quasar | hxxps://github[.]com/yournotaloser/PG3DNAZI-MOD

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2024 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/yournotaloser/PG3DNAZI-MOD

Score

10^/10

quasar novaclientfix discovery persistence pyinstaller spyware stealer trojan upx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

NovaClientFix

five2-26874.portmap.host:4782

five2-26874.portmap.host:26874

Mutex

17c21f84-e404-4b5a-9c66-6af36c91af40

Attributes

encryption_key
6A8D8A92555E054898F990B4C1C4672BCAF35F39
install_name
NovaClientFix.exe
log_directory
Logs
reconnect_delay
3000
startup_key
NovaClientFix
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000700000001da96-219.dat	family_quasar
behavioral1/memory/6128-247-0x0000000000570000-0x0000000000894000-memory.dmp	family_quasar

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

Processes:

PG3D NaziMod Installer.exeNovaClientFix.exePG3D NaziMod Installer.exePG3D NaziMod Installer.exePG3D NaziMod Installer.exeNovaClientFix.exeNovaClientFix.exe

pid	Process
6128	PG3D NaziMod Installer.exe
3304	NovaClientFix.exe
5500	PG3D NaziMod Installer.exe
4740	PG3D NaziMod Installer.exe
5780	PG3D NaziMod Installer.exe
5456	NovaClientFix.exe
1836	NovaClientFix.exe

Loads dropped DLL 59 IoCs

Processes:

NovaClientFix.exe

pid	Process
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\empyrean = "C:\\Users\\Admin\\AppData\\Roaming\\empyrean\\run.bat"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

Processes:

flow	ioc
58	raw.githubusercontent.com
101	discord.com
102	discord.com
103	raw.githubusercontent.com
104	raw.githubusercontent.com
57	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
99	ipapi.co
100	ipapi.co
110	ipapi.co

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x0007000000023d9a-699.dat	upx
behavioral1/memory/1836-703-0x00007FFE0D4E0000-0x00007FFE0D94E000-memory.dmp	upx
behavioral1/files/0x0003000000022efa-714.dat	upx
behavioral1/memory/1836-720-0x00007FFE299F0000-0x00007FFE29A14000-memory.dmp	upx
behavioral1/files/0x0007000000023d91-721.dat	upx
behavioral1/memory/1836-723-0x00007FFE2F0E0000-0x00007FFE2F0EF000-memory.dmp	upx
behavioral1/files/0x0003000000022ec2-722.dat	upx
behavioral1/memory/1836-725-0x00007FFE29340000-0x00007FFE29359000-memory.dmp	upx
behavioral1/files/0x0002000000022efd-726.dat	upx
behavioral1/memory/1836-734-0x00007FFE29320000-0x00007FFE29339000-memory.dmp	upx
behavioral1/files/0x0007000000023d9d-735.dat	upx
behavioral1/files/0x0008000000023c84-733.dat	upx
behavioral1/memory/1836-732-0x00007FFE25D50000-0x00007FFE25D84000-memory.dmp	upx
behavioral1/memory/1836-731-0x00007FFE291D0000-0x00007FFE291FD000-memory.dmp	upx
behavioral1/files/0x0007000000023d98-729.dat	upx
behavioral1/memory/1836-738-0x00007FFE2D290000-0x00007FFE2D29D000-memory.dmp	upx
behavioral1/files/0x00020000000230be-737.dat	upx
behavioral1/memory/1836-741-0x00007FFE299E0000-0x00007FFE299ED000-memory.dmp	upx
behavioral1/files/0x0007000000023d9c-740.dat	upx
behavioral1/files/0x0007000000023d9b-745.dat	upx
behavioral1/memory/1836-749-0x00007FFE145A0000-0x00007FFE1465C000-memory.dmp	upx
behavioral1/memory/1836-748-0x00007FFE25CF0000-0x00007FFE25D1E000-memory.dmp	upx
behavioral1/memory/1836-747-0x00007FFE0D4E0000-0x00007FFE0D94E000-memory.dmp	upx
behavioral1/files/0x0007000000023da0-751.dat	upx
behavioral1/memory/1836-753-0x00007FFE1CAF0000-0x00007FFE1CB1B000-memory.dmp	upx
behavioral1/memory/1836-752-0x00007FFE299F0000-0x00007FFE29A14000-memory.dmp	upx
behavioral1/files/0x0002000000022efb-756.dat	upx
behavioral1/memory/1836-758-0x00007FFE1C410000-0x00007FFE1C452000-memory.dmp	upx
behavioral1/files/0x0008000000023d75-759.dat	upx
behavioral1/memory/1836-762-0x00007FFE297C0000-0x00007FFE297CA000-memory.dmp	upx
behavioral1/memory/1836-761-0x00007FFE29340000-0x00007FFE29359000-memory.dmp	upx
behavioral1/files/0x0007000000023d97-763.dat	upx
behavioral1/memory/1836-764-0x00007FFE25E20000-0x00007FFE25E3C000-memory.dmp	upx
behavioral1/memory/1836-765-0x00007FFE17370000-0x00007FFE1739E000-memory.dmp	upx
behavioral1/memory/1836-766-0x00007FFE29320000-0x00007FFE29339000-memory.dmp	upx
behavioral1/memory/1836-767-0x00007FFE144E0000-0x00007FFE14598000-memory.dmp	upx
behavioral1/memory/1836-768-0x00007FFE0F9C0000-0x00007FFE0FD35000-memory.dmp	upx
behavioral1/memory/1836-771-0x00007FFE25D30000-0x00007FFE25D44000-memory.dmp	upx
behavioral1/memory/1836-770-0x00007FFE25CF0000-0x00007FFE25D1E000-memory.dmp	upx
behavioral1/memory/1836-772-0x00007FFE145A0000-0x00007FFE1465C000-memory.dmp	upx
behavioral1/memory/1836-774-0x00007FFE14A80000-0x00007FFE14AA6000-memory.dmp	upx
behavioral1/memory/1836-773-0x00007FFE291C0000-0x00007FFE291CB000-memory.dmp	upx
behavioral1/memory/1836-775-0x00007FFE1C410000-0x00007FFE1C452000-memory.dmp	upx
behavioral1/memory/1836-778-0x00007FFE13550000-0x00007FFE136C1000-memory.dmp	upx
behavioral1/memory/1836-777-0x00007FFE25CD0000-0x00007FFE25CEF000-memory.dmp	upx
behavioral1/memory/1836-776-0x00007FFE13B00000-0x00007FFE13C18000-memory.dmp	upx
behavioral1/memory/1836-780-0x00007FFE261F0000-0x00007FFE261FB000-memory.dmp	upx
behavioral1/memory/1836-789-0x00007FFE17370000-0x00007FFE1739E000-memory.dmp	upx
behavioral1/memory/1836-801-0x00007FFE1C3F0000-0x00007FFE1C3FC000-memory.dmp	upx
behavioral1/memory/1836-800-0x00007FFE1C400000-0x00007FFE1C40C000-memory.dmp	upx
behavioral1/memory/1836-799-0x00007FFE144A0000-0x00007FFE144B5000-memory.dmp	upx
behavioral1/memory/1836-798-0x00007FFE16F80000-0x00007FFE16F8C000-memory.dmp	upx
behavioral1/memory/1836-797-0x00007FFE144C0000-0x00007FFE144D2000-memory.dmp	upx
behavioral1/memory/1836-796-0x00007FFE17360000-0x00007FFE1736D000-memory.dmp	upx
behavioral1/memory/1836-795-0x00007FFE0F9C0000-0x00007FFE0FD35000-memory.dmp	upx
behavioral1/memory/1836-794-0x00007FFE1CAD0000-0x00007FFE1CADB000-memory.dmp	upx
behavioral1/memory/1836-793-0x00007FFE1CAE0000-0x00007FFE1CAEB000-memory.dmp	upx
behavioral1/memory/1836-792-0x00007FFE1EB20000-0x00007FFE1EB2C000-memory.dmp	upx
behavioral1/memory/1836-791-0x00007FFE1F460000-0x00007FFE1F46C000-memory.dmp	upx
behavioral1/memory/1836-790-0x00007FFE144E0000-0x00007FFE14598000-memory.dmp	upx
behavioral1/memory/1836-788-0x00007FFE232B0000-0x00007FFE232BE000-memory.dmp	upx
behavioral1/memory/1836-787-0x00007FFE232C0000-0x00007FFE232CD000-memory.dmp	upx
behavioral1/memory/1836-786-0x00007FFE233E0000-0x00007FFE233EC000-memory.dmp	upx
behavioral1/memory/1836-785-0x00007FFE233F0000-0x00007FFE233FB000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
behavioral1/files/0x000800000001dadb-548.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

DllHost.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 6 IoCs

Processes:

explorer.exemsedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exe

pid	Process
3944	reg.exe
5616	reg.exe

NTFS ADS 3 IoCs

Processes:

msedge.exePG3D NaziMod Installer.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 839921.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\SubDir\NovaClientFix.exe\:SmartScreen:$DATA	PG3D NaziMod Installer.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 524287.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exe

pid	Process
2476	schtasks.exe
5388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeNovaClientFix.exemsedge.exe

pid	Process
2340	msedge.exe
2340	msedge.exe
2688	msedge.exe
2688	msedge.exe
3784	identity_helper.exe
3784	identity_helper.exe
5968	msedge.exe
5968	msedge.exe
2624	msedge.exe
2624	msedge.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
1836	NovaClientFix.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

PG3D NaziMod Installer.exeNovaClientFix.exePG3D NaziMod Installer.exePG3D NaziMod Installer.exePG3D NaziMod Installer.exeNovaClientFix.exeWMIC.exeWMIC.exe

description	pid	Process
Token: SeDebugPrivilege	6128	PG3D NaziMod Installer.exe
Token: SeDebugPrivilege	3304	NovaClientFix.exe
Token: SeDebugPrivilege	5500	PG3D NaziMod Installer.exe
Token: SeDebugPrivilege	4740	PG3D NaziMod Installer.exe
Token: SeDebugPrivilege	5780	PG3D NaziMod Installer.exe
Token: SeDebugPrivilege	1836	NovaClientFix.exe
Token: SeIncreaseQuotaPrivilege	4120	WMIC.exe
Token: SeSecurityPrivilege	4120	WMIC.exe
Token: SeTakeOwnershipPrivilege	4120	WMIC.exe
Token: SeLoadDriverPrivilege	4120	WMIC.exe
Token: SeSystemProfilePrivilege	4120	WMIC.exe
Token: SeSystemtimePrivilege	4120	WMIC.exe
Token: SeProfSingleProcessPrivilege	4120	WMIC.exe
Token: SeIncBasePriorityPrivilege	4120	WMIC.exe
Token: SeCreatePagefilePrivilege	4120	WMIC.exe
Token: SeBackupPrivilege	4120	WMIC.exe
Token: SeRestorePrivilege	4120	WMIC.exe
Token: SeShutdownPrivilege	4120	WMIC.exe
Token: SeDebugPrivilege	4120	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4120	WMIC.exe
Token: SeRemoteShutdownPrivilege	4120	WMIC.exe
Token: SeUndockPrivilege	4120	WMIC.exe
Token: SeManageVolumePrivilege	4120	WMIC.exe
Token: 33	4120	WMIC.exe
Token: 34	4120	WMIC.exe
Token: 35	4120	WMIC.exe
Token: 36	4120	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4120	WMIC.exe
Token: SeSecurityPrivilege	4120	WMIC.exe
Token: SeTakeOwnershipPrivilege	4120	WMIC.exe
Token: SeLoadDriverPrivilege	4120	WMIC.exe
Token: SeSystemProfilePrivilege	4120	WMIC.exe
Token: SeSystemtimePrivilege	4120	WMIC.exe
Token: SeProfSingleProcessPrivilege	4120	WMIC.exe
Token: SeIncBasePriorityPrivilege	4120	WMIC.exe
Token: SeCreatePagefilePrivilege	4120	WMIC.exe
Token: SeBackupPrivilege	4120	WMIC.exe
Token: SeRestorePrivilege	4120	WMIC.exe
Token: SeShutdownPrivilege	4120	WMIC.exe
Token: SeDebugPrivilege	4120	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4120	WMIC.exe
Token: SeRemoteShutdownPrivilege	4120	WMIC.exe
Token: SeUndockPrivilege	4120	WMIC.exe
Token: SeManageVolumePrivilege	4120	WMIC.exe
Token: 33	4120	WMIC.exe
Token: 34	4120	WMIC.exe
Token: 35	4120	WMIC.exe
Token: 36	4120	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5912	WMIC.exe
Token: SeSecurityPrivilege	5912	WMIC.exe
Token: SeTakeOwnershipPrivilege	5912	WMIC.exe
Token: SeLoadDriverPrivilege	5912	WMIC.exe
Token: SeSystemProfilePrivilege	5912	WMIC.exe
Token: SeSystemtimePrivilege	5912	WMIC.exe
Token: SeProfSingleProcessPrivilege	5912	WMIC.exe
Token: SeIncBasePriorityPrivilege	5912	WMIC.exe
Token: SeCreatePagefilePrivilege	5912	WMIC.exe
Token: SeBackupPrivilege	5912	WMIC.exe
Token: SeRestorePrivilege	5912	WMIC.exe
Token: SeShutdownPrivilege	5912	WMIC.exe
Token: SeDebugPrivilege	5912	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5912	WMIC.exe
Token: SeRemoteShutdownPrivilege	5912	WMIC.exe
Token: SeUndockPrivilege	5912	WMIC.exe

Suspicious use of FindShellTrayWindow 46 IoCs

Processes:

msedge.exeNovaClientFix.exe

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
3304	NovaClientFix.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

Processes:

msedge.exeNovaClientFix.exe

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
3304	NovaClientFix.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 2688 wrote to memory of 2092	2688	msedge.exe	83
PID 2688 wrote to memory of 2092	2688	msedge.exe	83
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 3296	2688	msedge.exe	84
PID 2688 wrote to memory of 2340	2688	msedge.exe	85
PID 2688 wrote to memory of 2340	2688	msedge.exe	85
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86
PID 2688 wrote to memory of 1408	2688	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/yournotaloser/PG3DNAZI-MOD
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe25bf46f8,0x7ffe25bf4708,0x7ffe25bf4718
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5968
- C:\Users\Admin\Downloads\PG3D NaziMod Installer.exe
  "C:\Users\Admin\Downloads\PG3D NaziMod Installer.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:6128
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "NovaClientFix" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\NovaClientFix.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2476
- - C:\Users\Admin\AppData\Roaming\SubDir\NovaClientFix.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\NovaClientFix.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3304
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "NovaClientFix" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\NovaClientFix.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5388
- C:\Users\Admin\Downloads\PG3D NaziMod Installer.exe
  "C:\Users\Admin\Downloads\PG3D NaziMod Installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5500
- C:\Users\Admin\Downloads\PG3D NaziMod Installer.exe
  "C:\Users\Admin\Downloads\PG3D NaziMod Installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8352250994522229580,4923642938190910863,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6208 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5068

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5192

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:5252

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5612

C:\Users\Admin\Downloads\PG3D NaziMod Installer.exe
"C:\Users\Admin\Downloads\PG3D NaziMod Installer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5780

C:\Users\Admin\Downloads\NovaClientFix.exe
"C:\Users\Admin\Downloads\NovaClientFix.exe"
1⤵
- Executes dropped EXE
PID:5456
- C:\Users\Admin\Downloads\NovaClientFix.exe
  "C:\Users\Admin\Downloads\NovaClientFix.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
    3⤵
    PID:2372
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"
    3⤵
    PID:5320
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f
      4⤵
      Modifies registry key
      PID:3944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f"
    3⤵
    PID:5504
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:5616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
    3⤵
    PID:3100
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
    3⤵
    PID:5792
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
      4⤵
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
    3⤵
    PID:2644
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
      4⤵
      PID:5708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PG3D NaziMod Installer.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
20KB

MD5
4e786ef6de6d058a7ee21d714b5878f8

SHA1
a25cf3a4ef2c4208064a295fc00bf84be1557e8d

SHA256
fd7a0097dcdb4360e99e3131665aaf1cdddb65f638323d8dcd86832ac1c65b57

SHA512
79f32a2fe5204c324bcdfd5b11b3d7423cb8961e61350ef8b1a40390212bb1f2125be11aa9a8761edb2fd4c760a39c9f18394a8bd8bc55148ff2937b4ea67bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
37KB

MD5
908677684413f5278249c1b08127d6a0

SHA1
df54a142c7eb47537509a54a8519f1c6c82d0965

SHA256
49910739da15aef97cf1b1fab8a1c6817991542d296c3fe6619248258626330b

SHA512
d6458614c8cf209da33129d5672f4eee9923bb56e91692c87a0f82a0e00c0ed0c03bad913e3ebfae7dab32f76465e58289e15e579bc5f8af37845ab250301773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
38KB

MD5
084a7c45c750134bc52120929e4adfa2

SHA1
7caa207a66cb97095da77cb26bc03c05e3e3e3ef

SHA256
d897e13540624694573d596496a442f317069973a8bd8f9464b2ee91406fb990

SHA512
6aac3796f0435096a86e81ef9bdcd0186ecf74d35a38dbcd9d5c08662fe707c50d015453bf7eef1cbdbade8fca2779aded56bf3a2407a5ae97fb2a6eb1092f2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
19KB

MD5
46c65c348f90aa174bfc5f9dbacbc3a1

SHA1
f3f1cb408e89e48b14532730632dba27858d2676

SHA256
0b36587fac66193c3e84fc32c4edfecf3b9a8717aafea51178f5480239bfa008

SHA512
e18be3c74e039ff4297313b12abae8719e26eb852724a46f119121d008a7165e249bc17d17b3275a108e6de14b1bc443a7827589bc4fd46d616de699b8294ada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
de80195a713c94331966d112b1fc283d

SHA1
f9dd23a9331904fa37c40b528e1618dbf8b1a37f

SHA256
6882ec41b355d9925085ea6796f38f88b73a42fafe2a37afc8edf1a8cb9f8b59

SHA512
c1cbd43183265e3551e11f38f445d5d9ff16ad8cba9b994e09f5848732cc31858e40eae3c2fef76743224f8b15d98c5d0e2f3819a038031c40b9c25cb8e272ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
713016204975ee5d8aa6d1455c35ea34

SHA1
86034148c01b46ae6c7b34349e74a5df26a9f26b

SHA256
d7155ea97a884b55574de7c7e100b46ec3d64a017768dcc03437fee9b343180e

SHA512
1464ce252853b43a924fda14441bf157d47ac4e43ef93db548d2f896e01ca93595241c9e5bb2d737b7f657b8db55d4ee76de4d2156bfc0761d724b88897e73f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad77b1ea31819765b8ef22861af86743

SHA1
49e7f054a93b3da7f1d6b66deabc790c331d6dc2

SHA256
8eb4eccfe326a4e770c4260b653e9a79ea8ec3bd220af5f2540d0e54e87cd10f

SHA512
8a279550b7c3bd2d4c1cad7dec6c6b1805386f9706cfc754bfd68c8d064466b1c2ad369a5f2d078f55f0e36450442287be64fa8af26f6b05e48afafff8d22336

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef6cf831216e0c2ecdad53b6d5be6e7b

SHA1
a40e2b82348b1cc3b30959b9899c8689b546c76b

SHA256
a94caa3a46a7829a9d6b43d3c422210b9b62d20683ecbeb362cb1559a5850e67

SHA512
ab10a5bb0750bfe061e97f9284159b68ef3361ad5459647321df1cd78f0010215efcdafd1389c3cb339126f7caab2d3d5dc5f53e8bd55cd5fbd60c0ca13334ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
30a8160e9b1c00128ebb099cf9d45520

SHA1
bf5a4e5be509206330cd62685d74a21838a204be

SHA256
ff424a67438adb6e558a103400c43c30ec92655d87be964ce3eb59ba983e35ca

SHA512
9c034dde0078dcde5cf1a29fc14eb86cef1fc9dcbaf96b424536d0cc57865b639a5c8a0a7deb13283cb00b381ba83244d89bd2fee51a1e8e601ab11e3316d52e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a6abfccaed3e740821990fb6993fc8d3

SHA1
1d2b538e6faf0f8a75d857156bf1c28601f06692

SHA256
371b3850467005aa0070b315a493950cd7f105b467ee8c7795429f42e8c8739f

SHA512
15b99222b1c933e23ab306545c3d2fe7dab44a13656981ca39517cb123d8c7c14fec1e135035d62dbc18c4cb61b61331968ddbe721cd8fa4cc6ab53b59de9cce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db3299ad7e2bdca15541498bb99ed21b

SHA1
67524ce0d8983295016e0636ba9c45a1b3643140

SHA256
e736d2d646f124332df5a3ea7a63801e41f734897136eb245b4563d865658155

SHA512
53aad34383e29068c554caa834c31deed8ddae1650ffce5cc2384b17e2d2d025b6b3e04f1fd655e9a22f56c3923ce75acad3a287d80a716dc504bea5db62d786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f08186154148b756d97ad9d2ac785a64

SHA1
68979d475863d3bcf2f27c531353a0dbf4666be4

SHA256
4443cdc9ec7fdcf779211e12c19cf32899256c012fdcf1992219b5228d2e97d2

SHA512
c98173013709f523a76ff4950335bfb54b445a665e21bb7b81c7eb5ae1bfde0080fb8af7022de834bc8e803bbf7ac4b3f76a99c6763ce8c74c5eb983a5d79c2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aefc04793899721a0db23a282bde890c

SHA1
31dc8723a1d12a98f562e43ff5ba21b1a509c87f

SHA256
545e3b11d6e339328b1aad52084214df6d745677928038a8f4cc9b448f7f0202

SHA512
56eaa632fd1a14717dbfc6f094238cc428ba0a413f33e7819ca6300a7109a0571a94276f85e12b85b0b559f5d2593e26a3e917797bd75c4131bb14c4d68a1fec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
58a669e059769fad0d0af9383cc268c3

SHA1
ccaff26487996d9da1b327e97bd40c754277c8c3

SHA256
0fa0cb2ce4a6bfc727dc1d75ea359443d7564cd5ba75b7876c5b2a4ad976b127

SHA512
49253f51aba5318d96ff7b045b0794cdb1547f288f1ef7e08a6b9a2cfdd1d7f84275e89cd78a2da6cc9fbf454825702d484ddccfa225ec5583e090d015110665

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581e8f.TMP

Filesize
874B

MD5
e7e2b521bc60c0a17d2d024210636b4d

SHA1
f4d8d819f0ee98c56a8462acf0becbd2bbee8ff8

SHA256
047b2e04e05e09cb5194619675b552c20dcd4c4ea15f3a77daf70567293c2d6a

SHA512
e412514a460d27f78bd06d0f925cd816446723a5d256749696c1425c34328c30e79460a52aca71adc445fd121212d6976bfea17ec2d8b5824fd05ec24cf41d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8dfd804-523f-4efa-adcb-4b1f1b987a18.tmp

Filesize
579B

MD5
be85a012866f82533b134a3e7c03581c

SHA1
8f361377763dc0f643a3c2746149ca5850c5d8c0

SHA256
7c0534066657219aeecf9763515dbb8eeb5b0cc4509d25ed75d5347476f443a0

SHA512
38aa3dc3c36a5319162d52fb0bdb7588dfa9fada5247c49ee53d870b7d928ea5be1387e176e8caf3dd6cad9b6975d432eae587c0103f8dffc56f17ef887ae621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
535b1b3c47524beb6009f7f78825cdab

SHA1
928c1e446332a4bcbfdd9b849c4308c68f6014ee

SHA256
56299592fb41fcfbd3c2c26ef633eaf35376fc8ab2cbc34cad36a43fdebc58b1

SHA512
3a551da340659675628b6d685767304e971ad1f21acee217022f1d963e60d15ed56933cfe7b2e45a464e880657cc75911dca9a0a75dd9107e5215254f4f9d72b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0325b2e29bd18e70e7f791b247439837

SHA1
96653c73bf733dc9c544baee9d5435c1d19e01bb

SHA256
71e872237d7f2fd9e8ae8fde1db72870b584af82cb36ea7457b6d9aa0026cce5

SHA512
d62afc169df7704cb46b928e5825a76156efc042524b3cf33a03e9bd0b9edd2b19e2c7b03735f2b369c3cc282c5f6b916ecac42255770ac99157d7cc2c293756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8664285131f221edfcb878b37f22bcee

SHA1
17da6390ba80384f69a2d2fa607f802176d0578f

SHA256
8cf10f4edf9323b72979c5431a551e92fcfd67f240d6a20ae89a98b09b04c442

SHA512
8e229777f0a0afc47ed7d23b31cb43c7bc96fb5c9924ece30295b3ab00a463b9a492d0d8bfa887f48183f315afd954d2fa5ceff44b82092ea287e1f4b58fa181

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\VCRUNTIME140_1.dll

Filesize
48KB

MD5
bba9680bc310d8d25e97b12463196c92

SHA1
9a480c0cf9d377a4caedd4ea60e90fa79001f03a

SHA256
e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab

SHA512
1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\_bz2.pyd

Filesize
47KB

MD5
758fff1d194a7ac7a1e3d98bcf143a44

SHA1
de1c61a8e1fb90666340f8b0a34e4d8bfc56da07

SHA256
f5e913a9f2adf7d599ea9bb105e144ba11699bbcb1514e73edcf7e062354e708

SHA512
468d7c52f14812d5bde1e505c95cb630e22d71282bda05bf66324f31560bfa06095cf60fc0d34877f8b361ccd65a1b61d0fd1f91d52facb0baf8e74f3fed31cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\_ctypes.pyd

Filesize
56KB

MD5
6ca9a99c75a0b7b6a22681aa8e5ad77b

SHA1
dd1118b7d77be6bb33b81da65f6b5dc153a4b1e8

SHA256
d39390552c55d8fd4940864905cd4437bc3f8efe7ff3ca220543b2c0efab04f8

SHA512
b0b5f2979747d2f6796d415dd300848f32b4e79ede59827ac447af0f4ea8709b60d6935d09e579299b3bc54b6c0f10972f17f6c0d1759c5388ad5b14689a23fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\_decimal.pyd

Filesize
103KB

MD5
eb45ea265a48348ce0ac4124cb72df22

SHA1
ecdc1d76a205f482d1ed9c25445fa6d8f73a1422

SHA256
3881f00dbc4aadf9e87b44c316d93425a8f6ba73d72790987226238defbc7279

SHA512
f7367bf2a2d221a7508d767ad754b61b2b02cdd7ae36ae25b306f3443d4800d50404ac7e503f589450ed023ff79a2fb1de89a30a49aa1dd32746c3e041494013

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\_lzma.pyd

Filesize
84KB

MD5
abceeceaeff3798b5b0de412af610f58

SHA1
c3c94c120b5bed8bccf8104d933e96ac6e42ca90

SHA256
216aa4bb6f62dd250fd6d2dcde14709aa82e320b946a21edeec7344ed6c2c62e

SHA512
3e1a2eb86605aa851a0c5153f7be399f6259ecaad86dbcbf12eeae5f985dc2ea2ab25683285e02b787a5b75f7df70b4182ae8f1567946f99ad2ec7b27d4c7955

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\_queue.pyd

Filesize
24KB

MD5
0d267bb65918b55839a9400b0fb11aa2

SHA1
54e66a14bea8ae551ab6f8f48d81560b2add1afc

SHA256
13ee41980b7d0fb9ce07f8e41ee6a309e69a30bbf5b801942f41cbc357d59e9c

SHA512
c2375f46a98e44f54e2dd0a5cc5f016098500090bb78de520dc5e05aef8e6f11405d8f6964850a03060caed3628d0a6303091cba1f28a0aa9b3b814217d71e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\_socket.pyd

Filesize
41KB

MD5
afd296823375e106c4b1ac8b39927f8b

SHA1
b05d811e5a5921d5b5cc90b9e4763fd63783587b

SHA256
e423a7c2ce5825dfdd41cfc99c049ff92abfb2aa394c85d0a9a11de7f8673007

SHA512
95e98a24be9e603b2870b787349e2aa7734014ac088c691063e4078e11a04898c9c547d6998224b1b171fc4802039c3078a28c7e81d59f6497f2f9230d8c9369

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\_uuid.pyd

Filesize
21KB

MD5
81dfa68ca3cb20ced73316dbc78423f6

SHA1
8841cf22938aa6ee373ff770716bb9c6d9bc3e26

SHA256
d0cb6dd98a2c9d4134c6ec74e521bad734bc722d6a3b4722428bf79e7b66f190

SHA512
e24288ae627488251682cd47c1884f2dc5f4cd834d7959b9881e5739c42d91fd0a30e75f0de77f5b5a0d63d9baebcafa56851e7e40812df367fd433421c0ccdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\base_library.zip

Filesize
812KB

MD5
524a85217dc9edc8c9efc73159ca955d

SHA1
a4238cbde50443262d00a843ffe814435fb0f4e2

SHA256
808549964adb09afafb410cdc030df4813c5c2a7276a94e7f116103af5de7621

SHA512
f5a929b35a63f073bdc7600155ba2f0f262e6f60cf67efb38fa44e8b3be085cf1d5741d66d25a1ecaaf3f94abfe9bbe97d135f8a47c11f2b811d2aac6876f46c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\libffi-7.dll

Filesize
23KB

MD5
b5150b41ca910f212a1dd236832eb472

SHA1
a17809732c562524b185953ffe60dfa91ba3ce7d

SHA256
1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a

SHA512
9e82b0caa3d72bb4a7ad7d66ebfb10edb778749e89280bca67c766e72dc794e99aab2bc2980d64282a384699929ce6cc996462a73584898d2df67a57bff2a9c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\psutil\_psutil_windows.pyd

Filesize
34KB

MD5
fb17b2f2f09725c3ffca6345acd7f0a8

SHA1
b8d747cc0cb9f7646181536d9451d91d83b9fc61

SHA256
9c7d401418db14353db85b54ff8c7773ee5d17cbf9a20085fde4af652bd24fc4

SHA512
b4acb60045da8639779b6bb01175b13344c3705c92ea55f9c2942f06c89e5f43cedae8c691836d63183cacf2d0a98aa3bcb0354528f1707956b252206991bf63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\pyexpat.pyd

Filesize
86KB

MD5
5a328b011fa748939264318a433297e2

SHA1
d46dd2be7c452e5b6525e88a2d29179f4c07de65

SHA256
e8a81b47029e8500e0f4e04ccf81f8bdf23a599a2b5cd627095678cdf2fabc14

SHA512
06fa8262378634a42f5ab8c1e5f6716202544c8b304de327a08aa20c8f888114746f69b725ed3088d975d09094df7c3a37338a93983b957723aa2b7fda597f87

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\python3.DLL

Filesize
63KB

MD5
c17b7a4b853827f538576f4c3521c653

SHA1
6115047d02fbbad4ff32afb4ebd439f5d529485a

SHA256
d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

SHA512
8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\python310.dll

Filesize
1.4MB

MD5
69d4f13fbaeee9b551c2d9a4a94d4458

SHA1
69540d8dfc0ee299a7ff6585018c7db0662aa629

SHA256
801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

SHA512
8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\pythoncom310.dll

Filesize
193KB

MD5
9051abae01a41ea13febdea7d93470c0

SHA1
b06bd4cd4fd453eb827a108e137320d5dc3a002f

SHA256
f12c8141d4795719035c89ff459823ed6174564136020739c106f08a6257b399

SHA512
58d8277ec4101ad468dd8c4b4a9353ab684ecc391e5f9db37de44d5c3316c17d4c7a5ffd547ce9b9a08c56e3dd6d3c87428eae12144dfb72fc448b0f2cfc47da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\pywintypes310.dll

Filesize
62KB

MD5
6f2aa8fa02f59671f99083f9cef12cda

SHA1
9fd0716bcde6ac01cd916be28aa4297c5d4791cd

SHA256
1a15d98d4f9622fa81b60876a5f359707a88fbbbae3ae4e0c799192c378ef8c6

SHA512
f5d5112e63307068cdb1d0670fe24b65a9f4942a39416f537bdbc17dedfd99963861bf0f4e94299cdce874816f27b3d86c4bebb889c3162c666d5ee92229c211

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\select.pyd

Filesize
24KB

MD5
72009cde5945de0673a11efb521c8ccd

SHA1
bddb47ac13c6302a871a53ba303001837939f837

SHA256
5aaa15868421a46461156e7817a69eeeb10b29c1e826a9155b5f8854facf3dca

SHA512
d00a42700c9201f23a44fd9407fea7ea9df1014c976133f33ff711150727bf160941373d53f3a973f7dd6ca7b5502e178c2b88ea1815ca8bce1a239ed5d8256d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54562\win32api.pyd

Filesize
48KB

MD5
561f419a2b44158646ee13cd9af44c60

SHA1
93212788de48e0a91e603d74f071a7c8f42fe39b

SHA256
631465da2a1dad0cb11cd86b14b4a0e4c7708d5b1e8d6f40ae9e794520c3aaf7

SHA512
d76ab089f6dc1beffd5247e81d267f826706e60604a157676e6cbc3b3447f5bcee66a84bf35c21696c020362fadd814c3e0945942cdc5e0dfe44c0bca169945c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 524287.crdownload

Filesize
17.8MB

MD5
dff0efdaf25f277ecf07229acd010cdf

SHA1
cf433f40d3c6084759dbb1a6defd71ecb048dc12

SHA256
c57f57634c9377e2e1608d6e2f0c8c03ea977122cf5c0157899dc3ef93bf752e

SHA512
e264bf4cc36f4aea6284f714f323b7dd582ece58faaea3cf3a55271c8aaa7d298e6ef1d2152daf448dc654b92b9efb9ba97d1e9f418439482d473ddd116dd41b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 839921.crdownload

Filesize
3.1MB

MD5
382410639104a2d0568749ae9f308510

SHA1
a3795963deabc8436ce0831c0527447f4ca6eb9c

SHA256
d3b6c77210adb9bff865004bde5b5c0e845ab3e99559edc25383e51a07567628

SHA512
8ff72ae2cec54e235d360adf8c20e7786c81f3b45952723268f2390ccae22e755793158e185c5695bb5c85d6091ddd19bf3f1e3516b884f949cee576b59d1ba7

Download Submit
C:\Users\Admin\Downloads\downloads_db

Filesize
124KB

MD5
963cfa045b08671335690653a92cdc8b

SHA1
d42e1f8f2b997a4fb2abf9c6cb10582f9ad79cf1

SHA256
8bf117488a1ad5d0be0f3fff408f8cb25e77cdda197c4bf4e61e15e52051d651

SHA512
2fd1416e038b6b6ab3c3dee819d2cf0d401261ef4414539f74dac51d1e39b80eb8e6941f8c84ab43e4a80d2d1bb5335502f4f34746aea0f2828b3283290a9c52

Download Submit
C:\Users\Admin\Downloads\downloads_db

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\Downloads\vault\cookies.txt

Filesize
258B

MD5
e1c8e7830d06e78bf0d65bf68a2d0c82

SHA1
46e83bb1976fcdb694863adee4a4f03ae03100d5

SHA256
f5994b6af45bef3aaa358cf4c2df0f101707acbc718df3466f761c369ac7cefc

SHA512
47faa9103a74a2bdefa56957fe810c71983378c09e95b02959c1e1a1bb0e5dc99afac7e986a4fb2aeb172bdbf2b6006f8897a7cb38ce49d824fd95d000e468d2

Download Submit
C:\Users\Admin\Downloads\vault\downloads.txt

Filesize
257B

MD5
3159adfdca08cf2de983b8c4d962be72

SHA1
7d88272bfef4fff2a437a2a8cea9cb2dd72ae7b3

SHA256
72cf7e03f70b051656a7fd740137662d6d0b476d8c578e013577a61a9ed55548

SHA512
d42a6823288307023ff13ab3a0de299567464a0c589b4cb55a8664b4d8af48a3ea39e7a8c9d822141fbc51867bcfde3e0ba8015ecb3c6e5e9a05255cd2540e32

Download Submit
C:\Users\Admin\Downloads\vault\web_history.txt

Filesize
692B

MD5
9c30856d99ed7aebc031d8fe09636a8f

SHA1
60eb4249f8b63f037c95fb8bd3d2603440428ede

SHA256
49a750ba69de91cd34f608f6ee78bec0214d54a427c808878b9b82c82c671cc7

SHA512
dc0fb3d8e94d352800a8c9f7ce2eee69dce25e47dfba275b06cf7b5d11aa9290f80ef7adb90371e3338ae3124f4ebb045f525087210c27a60757f65bb20562ba

Download Submit
\??\pipe\LOCAL\crashpad_2688_WBSFQGLONXUQMKDY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1836-799-0x00007FFE144A0000-0x00007FFE144B5000-memory.dmp

Filesize
84KB

Download
memory/1836-811-0x00007FFE13A20000-0x00007FFE13A6D000-memory.dmp

Filesize
308KB

Download
memory/1836-738-0x00007FFE2D290000-0x00007FFE2D29D000-memory.dmp

Filesize
52KB

Download
memory/1836-749-0x00007FFE145A0000-0x00007FFE1465C000-memory.dmp

Filesize
752KB

Download
memory/1836-748-0x00007FFE25CF0000-0x00007FFE25D1E000-memory.dmp

Filesize
184KB

Download
memory/1836-747-0x00007FFE0D4E0000-0x00007FFE0D94E000-memory.dmp

Filesize
4.4MB

Download
memory/1836-731-0x00007FFE291D0000-0x00007FFE291FD000-memory.dmp

Filesize
180KB

Download
memory/1836-753-0x00007FFE1CAF0000-0x00007FFE1CB1B000-memory.dmp

Filesize
172KB

Download
memory/1836-752-0x00007FFE299F0000-0x00007FFE29A14000-memory.dmp

Filesize
144KB

Download
memory/1836-732-0x00007FFE25D50000-0x00007FFE25D84000-memory.dmp

Filesize
208KB

Download
memory/1836-758-0x00007FFE1C410000-0x00007FFE1C452000-memory.dmp

Filesize
264KB

Download
memory/1836-734-0x00007FFE29320000-0x00007FFE29339000-memory.dmp

Filesize
100KB

Download
memory/1836-762-0x00007FFE297C0000-0x00007FFE297CA000-memory.dmp

Filesize
40KB

Download
memory/1836-761-0x00007FFE29340000-0x00007FFE29359000-memory.dmp

Filesize
100KB

Download
memory/1836-725-0x00007FFE29340000-0x00007FFE29359000-memory.dmp

Filesize
100KB

Download
memory/1836-764-0x00007FFE25E20000-0x00007FFE25E3C000-memory.dmp

Filesize
112KB

Download
memory/1836-765-0x00007FFE17370000-0x00007FFE1739E000-memory.dmp

Filesize
184KB

Download
memory/1836-766-0x00007FFE29320000-0x00007FFE29339000-memory.dmp

Filesize
100KB

Download
memory/1836-767-0x00007FFE144E0000-0x00007FFE14598000-memory.dmp

Filesize
736KB

Download
memory/1836-769-0x00000288A08A0000-0x00000288A0C15000-memory.dmp

Filesize
3.5MB

Download
memory/1836-768-0x00007FFE0F9C0000-0x00007FFE0FD35000-memory.dmp

Filesize
3.5MB

Download
memory/1836-771-0x00007FFE25D30000-0x00007FFE25D44000-memory.dmp

Filesize
80KB

Download
memory/1836-770-0x00007FFE25CF0000-0x00007FFE25D1E000-memory.dmp

Filesize
184KB

Download
memory/1836-772-0x00007FFE145A0000-0x00007FFE1465C000-memory.dmp

Filesize
752KB

Download
memory/1836-774-0x00007FFE14A80000-0x00007FFE14AA6000-memory.dmp

Filesize
152KB

Download
memory/1836-773-0x00007FFE291C0000-0x00007FFE291CB000-memory.dmp

Filesize
44KB

Download
memory/1836-775-0x00007FFE1C410000-0x00007FFE1C452000-memory.dmp

Filesize
264KB

Download
memory/1836-778-0x00007FFE13550000-0x00007FFE136C1000-memory.dmp

Filesize
1.4MB

Download
memory/1836-777-0x00007FFE25CD0000-0x00007FFE25CEF000-memory.dmp

Filesize
124KB

Download
memory/1836-776-0x00007FFE13B00000-0x00007FFE13C18000-memory.dmp

Filesize
1.1MB

Download
memory/1836-780-0x00007FFE261F0000-0x00007FFE261FB000-memory.dmp

Filesize
44KB

Download
memory/1836-789-0x00007FFE17370000-0x00007FFE1739E000-memory.dmp

Filesize
184KB

Download
memory/1836-801-0x00007FFE1C3F0000-0x00007FFE1C3FC000-memory.dmp

Filesize
48KB

Download
memory/1836-800-0x00007FFE1C400000-0x00007FFE1C40C000-memory.dmp

Filesize
48KB

Download
memory/1836-723-0x00007FFE2F0E0000-0x00007FFE2F0EF000-memory.dmp

Filesize
60KB

Download
memory/1836-798-0x00007FFE16F80000-0x00007FFE16F8C000-memory.dmp

Filesize
48KB

Download
memory/1836-797-0x00007FFE144C0000-0x00007FFE144D2000-memory.dmp

Filesize
72KB

Download
memory/1836-796-0x00007FFE17360000-0x00007FFE1736D000-memory.dmp

Filesize
52KB

Download
memory/1836-795-0x00007FFE0F9C0000-0x00007FFE0FD35000-memory.dmp

Filesize
3.5MB

Download
memory/1836-794-0x00007FFE1CAD0000-0x00007FFE1CADB000-memory.dmp

Filesize
44KB

Download
memory/1836-793-0x00007FFE1CAE0000-0x00007FFE1CAEB000-memory.dmp

Filesize
44KB

Download
memory/1836-792-0x00007FFE1EB20000-0x00007FFE1EB2C000-memory.dmp

Filesize
48KB

Download
memory/1836-791-0x00007FFE1F460000-0x00007FFE1F46C000-memory.dmp

Filesize
48KB

Download
memory/1836-790-0x00007FFE144E0000-0x00007FFE14598000-memory.dmp

Filesize
736KB

Download
memory/1836-788-0x00007FFE232B0000-0x00007FFE232BE000-memory.dmp

Filesize
56KB

Download
memory/1836-787-0x00007FFE232C0000-0x00007FFE232CD000-memory.dmp

Filesize
52KB

Download
memory/1836-786-0x00007FFE233E0000-0x00007FFE233EC000-memory.dmp

Filesize
48KB

Download
memory/1836-785-0x00007FFE233F0000-0x00007FFE233FB000-memory.dmp

Filesize
44KB

Download
memory/1836-784-0x00007FFE25190000-0x00007FFE2519C000-memory.dmp

Filesize
48KB

Download
memory/1836-783-0x00007FFE25530000-0x00007FFE2553B000-memory.dmp

Filesize
44KB

Download
memory/1836-782-0x00007FFE25AA0000-0x00007FFE25AAC000-memory.dmp

Filesize
48KB

Download
memory/1836-781-0x00007FFE25AB0000-0x00007FFE25ABB000-memory.dmp

Filesize
44KB

Download
memory/1836-779-0x00007FFE25E20000-0x00007FFE25E3C000-memory.dmp

Filesize
112KB

Download
memory/1836-805-0x00007FFE13AE0000-0x00007FFE13AF7000-memory.dmp

Filesize
92KB

Download
memory/1836-804-0x00007FFE14480000-0x00007FFE14494000-memory.dmp

Filesize
80KB

Download
memory/1836-803-0x00007FFE14A70000-0x00007FFE14A80000-memory.dmp

Filesize
64KB

Download
memory/1836-802-0x00000288A08A0000-0x00000288A0C15000-memory.dmp

Filesize
3.5MB

Download
memory/1836-813-0x00007FFE139E0000-0x00007FFE139FE000-memory.dmp

Filesize
120KB

Download
memory/1836-812-0x00007FFE13A00000-0x00007FFE13A11000-memory.dmp

Filesize
68KB

Download
memory/1836-741-0x00007FFE299E0000-0x00007FFE299ED000-memory.dmp

Filesize
52KB

Download
memory/1836-810-0x00007FFE13A70000-0x00007FFE13A89000-memory.dmp

Filesize
100KB

Download
memory/1836-809-0x00007FFE13A90000-0x00007FFE13AA7000-memory.dmp

Filesize
92KB

Download
memory/1836-808-0x00007FFE13AB0000-0x00007FFE13AD2000-memory.dmp

Filesize
136KB

Download
memory/1836-807-0x00007FFE13550000-0x00007FFE136C1000-memory.dmp

Filesize
1.4MB

Download
memory/1836-806-0x00007FFE14A80000-0x00007FFE14AA6000-memory.dmp

Filesize
152KB

Download
memory/1836-815-0x00007FFE13720000-0x00007FFE13749000-memory.dmp

Filesize
164KB

Download
memory/1836-814-0x00007FFE25CD0000-0x00007FFE25CEF000-memory.dmp

Filesize
124KB

Download
memory/1836-818-0x00007FFE0B890000-0x00007FFE0BAE2000-memory.dmp

Filesize
2.3MB

Download
memory/1836-720-0x00007FFE299F0000-0x00007FFE29A14000-memory.dmp

Filesize
144KB

Download
memory/1836-703-0x00007FFE0D4E0000-0x00007FFE0D94E000-memory.dmp

Filesize
4.4MB

Download
memory/1836-949-0x00007FFE1F460000-0x00007FFE1F46C000-memory.dmp

Filesize
48KB

Download
memory/1836-950-0x00007FFE1C3F0000-0x00007FFE1C3FC000-memory.dmp

Filesize
48KB

Download
memory/1836-951-0x00007FFE1EB20000-0x00007FFE1EB2C000-memory.dmp

Filesize
48KB

Download
memory/1836-880-0x00007FFE144A0000-0x00007FFE144B5000-memory.dmp

Filesize
84KB

Download
memory/1836-881-0x00007FFE13AE0000-0x00007FFE13AF7000-memory.dmp

Filesize
92KB

Download
memory/1836-883-0x00007FFE299F0000-0x00007FFE29A14000-memory.dmp

Filesize
144KB

Download
memory/1836-907-0x00007FFE13AB0000-0x00007FFE13AD2000-memory.dmp

Filesize
136KB

Download
memory/1836-905-0x00007FFE13550000-0x00007FFE136C1000-memory.dmp

Filesize
1.4MB

Download
memory/1836-904-0x00007FFE25CD0000-0x00007FFE25CEF000-memory.dmp

Filesize
124KB

Download
memory/1836-897-0x00007FFE17370000-0x00007FFE1739E000-memory.dmp

Filesize
184KB

Download
memory/1836-891-0x00007FFE25CF0000-0x00007FFE25D1E000-memory.dmp

Filesize
184KB

Download
memory/1836-888-0x00007FFE29320000-0x00007FFE29339000-memory.dmp

Filesize
100KB

Download
memory/1836-882-0x00007FFE0D4E0000-0x00007FFE0D94E000-memory.dmp

Filesize
4.4MB

Download
memory/1836-899-0x00007FFE0F9C0000-0x00007FFE0FD35000-memory.dmp

Filesize
3.5MB

Download
memory/1836-898-0x00007FFE144E0000-0x00007FFE14598000-memory.dmp

Filesize
736KB

Download
memory/1836-892-0x00007FFE145A0000-0x00007FFE1465C000-memory.dmp

Filesize
752KB

Download
memory/1836-920-0x00007FFE145A0000-0x00007FFE1465C000-memory.dmp

Filesize
752KB

Download
memory/1836-944-0x00007FFE25CF0000-0x00007FFE25D1E000-memory.dmp

Filesize
184KB

Download
memory/1836-948-0x00007FFE14480000-0x00007FFE14494000-memory.dmp

Filesize
80KB

Download
memory/1836-947-0x00007FFE1C400000-0x00007FFE1C40C000-memory.dmp

Filesize
48KB

Download
memory/1836-946-0x00007FFE1CAF0000-0x00007FFE1CB1B000-memory.dmp

Filesize
172KB

Download
memory/1836-945-0x00007FFE0D4E0000-0x00007FFE0D94E000-memory.dmp

Filesize
4.4MB

Download
memory/1836-943-0x00007FFE299E0000-0x00007FFE299ED000-memory.dmp

Filesize
52KB

Download
memory/1836-942-0x00007FFE2D290000-0x00007FFE2D29D000-memory.dmp

Filesize
52KB

Download
memory/1836-941-0x00007FFE14A80000-0x00007FFE14AA6000-memory.dmp

Filesize
152KB

Download
memory/1836-940-0x00007FFE25D50000-0x00007FFE25D84000-memory.dmp

Filesize
208KB

Download
memory/1836-939-0x00007FFE291D0000-0x00007FFE291FD000-memory.dmp

Filesize
180KB

Download
memory/1836-938-0x00007FFE29340000-0x00007FFE29359000-memory.dmp

Filesize
100KB

Download
memory/1836-937-0x00007FFE2F0E0000-0x00007FFE2F0EF000-memory.dmp

Filesize
60KB

Download
memory/1836-936-0x00007FFE299F0000-0x00007FFE29A14000-memory.dmp

Filesize
144KB

Download
memory/1836-935-0x00007FFE29320000-0x00007FFE29339000-memory.dmp

Filesize
100KB

Download
memory/1836-934-0x00007FFE261F0000-0x00007FFE261FB000-memory.dmp

Filesize
44KB

Download
memory/1836-933-0x00007FFE13550000-0x00007FFE136C1000-memory.dmp

Filesize
1.4MB

Download
memory/1836-932-0x00007FFE25CD0000-0x00007FFE25CEF000-memory.dmp

Filesize
124KB

Download
memory/1836-931-0x00007FFE13B00000-0x00007FFE13C18000-memory.dmp

Filesize
1.1MB

Download
memory/1836-929-0x00007FFE291C0000-0x00007FFE291CB000-memory.dmp

Filesize
44KB

Download
memory/1836-928-0x00007FFE25D30000-0x00007FFE25D44000-memory.dmp

Filesize
80KB

Download
memory/1836-927-0x00007FFE0F9C0000-0x00007FFE0FD35000-memory.dmp

Filesize
3.5MB

Download
memory/1836-926-0x00007FFE144E0000-0x00007FFE14598000-memory.dmp

Filesize
736KB

Download
memory/1836-925-0x00007FFE17370000-0x00007FFE1739E000-memory.dmp

Filesize
184KB

Download
memory/1836-924-0x00007FFE25E20000-0x00007FFE25E3C000-memory.dmp

Filesize
112KB

Download
memory/1836-923-0x00007FFE297C0000-0x00007FFE297CA000-memory.dmp

Filesize
40KB

Download
memory/1836-922-0x00007FFE1C410000-0x00007FFE1C452000-memory.dmp

Filesize
264KB

Download
memory/1836-954-0x00007FFE25190000-0x00007FFE2519C000-memory.dmp

Filesize
48KB

Download
memory/1836-953-0x00007FFE25530000-0x00007FFE2553B000-memory.dmp

Filesize
44KB

Download
memory/1836-952-0x00007FFE25AA0000-0x00007FFE25AAC000-memory.dmp

Filesize
48KB

Download
memory/3304-255-0x000000001C030000-0x000000001C080000-memory.dmp

Filesize
320KB

Download
memory/3304-256-0x000000001C140000-0x000000001C1F2000-memory.dmp

Filesize
712KB

Download
memory/6128-247-0x0000000000570000-0x0000000000894000-memory.dmp

Filesize
3.1MB

Download