Malware Analysis Report

2025-05-05 21:24

Sample ID 240521-1g8pjabc57
Target https://cdn.discordapp.com/attachments/1232837563535065098/1242590901142945933/Logged_v1.6.0.exe?ex=664e6475&is=664d12f5&hm=6599e1c43aa014e0665117b2255c9eb2fb9c13e986f6877fe7fdd47f4b16a6a4&
Tags
discovery evasion pyinstaller
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

Threat Level: Likely malicious

The file https://cdn.discordapp.com/attachments/1232837563535065098/1242590901142945933/Logged_v1.6.0.exe?ex=664e6475&is=664d12f5&hm=6599e1c43aa014e0665117b2255c9eb2fb9c13e986f6877fe7fdd47f4b16a6a4& was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion pyinstaller

Downloads MZ/PE file

Loads dropped DLL

Checks CPU information

Checks memory information

Executes dropped EXE

Detects Pyinstaller

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

NTFS ADS

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-21 21:38

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-21 21:38

Reported

2024-05-21 21:42

Platform

android-x64-arm64-20240514-en

Max time kernel

172s

Max time network

132s

Command Line

com.android.chrome

Signatures

Downloads MZ/PE file

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Processes

com.android.chrome

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.46:443 tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
GB 216.58.204.78:443 android.apis.google.com tcp
US 1.1.1.1:53 cdn.discordapp.com udp
US 1.1.1.1:53 accounts.google.com udp
BE 142.251.168.84:443 accounts.google.com tcp
US 1.1.1.1:53 accounts.google.com udp
US 1.1.1.1:53 cdn.discordapp.com udp
BE 64.233.167.84:443 accounts.google.com tcp
US 162.159.130.233:443 cdn.discordapp.com tcp
US 1.1.1.1:53 a.nel.cloudflare.com udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 safebrowsing.googleapis.com udp
US 1.1.1.1:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 142.250.200.3:443 update.googleapis.com tcp
US 1.1.1.1:53 nyqjteeagccvh udp
US 1.1.1.1:53 vznkscdhlusjw udp
US 1.1.1.1:53 oqouhphtlswdg udp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 172.217.16.227:443 update.googleapis.com tcp

Files

/storage/emulated/0/Download/.pending-1716932354-Logged_v1.6.0.exe (deleted)

MD5 c7485cef3f7d1556c588b731bccbd647
SHA1 c14bb283a824f93ffa3b86e94fc2749bb5f49a14
SHA256 1ecf5a9e9159e951ca0dd05f84c6dcbcb0a255521ce727e22fdacf46acc2fab2
SHA512 eb68844476d3ebcf42dd6d67b5397fec679a9697848152871422e5fb90b4d058d6634cb4b61968f6d356bce17b204f495933a485cbb312d81af4ba21b9b58089

/storage/emulated/0/Download/.pending-1716932354-Logged_v1.6.0.exe

MD5 e17d47876d6c3f7313a8c7a830733d18
SHA1 b4df682a47947328421af8f64bed1367d44b28e3
SHA256 1e835806ad4af3c933a0acfe497bc84fa15c95cbfc78681a5a4a71495c0b6d39
SHA512 2d4bfdda309752bf6e65f34a2f38345ed83c0ee70d8587d58e059d9adbd8f56030928a8c75a88f4df16cf0c855062c650d975bd97db89ab7dcdc6797d7e08070

files/dom-0.html

MD5 cecb649cb1fb79c3736936fcbef3bbf2
SHA1 2c95183d7d2b0cd68d15b3c4115189351fc08720
SHA256 09bda72e7c32a69e3268e0ebd8caa33684cbc954dd00c7d93a38830e348ef324
SHA512 b8aca3cf0ea838093bd29b70ead608597260b0e35886d491d17c304878f99510fd885d96a191080acb5b706a642253bd9cbe5065ff234472b048fcce282061de

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-21 21:38

Reported

2024-05-21 21:56

Platform

win11-20240419-en

Max time kernel

960s

Max time network

967s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1232837563535065098/1242590901142945933/Logged_v1.6.0.exe?ex=664e6475&is=664d12f5&hm=6599e1c43aa014e0665117b2255c9eb2fb9c13e986f6877fe7fdd47f4b16a6a4&

Signatures

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A
N/A N/A C:\Users\Admin\Downloads\Logged_v1.6.0.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 887641.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Users\Admin\Downloads\Logged_v1.6.0.exe:Zone.Identifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4908 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4908 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1232837563535065098/1242590901142945933/Logged_v1.6.0.exe?ex=664e6475&is=664d12f5&hm=6599e1c43aa014e0665117b2255c9eb2fb9c13e986f6877fe7fdd47f4b16a6a4&

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe6bc53cb8,0x7ffe6bc53cc8,0x7ffe6bc53cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4408 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6160 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8

C:\Users\Admin\Downloads\Logged_v1.6.0.exe

"C:\Users\Admin\Downloads\Logged_v1.6.0.exe"

C:\Users\Admin\Downloads\Logged_v1.6.0.exe

"C:\Users\Admin\Downloads\Logged_v1.6.0.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Users\Admin\Downloads\Logged_v1.6.0.exe

"C:\Users\Admin\Downloads\Logged_v1.6.0.exe"

C:\Users\Admin\Downloads\Logged_v1.6.0.exe

"C:\Users\Admin\Downloads\Logged_v1.6.0.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,7788066945247130841,15168824851475329829,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3612 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d0f84c55517d34a91f12cccf1d3af583
SHA1 52bd01e6ab1037d31106f8bf6e2552617c201cea
SHA256 9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c
SHA512 94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171

\??\pipe\LOCAL\crashpad_4908_CRXXAQOHESNCBRIG

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ade01a8cdbbf61f66497f88012a684d1
SHA1 9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f
SHA256 f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5
SHA512 fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c2207c9d3bcb3e0a2327142d5a666bf3
SHA1 7a88d666725247b76f24cb630984c30d06bbf277
SHA256 8082bb5e6ef9d0c8c968ea35a59f9eeb20b2a243df403dd8d77438405ce2d4fd
SHA512 868d72206f40902814525208ef827ec678bfcb6e0c2ad3dcb17efd888519e68e851af4641cf3c9e8f2806bf5511e9b095cc137f1ca94677b0ce40af6f9b603fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 120c60a50ab74f4756e7df404a96b98e
SHA1 d36671aabb56dfcf5d811ab4293249dacced2633
SHA256 a56ce2ed25340caf665691f605261a5e45c5f9c53d906339a9247e0e08c05c77
SHA512 7118d15f7263be9d7b4c889690e0f1cae60e288fcd782e5f70adfcc3d5a04aba9f7bc3bc1c182dc86839958f50762a51070700dedd992596c40cc937ab8f8624

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1c94749e4101837e2fa29087cb63878b
SHA1 03b2f6b7d0ee0a7d6d6def099b308aaaad4c8eac
SHA256 6d967c16cc68eecb3511db7e0dacb59ad858ef0c09fcafcbf0c073e544db4387
SHA512 4a7de2a62b5322cb064e174081106e6c26e82aa41eae5eeff756476e2a001b224e538c77324abe2f479d5edf98b8184f330d7266e925f68e5a4f636c63b345da

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4aeb36db8040c54b7c220c7cd136b867
SHA1 63034d8b32219c2929ae4b4cb8207a9718725e86
SHA256 58804df329a3aa0704fb04d4bdb34eb62e5364d8bc1a865895a63f6373f0f72c
SHA512 1e9d41d31ea31611cf87a07f180ee656bb29ad5ed73816b3e760f53d6d92972e9b5fb6a48487713728c26a831e9666aa94e03ac7c283a29c3fcc7cd2ffbd5cfc

C:\Users\Admin\AppData\Local\Temp\_MEI14482\python311.dll

MD5 e2bd5ae53427f193b42d64b8e9bf1943
SHA1 7c317aad8e2b24c08d3b8b3fba16dd537411727f
SHA256 c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400
SHA512 ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036

C:\Users\Admin\AppData\Local\Temp\_MEI14482\VCRUNTIME140.dll

MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

C:\Users\Admin\AppData\Local\Temp\_MEI14482\base_library.zip

MD5 df673df8c5f4b100f5588b8cf1834b68
SHA1 dc82a6a581fc4ad98ef94046753a107f3079e2a8
SHA256 61f8ceeb90d4321ea6b9593627ee414acac0de654327e703c679aebc8c520c6f
SHA512 6836c4bc80a15b89401006d1b061a7ce7c1431b742dcc903bcf027713bf8886189f88e8937dd13bd2c5e21671063adb09939d1c1fcf2db755d8935abd846dc3e

C:\Users\Admin\AppData\Local\Temp\_MEI14482\_ctypes.pyd

MD5 9b344f8d7ce5b57e397a475847cc5f66
SHA1 aff1ccc2608da022ecc8d0aba65d304fe74cdf71
SHA256 b1214d7b7efd9d4b0f465ec3463512a1cbc5f59686267030f072e6ce4b2a95cf
SHA512 2b0d9e1b550bf108fa842324ab26555f2a224aefff517fdb16df85693e05adaf0d77ebe49382848f1ec68dc9b5ae75027a62c33721e42a1566274d1a2b1baa41

C:\Users\Admin\AppData\Local\Temp\_MEI14482\python3.DLL

MD5 7442c154565f1956d409092ede9cc310
SHA1 c72f9c99ea56c8fb269b4d6b3507b67e80269c2d
SHA256 95086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b
SHA512 2bf96828534bcdf71e48d1948b989011d8e3ba757c38cc17905a13d3021ea5deb57e2c68d79507a6acbb62be009cfc85b24d14543958dba1d3bc3e4ca7d4f844

C:\Users\Admin\AppData\Local\Temp\_MEI14482\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\_MEI14482\_bz2.pyd

MD5 a62207fc33140de460444e191ae19b74
SHA1 9327d3d4f9d56f1846781bcb0a05719dea462d74
SHA256 ebcac51449f323ae3ae961a33843029c34b6a82138ccd9214cf99f98dd2148c2
SHA512 90f9db9ee225958cb3e872b79f2c70cb1fd2248ebaa8f3282afff9250285852156bf668f5cfec49a4591b416ce7ebaaac62d2d887152f5356512f2347e3762b7

C:\Users\Admin\AppData\Local\Temp\_MEI14482\_lzma.pyd

MD5 0c7ea68ca88c07ae6b0a725497067891
SHA1 c2b61a3e230b30416bc283d1f3ea25678670eb74
SHA256 f74aaf0aa08cf90eb1eb23a474ccb7cb706b1ede7f911daf7ae68480765bdf11
SHA512 fd52f20496a12e6b20279646663d880b1354cffea10793506fe4560ed7da53e4efba900ae65c9996fbb3179c83844a9674051385e6e3c26fb2622917351846b9

C:\Users\Admin\AppData\Local\Temp\_MEI14482\_socket.pyd

MD5 26dd19a1f5285712068b9e41808e8fa0
SHA1 90c9a112dd34d45256b4f2ed38c1cbbc9f24dba5
SHA256 eaabf6b78840daeaf96b5bdbf06adf0e4e2994dfeee5c5e27fefd824dbda5220
SHA512 173e1eda05d297d7da2193e8566201f05428437adcac80aecefe80f82d46295b15ce10990b5c080325dc59a432a587eef84a15ec688a62b82493ad501a1e4520

C:\Users\Admin\AppData\Local\Temp\_MEI14482\select.pyd

MD5 756c95d4d9b7820b00a3099faf3f4f51
SHA1 893954a45c75fb45fe8048a804990ca33f7c072d
SHA256 13e4d9a734a453a3613e11b6a518430099ad7e3d874ea407d1f9625b7f60268a
SHA512 0f54f0262cf8d71f00bf5666eb15541c6ecc5246cd298efd3b7dd39cdd29553a8242d204c42cfb28c537c3d61580153200373c34a94769f102b3baa288f6c398

C:\Users\Admin\AppData\Local\Temp\_MEI14482\pyexpat.pyd

MD5 48e6930e3095f5a2dcf9baa67098acfb
SHA1 ddcd143f386e74e9820a3f838058c4caa7123a65
SHA256 c1ed7017ce55119df27563d470e7dc3fb29234a7f3cd5fc82d317b6fe559300b
SHA512 b50f42f6c7ddbd64bf0ff37f40b8036d253a235fb67693a7f1ed096f5c3b94c2bde67d0db63d84a8c710505a891b43f913e1b1044c42b0f5f333d0fe0386a62c

C:\Users\Admin\AppData\Local\Temp\_MEI14482\_queue.pyd

MD5 06248702a6cd9d2dd20c0b1c6b02174d
SHA1 3f14d8af944fe0d35d17701033ff1501049e856f
SHA256 ac177cd84c12e03e3a68bca30290bc0b8f173eee518ef1fa6a9dce3a3e755a93
SHA512 5b22bbff56a8b48655332ebd77387d307f5c0a526626f3654267a34bc4863d8afaf08ff3946606f3cf00b660530389c37bdfac91843808dbebc7373040fec4c1

C:\Users\Admin\AppData\Local\Temp\_MEI14482\_ssl.pyd

MD5 ab0e4fbffb6977d0196c7d50bc76cf2d
SHA1 680e581c27d67cd1545c810dbb175c2a2a4ef714
SHA256 680ad2de8a6cff927822c1d7dd22112a3e8a824e82a7958ee409a7b9ce45ec70
SHA512 2bff84a8ec7a26dde8d1bb09792ead8636009c8ef3fa68300a75420197cd7b6c8eaaf8db6a5f97442723e5228afa62961f002948e0eeee8c957c6517547dffba

C:\Users\Admin\AppData\Local\Temp\_MEI14482\libcrypto-1_1.dll

MD5 9d7a0c99256c50afd5b0560ba2548930
SHA1 76bd9f13597a46f5283aa35c30b53c21976d0824
SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
SHA512 cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

C:\Users\Admin\AppData\Local\Temp\_MEI14482\libssl-1_1.dll

MD5 bec0f86f9da765e2a02c9237259a7898
SHA1 3caa604c3fff88e71f489977e4293a488fb5671c
SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
SHA512 ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4

C:\Users\Admin\AppData\Local\Temp\_MEI14482\_asyncio.pyd

MD5 61a5ae75f514b3ccbf1b939e06a5d451
SHA1 8154795e0f14415fb5802da65aafa91d7cbc57ec
SHA256 2b772076c2dba91fb4f61182b929485cc6c660baab4bce6e08aa18e414c69641
SHA512 bcd077d5d23fdab8427cc077b26626644b1b4b793c7f445e4f85094bd596c28319a854623b6e385f8e479b52726a9b843c4376bf288dc4f09edc30f332dbaf13

C:\Users\Admin\AppData\Local\Temp\_MEI14482\_overlapped.pyd

MD5 7db2b9d0fd06f7bd7e32b52bd626f1ce
SHA1 6756c6adf03d4887f8be371954ef9179b2df78cd
SHA256 24f9971debbd864e3ba615a89d2c5b0e818f9ab2be4081499bc877761992c814
SHA512 5b3f55c89056c0bf816c480ed7f8aad943a5ca07bd9b9948f0aa7163664d462c3c46d233ee11dd101ce46dc8a53b29e8341e227fe462e81d29e257a6897a5f3d

C:\Users\Admin\AppData\Local\Temp\_MEI14482\multidict\_multidict.cp311-win_amd64.pyd

MD5 b92f8efb672c383ab60b971b3c6c87de
SHA1 acb671089a01d7f1db235719c52e6265da0f708f
SHA256 b7376b5d729115a06b1cab60b251df3efc3051ebba31524ea82f0b8db5a49a72
SHA512 680663d6c6cd7b9d63160c282f6d38724bd8b8144d15f430b28b417dda0222bfff7afefcb671e863d1b4002b154804b1c8af2d8a28fff11fa94972b207df081b

C:\Users\Admin\AppData\Local\Temp\_MEI14482\_hashlib.pyd

MD5 787b82d4466f393366657b8f1bc5f1a9
SHA1 658639cddda55ac3bfc452db4ec9cf88851e606b
SHA256 241322647ba9f94bdc3ae387413ffb57ae14c8cf88bd564a31fe193c6ca43e37
SHA512 afcf66962958f38eec8b591aa30d380eb0e1b41028836058ff91b4d1472658de9fba3262f5c27ba688bd73da018e938f398e45911cd37584f623073067f575b6

C:\Users\Admin\AppData\Local\Temp\_MEI14482\unicodedata.pyd

MD5 58f7988b50cba7b793884f580c7083e1
SHA1 d52c06b19861f074e41d8b521938dee8b56c1f2e
SHA256 e36d14cf49ca2af44fae8f278e883341167bc380099dac803276a11e57c9cfa1
SHA512 397fa46b90582f8a8cd7df23b722204c38544717bf546837c45e138b39112f33a1850be790e248fca5b5ecd9ed7c91cd1af1864f72717d9805c486db0505fb9c

C:\Users\Admin\AppData\Local\Temp\_MEI14482\yarl\_quoting_c.cp311-win_amd64.pyd

MD5 0edc0f96b64523314788745fa2cc7ddd
SHA1 555a0423ce66c8b0fa5eea45caac08b317d27d68
SHA256 db5b421e09bf2985fbe4ef5cdf39fc16e2ff0bf88534e8ba86c6b8093da6413f
SHA512 bb0074169e1bd05691e1e39c2e3c8c5fae3a68c04d851c70028452012bb9cb8d19e49cdff34efb72e962ed0a03d418dfbad34b7c9ad032105cf5acd311c1f713

C:\Users\Admin\AppData\Local\Temp\_MEI14482\aiohttp\_helpers.cp311-win_amd64.pyd

MD5 4b5dcc46170e4ac810a59ca5b7533462
SHA1 1eacf60fdfd427909b54f83518612a4638930225
SHA256 704cdcfca773ac658b8f84335f29630707c216f739f7fa5970b1be57f13a5b82
SHA512 c2e5b9b40f267f375234be9a562882faa1a0e82f32a951233464d27879d0b1620099bb800de3e96be277bb3bb44ff421a98a2f0c125f28652c2b6415d0fb4dea

C:\Users\Admin\AppData\Local\Temp\_MEI14482\aiohttp\_http_writer.cp311-win_amd64.pyd

MD5 2f2a2b2343549e990419df0977e3fac9
SHA1 5724b63e32bda7d36285f79dc9ad57fc97ba5415
SHA256 9569b0b501a0235388d075baa4c84e5d571169ac6ce3ae9220cde31a5f208b94
SHA512 a1b99dcaf01666c3ab9755d55001f3a18344cd70c386ce1b2233b5c6b8248b59d95804b450f9ee9c2f51d6293c4e748b9347540ae3f247418a1673bbd6ef466a

C:\Users\Admin\AppData\Local\Temp\_MEI14482\_brotli.cp311-win_amd64.pyd

MD5 0606e7d1af5d7420ea2f363a9b22e647
SHA1 949e2661c8abf1f108e49ddc431892af5c4eb5ae
SHA256 79e60cd8bfd29ad1f7d0bf7a1eec3d9abadfce90587438ea172034074bc174ee
SHA512 0fbb16af2523f374c6057e2cb2397cd7ff7eee7e224372fd56a5feada58b0cebb992a9889865d3b971f960ca5f3bc37ff3017474b79ccc9b74aa4d341b7e06fc

C:\Users\Admin\AppData\Local\Temp\_MEI54082\setuptools-65.5.0.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b1b6f31-801e-42aa-a6e3-d7daca7e6da3.tmp

MD5 094ab275342c45551894b7940ae9ad0d
SHA1 2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e
SHA256 ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3
SHA512 19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d