitro-Generator--main\Discord Nitro Generator.exe"
  2⤵
  - Loads dropped DLL
  PID:5392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a5597c7864093b080683374875147a41

SHA1
78c4f51d7b50de526c1a4be90cc53e5fc5dfd1f9

SHA256
92f4a2570eb5e277e32a53d23fa178b5d3783fd1b28d8cd1733c295b28bd34df

SHA512
90c1e5ec780180d761fd055d9da3fb699d0d62c54d74b9f72cac4f7956806337fe5032c61507b317cffbbd8183c8cfe43898ecab494dd0712592498ee3da3dbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
37baf21f6884d62dd3fae3bcac0e3f54

SHA1
86387f81e0e639f4b89ac148a2611dbe17c692e5

SHA256
fd6b196dedb818f06d7e045bc0ca39921765ba16deeb416261c8605de41aa1be

SHA512
13d36ff793b191e5036fad9a998d653eba70f27900f205c8eb1e2b336837f6a6b9977e0129b0645844b6d40a08883ccbc71b132e22f5577c5db8b44ad4f74461

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a1d015802668c8d1d269ce5992b8fae3

SHA1
edbed3a6e71a131dc063b528b168a48b222ad222

SHA256
d325d8147fd4881b9a7a8877176f4b6ecabff578569a11a775e07b6c92d8b203

SHA512
6b8bd780f741b9542a4921dad87969ee4aa60a578acc8e7312711496964f87f0fb0c231c4918b219189854300e8a7c8ad359a10bdd44777bca83c1ad9ddd7885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f659c09dd7523914af9e2d6d32f1194a

SHA1
f7fe1ff7c3f80f94873bbfb5d9767772b1309bca

SHA256
439082d10f1c33b537d320396b0661ee9661db720e20119d6ae7d2275e01d9d7

SHA512
90066c6a65892526b5f6c27f4a98c40ad8441299012e70077164fb093079c68021a2e71fd1acf2fde78c6e6204b3d9496aed41f4dee3f46419e1b6e22c95d747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb088e5579c3d833ca9f045c0412656c

SHA1
7f779661d5860b2ed2414c3c09129b229aeb75df

SHA256
7d14242d8be3492555daf9543efad4d6293f2dc21eb6022854fa86412fd196d8

SHA512
3310fb1e48d2a005823ea78f0d251c85282198b3dd2a16989566ded0e0edfcdffbf739a1423b0dcf6c71149106fec595112675cc2f43c9d1180b90cda0be7371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e91fe32f98e3c6b06b60f9bb33854f0f

SHA1
48beee3adeda572ef9002fd3a0d0e6c1847f94bc

SHA256
1a4221de1e51f68cfb939bd696f126142a4d5c0f214a6a6af6de5402c2182321

SHA512
cc5a868a97761d909e239c86b52835393c07b12e217b5e266be5deee44760a50ee7ba88aa63796077610510fcc1d2e4e07bd6e033027ffc4e9583d5f5853276b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
d3992400638c84d51e5bbc184832c1d4

SHA1
cadf322ebccafc859fb7f2db73133ef4b9e12833

SHA256
556c519bf63350f5e3c1aa1dab51d8eb1ff9c65bd528032ab897e5fecd068709

SHA512
0413e222d0c980e6ad5434f2a1abc385931aa58ca60d4b7790bd2d5c004efdc6bab522cdf790c37d5293d159afcfff5554b6f20e0a0c65921b8d06d169a0aa86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a3f1.TMP

Filesize
874B

MD5
7464b8dfabc6546d0f1e5f4463508a10

SHA1
7386551f873eb0e35565500615d6d065b6e5402b

SHA256
46e8f33fb2c88c9b70bd78efbafbaa8ae7b83f2ec70b71063d366feb48ebc658

SHA512
01df50a442745a7e4b0f510cd41db4fe453eced69c3e15b8bf80d96759fecc13bd3db37080cd3525c93c8de8f21562581c93fc2175f7ee9e18fbbbb2c370ce54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9c7ab2f44b150812b13f06cefa3dcb6f

SHA1
3a2a62be2981bfa52e40af5e6a87b278cc3574d3

SHA256
c71ba862d631a556cf71b010fdff4cf6ad07833f6702928a8d3d6e81452c7295

SHA512
22aa507514428e3a575c5a81aa8df219132fb61b5451b837cc1b559792d6f21318157ac7893dbffc34b14d6c2aeb6d9ea411d785b087273eed142968444cc341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6c48d25d360b154cb83f089cc7934dce

SHA1
ff122bd6c6bea041e5484ce35e504f58a66df0ba

SHA256
4ad251848a7a584e7e6afcf83d98107dfde81358beb9f0ead35975f927815724

SHA512
0bc088bcb6cd447567b290f1fae7c4f7e78222eabf0d54abb9258e3ce1b19c732fa41917f2fa38daf214e25b7e85d6f69fbcd0038b57a1e41ca3b88c558de224

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\Crypto\Cipher\_raw_ecb.pyd

Filesize
10KB

MD5
7435accde789b701a1df37462cc4e1ed

SHA1
7b3c8207f8a699cd2cd9428cd9740490555f7eed

SHA256
37a05109296a76194baa7bb7473cdb032a83b73b4c5b2d5f67d93a35ab97b9b6

SHA512
f9c5ca857be746ddc0587fe28d05840e9d72255f1ed001a74a0f8d25f97e5516d9e6ae3f58c8022832d663810969202efbe5d9dbdc40a1d4ab82f8fcd0bba67b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\_asyncio.pyd

Filesize
62KB

MD5
47de17275c73cfcdce18ace16cd4f355

SHA1
5d6b9b1d4534eeae0a3b72bfa359bb4818e4c86e

SHA256
d667822030ba160cd8770569afec2c029b5247ceaa401d9268fe98bbea9e4c11

SHA512
e11637808ddaf14d0abdb88a389e6947b16f272d97642312c99ec38bbcaf43e3594d8f89bc8699d769368704a81bc1f01edffa69ab736665c1c192aeed780c8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\_bz2.pyd

Filesize
81KB

MD5
10d42efac304861ad19821b4594fa959

SHA1
1a65f60bba991bc7e9322af1e19f193dae76d77a

SHA256
8eecdcc250637652e6babc306ea6b8820e9e835ddd2434816d0e0fd0ca67fd14

SHA512
3f16dba627a133586e9d1c16d383b9461424d31892278ab984f7e6932a1cdc51445e1bec017a665bd66c0f2a9ba417387fecc5fdede36d67f8343b82a2ceb9ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\_cffi_backend.cp311-win_amd64.pyd

Filesize
177KB

MD5
fde9a1d6590026a13e81712cd2f23522

SHA1
ca99a48caea0dbaccf4485afd959581f014277ed

SHA256
16eccc4baf6cf4ab72acd53c72a1f2b04d952e07e385e9050a933e78074a7d5b

SHA512
a522661f5c3eeea89a39df8bbb4d23e6428c337aac1d231d32b39005ea8810fce26af18454586e0e94e51ea4ac0e034c88652c1c09b1ed588aeac461766981f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\_ctypes.pyd

Filesize
120KB

MD5
df6be515e183a0e4dbe9cdda17836664

SHA1
a5e8796189631c1aaca6b1c40bc5a23eb20b85db

SHA256
af598ae52ddc6869f24d36a483b77988385a5bbbf4618b2e2630d89d10a107ee

SHA512
b3f23530de7386cc4dcf6ad39141240e56d36322e3d4041e40d69d80dd529d1f8ef5f65b55cdca9641e378603b5252acfe5d50f39f0c6032fd4c307f73ef9253

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\_hashlib.pyd

Filesize
62KB

MD5
f419ac6e11b4138eea1fe8c86689076a

SHA1
886cda33fa3a4c232caa0fa048a08380971e8939

SHA256
441d32922122e59f75a728cc818f8e50613866a6c3dec627098e6cc6c53624e2

SHA512
6b5aa5f5fbc00fb48f49b441801ee3f3214bd07382444569f089efb02a93ce907f6f4e0df281bda81c80f2d6a247b0adc7c2384a2e484bc7ef43b43c84756d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\_lzma.pyd

Filesize
153KB

MD5
3230404a7191c6228a8772d3610e49e5

SHA1
4e8e36c89b4ff440ddff9a5b084b262c9b2394ec

SHA256
33ae42f744d2688bb7d5519f32ff7b7489b96f4eea47f66d2009dba6a0023903

SHA512
6ecce0c8e8b3d42275d486e8ff495e81e36adaaacaaa3db37844e204fcdaa6d89cb3d81c43d9e16d938cd8b6671b8800fe74a1e723a9187b0566a8f3c39d5d5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\_overlapped.pyd

Filesize
48KB

MD5
f7a6519fd517ad2426b05ef9dccd31f6

SHA1
32b8df120ca2cfeb8349c1675c0907fd2132c76b

SHA256
6f79a76094f43c55899fe804cdd5d44ba6ff920c651436a7effa30e7c01b96ec

SHA512
2de7f8302743f36c21a6e3442960976a63396b93201f63579aa507274571fab801e228edc67a83d7729b6473d4b2899f0a9ae1b0a8b4e278d3b802eb896432dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\_queue.pyd

Filesize
30KB

MD5
045ef55136b1e580582199b3399267a2

SHA1
de54519c67a996d0a8b4164417058f4610a57376

SHA256
39bd456267fe228a505ef4e9c8d28f948dd65123cb4d48b77da51910013fa582

SHA512
7b764fdc92bf10eb05bdd4116a549de67f0fa92f807d8b0eca9d718361c546dbec16ea68ef8ddec1c417530c6eb234c657e45f8c522852ab1bd7cb21976dad1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\_socket.pyd

Filesize
76KB

MD5
0fc65ec300553d8070e6b44b9b23b8c0

SHA1
f8db6af578cf417cfcddb2ed798c571c1abd878f

SHA256
360744663fce8dec252abbda1168f470244fdb6da5740bb7ab3171e19106e63c

SHA512
cba375a815db973b4e8babda951d1a4ca90a976e9806e9a62520a0729937d25de8e600e79a7a638d77df7f47001d8f884e88ee4497bd1e05c1dae6fa67fb3dd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\_sqlite3.pyd

Filesize
115KB

MD5
57f807639dd032d6209b6a2a0622aa9f

SHA1
d020e47b327a4a08afcacd29d2d944d3efcd3053

SHA256
07caa7a57f68c126c9039b27536c8710be1a0e2779843247e26c85138ec2094f

SHA512
d5e81f9acf04e1d8bb9f4554746e0a16b754836c4c43f887af91f6d4e758f69073abd8cd1ddbd192d61f7fab4eef62b83200d7ffe97c50ea4905b30ee6481fc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\_ssl.pyd

Filesize
155KB

MD5
93905020f4158c5119d16ee6792f8057

SHA1
eb613c31f26ed6d80681815193ffafdf30314a07

SHA256
d9cc4358d9351fed11eec03753a8fa8ed981a6c2246bbd7cb0b0a3472c09fdc4

SHA512
0de43b4fafdd39eaaff6cab613708d56b697c0c17505e4132d652fb3f878c2114f5e682745a41219193c75e783aede524685b77bd31620f8afe9c7b250f92609

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\base_library.zip

Filesize
1.7MB

MD5
d56969208cc0c8ae4f4098f7af096276

SHA1
a74286189944c7bc7e6df41221abe95649f03462

SHA256
50da2499c686b66a484b546fe7f6d194d766cc2e8a123405fc89dcc0e23f8f50

SHA512
4146e9289721388901c600bddde7c5c0b6068c3fa5bb2016e53e52da993df71585b5c7dde0ab17345b0f8c13e5bf694e567b3dcd4d58bf49a26c7018eb246abd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\libcrypto-1_1.dll

Filesize
3.3MB

MD5
6f4b8eb45a965372156086201207c81f

SHA1
8278f9539463f0a45009287f0516098cb7a15406

SHA256
976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

SHA512
2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\libffi-8.dll

Filesize
37KB

MD5
d86a9d75380fab7640bb950aeb05e50e

SHA1
1c61aaf9022cd1f09a959f7b2a65fb1372d187d7

SHA256
68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b

SHA512
18437e64061221be411a1587f634b4b8efa60e661dbc35fd96a6d0e7eff812752de0ada755c01f286efefc47fb5f2daf07953b4cfc4119121b6bee7756c88d0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\libssl-1_1.dll

Filesize
686KB

MD5
8769adafca3a6fc6ef26f01fd31afa84

SHA1
38baef74bdd2e941ccd321f91bfd49dacc6a3cb6

SHA256
2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071

SHA512
fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\pyexpat.pyd

Filesize
193KB

MD5
4378685011241d01248dd60fc9cb5436

SHA1
d754286af98f5ae2ee82883669d509e105413ed1

SHA256
867012edb8a6acd2131c4698b69bb94e6ba07607035e7c621aaa24262817e55b

SHA512
f9ed5957de5846b97cd8dc8ef8cf876b3192c03afd148541053b31d1237ead67ca287dc95e109b70305a3eb1422d32d6bec1cd7598c79c718469d88ac2e82575

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\python3.dll

Filesize
64KB

MD5
7feb3da304a2fead0bb07d06c6c6a151

SHA1
ee4122563d9309926ba32be201895d4905d686ce

SHA256
ddd2c77222e2c693ef73d142422d6bf37d6a37deead17e70741b0ac5c9fe095b

SHA512
325568bcf1835dd3f454a74012f5d7c6877496068ad0c2421bf65e0640910ae43b06e920f4d0024277eee1683f0ce27959843526d0070683da0c02f1eac0e7d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\python311.dll

Filesize
5.5MB

MD5
a72993488cecd88b3e19487d646f88f6

SHA1
5d359f4121e0be04a483f9ad1d8203ffc958f9a0

SHA256
aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038

SHA512
c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\pywin32_system32\pythoncom311.dll

Filesize
675KB

MD5
f655cc794762ae686c65b969e83f1e84

SHA1
ac635354ea70333c439aa7f97f2e1759df883e38

SHA256
9111856645f779f137c46d78a68374292fc512a2a4038466476bb9c6024097b5

SHA512
7dde92438d920e832025ae0a54dbf1b7acc6192d937b1babc388706723e92910bd355aa4bb0e8ef6378c71460468537fef9fd3031d048adf0743d48aed229c14

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\pywin32_system32\pywintypes311.dll

Filesize
134KB

MD5
1696732a242bfaf6a50bd98eb7874f23

SHA1
090a85275c7c67430d511570bab36eb299c7e787

SHA256
6583c15de0f5a1b20c8750b0599e5cf162f91f239f8341bda842485d8bbc9887

SHA512
70a03adb89649cece59e6b84a2f79ad53cf7c308ffaca8b19c0b64b59858e73a75addd131776d54b5bf12b747bcbb1ff9a4ce0e35d06bb995e34c5687dd3a25b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\select.pyd

Filesize
28KB

MD5
116335ebc419dd5224dd9a4f2a765467

SHA1
482ef3d79bfd6b6b737f8d546cd9f1812bd1663d

SHA256
813eede996fc08e1c9a6d45aaa4cbae1e82e781d69885680a358b4d818cfc0d4

SHA512
41dc7facab0757ed1e286ae8e41122e09738733ad110c2918f5e2120dfb0dbff0daefcad2bffd1715b15b44c861b1dd7fb0d514983db50ddc758f47c1b9b3bf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\sqlite3.dll

Filesize
1.4MB

MD5
d0ffe8df8de72e18c2f08ad813d3a532

SHA1
a628abdf6f7f0e124bfb9bc88f451bb2ede76e21

SHA256
2b86d45728aa3def8ee9f3b150b1b5ee89aa26f5ed2b5509c8f9fa1c8b5c7b1b

SHA512
27be68c790a18477b315204bbd655a8e8101c26931474d955932140b9e1e887f7463a60f13c5b5883e04d7a80f87be64ab0ebd315b53533c7fb9530800627df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\unicodedata.pyd

Filesize
1.1MB

MD5
cdb5f373d24adceb4dc4fa1677757f0c

SHA1
af6b381eed65d244c57129346008ec8532ba336b

SHA256
175c4cb528f1ac4e285c575cc3f5e85ec4b3ae88860210b5d795b580c7f0b5d9

SHA512
429a326648c761bf068ca7735094644f532d631cf9355c9f1a5743a5791837a36cd6aa2efe2265c7541feb06310d0c07b634dd04438d8eddbdf1c4147938a868

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30522\win32api.pyd

Filesize
136KB

MD5
3210cb66deb7f1bbcc46b4c3832c7e10

SHA1
5c5f59a29f5ef204f52fd3a9433b3a27d8a30229

SHA256
bf5147f4fffbffa77d9169b65af13d983e2fcccdbca8151d72814c55939bb2c4

SHA512
5d51ede8f464ca7e151bfaaef0b7e81f5ce16678d35a573cae2994db602c2d93f0463c3936fb896dee1cf5192b69fb1051594efa5d4f248a02226ca50b6bfa5c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 305879.crdownload

Filesize
19.0MB

MD5
7291377aa78e9b244020a98193587b03

SHA1
0584e7f7e63e542a1835da9f0123db9c3d1e99df

SHA256
0a03fde82f637cc7329331945f931e17e53a8f3bd609b3e381e8f893c38ee68f

SHA512
059c1c505c9ee0a5fd9b189f5a7f1f7e304ae794a992e628333ed277bb5fdfb1259d00670709f6d24681892ad62fa761e35b64f97bc421b7dede04402562702f

Download Submit