Malware Analysis Report

2025-03-15 03:46

Sample ID 241117-x94z9s1qan
Target https://jmthedesigner.com/storage/z9f4l6n2x0vI/
Tags
exelastealer collection defense_evasion discovery evasion persistence phishing privilege_escalation pyinstaller stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://jmthedesigner.com/storage/z9f4l6n2x0vI/ was found to be: Known bad.

Malicious Activity Summary

exelastealer collection defense_evasion discovery evasion persistence phishing privilege_escalation pyinstaller stealer upx

Exelastealer family

Exela Stealer

Grants admin privileges

Modifies Windows Firewall

Downloads MZ/PE file

A potential corporate email address has been identified in the URL: [email protected]

A potential corporate email address has been identified in the URL: [email protected]

A potential corporate email address has been identified in the URL: [email protected]

Executes dropped EXE

A potential corporate email address has been identified in the URL: vue@3

Loads dropped DLL

Clipboard Data

Legitimate hosting services abused for malware hosting/C2

Network Service Discovery

Looks up external IP address via web service

Hide Artifacts: Hidden Files and Directories

UPX packed file

Enumerates processes with tasklist

Launches sc.exe

Permission Groups Discovery: Local Groups

System Network Connections Discovery

Event Triggered Execution: Netsh Helper DLL

Browser Information Discovery

Enumerates physical storage devices

System Network Configuration Discovery: Wi-Fi Discovery

Detects Pyinstaller

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Kills process with taskkill

NTFS ADS

Views/modifies file attributes

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Gathers network information

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Detects videocard installed

Runs net.exe

Collects information from the system

Gathers system information

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-17 19:34

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-17 19:34

Reported

2024-11-17 19:52

Platform

win10v2004-20241007-en

Max time kernel

997s

Max time network

1051s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://jmthedesigner.com/storage/z9f4l6n2x0vI/

Signatures

Exela Stealer

stealer exelastealer

Exelastealer family

exelastealer

Grants admin privileges

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

A potential corporate email address has been identified in the URL: [email protected]

phishing

A potential corporate email address has been identified in the URL: [email protected]

phishing

A potential corporate email address has been identified in the URL: vue@3

phishing

A potential corporate email address has been identified in the URL: [email protected]

phishing

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\boltchecker.exe N/A
N/A N/A C:\Users\Admin\Downloads\boltchecker.exe N/A
N/A N/A C:\Users\Admin\Downloads\FortniteChecker.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A
N/A N/A C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A camo.githubusercontent.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Network Service Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\ARP.EXE N/A
N/A N/A C:\Windows\system32\cmd.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Permission Groups Discovery: Local Groups

discovery

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

System Network Connections Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Collects information from the system

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 935948.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 997626.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3452 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1240 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 1240 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 2120 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://jmthedesigner.com/storage/z9f4l6n2x0vI/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeca3f46f8,0x7ffeca3f4708,0x7ffeca3f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3884 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4d0 0x4f4

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5756 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5944 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,5161595936349266043,17944924093166478152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4556 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe

"C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe"

C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe

"C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "gdb --version"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get Manufacturer

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"

C:\Windows\System32\Wbem\WMIC.exe

wmic path Win32_ComputerSystem get Manufacturer

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3452"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 3452

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 672"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 672

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1652"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 1652

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1240"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 1240

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2120"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 2120

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5056"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 5056

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1504"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 1504

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2744"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 2744

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2328"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 2328

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2340"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 2340

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1168"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 1168

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Get-Clipboard

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe

"C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe"

C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe

"C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\HOSTNAME.EXE

hostname

C:\Windows\System32\Wbem\WMIC.exe

wmic logicaldisk get caption,description,providername

C:\Windows\system32\net.exe

net user

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user

C:\Windows\system32\query.exe

query user

C:\Windows\system32\quser.exe

"C:\Windows\system32\quser.exe"

C:\Windows\system32\net.exe

net localgroup

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup

C:\Windows\system32\net.exe

net localgroup administrators

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup administrators

C:\Windows\system32\net.exe

net user guest

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user guest

C:\Windows\system32\net.exe

net user administrator

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user administrator

C:\Windows\System32\Wbem\WMIC.exe

wmic startup get caption,command

C:\Windows\system32\tasklist.exe

tasklist /svc

C:\Windows\system32\ipconfig.exe

ipconfig /all

C:\Windows\system32\ROUTE.EXE

route print

C:\Windows\system32\ARP.EXE

arp -a

C:\Windows\system32\NETSTAT.EXE

netstat -ano

C:\Windows\system32\sc.exe

sc query type= service state= all

C:\Windows\system32\netsh.exe

netsh firewall show state

C:\Windows\system32\netsh.exe

netsh firewall show config

C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe

"C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe

"C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe

"C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe"

C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe

"C:\Users\Admin\Downloads\YaraReborn\YaraReborn\YaraReborn.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffec9f246f8,0x7ffec9f24708,0x7ffec9f24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6708 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6472 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1704 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 /prefetch:8

C:\Users\Admin\Downloads\boltchecker.exe

"C:\Users\Admin\Downloads\boltchecker.exe"

C:\Users\Admin\Downloads\boltchecker.exe

"C:\Users\Admin\Downloads\boltchecker.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6788 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1156 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2692 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6928 /prefetch:8

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_fortnite-account-checker-main.zip\fortnite-account-checker-main\results\ban.txt

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_fortnite-account-checker-main.zip\fortnite-account-checker-main\main.py

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4308 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7356 /prefetch:8

C:\Users\Admin\Downloads\FortniteChecker.exe

"C:\Users\Admin\Downloads\FortniteChecker.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/api/redirect?clientId=ec684b8c687f479fadea3cb2ad83f5c6&responseType=code

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x40,0x128,0x7ffec9f246f8,0x7ffec9f24708,0x7ffec9f24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7336 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8052 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7356 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7816 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8568 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9124 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9112 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9140 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3688 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8908 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,11462879642623106008,16386373712539124813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8892 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 jmthedesigner.com udp
DE 162.55.243.250:443 jmthedesigner.com tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 250.243.55.162.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
GB 88.221.135.34:443 www.bing.com tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 34.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 th.bing.com udp
GB 88.221.135.27:443 th.bing.com tcp
GB 88.221.135.27:443 th.bing.com tcp
GB 88.221.135.42:443 th.bing.com tcp
GB 88.221.135.42:443 th.bing.com tcp
US 8.8.8.8:53 27.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 42.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 login.microsoftonline.com udp
NL 40.126.32.140:443 login.microsoftonline.com tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.108.133:443 avatars.githubusercontent.com tcp
US 185.199.111.154:443 github.githubassets.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 185.199.111.154:443 github.githubassets.com tcp
US 185.199.111.154:443 github.githubassets.com tcp
US 185.199.111.154:443 github.githubassets.com tcp
US 185.199.111.154:443 github.githubassets.com tcp
US 185.199.111.154:443 github.githubassets.com tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 154.111.199.185.in-addr.arpa udp
US 8.8.8.8:53 repository-images.githubusercontent.com udp
US 185.199.109.133:443 repository-images.githubusercontent.com tcp
US 8.8.8.8:53 133.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 collector.github.com udp
US 185.199.111.154:443 github.githubassets.com tcp
US 140.82.114.21:443 collector.github.com tcp
US 8.8.8.8:53 api.github.com udp
US 140.82.114.21:443 collector.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 21.114.82.140.in-addr.arpa udp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 185.199.108.133:443 repository-images.githubusercontent.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 67.112.168.52.in-addr.arpa udp
N/A 127.0.0.1:50483 tcp
N/A 127.0.0.1:50492 tcp
N/A 127.0.0.1:50497 tcp
N/A 127.0.0.1:50500 tcp
N/A 127.0.0.1:50502 tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
N/A 127.0.0.1:50902 tcp
N/A 127.0.0.1:50904 tcp
US 8.8.8.8:53 api.gofile.io udp
FR 45.112.123.126:443 api.gofile.io tcp
US 8.8.8.8:53 store1.gofile.io udp
FR 45.112.123.227:443 store1.gofile.io tcp
US 8.8.8.8:53 126.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 227.123.112.45.in-addr.arpa udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 185.199.111.154:443 github.githubassets.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 collector.github.com udp
US 140.82.114.21:443 collector.github.com tcp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
GB 95.101.143.177:443 www.bing.com tcp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 r.bing.com udp
GB 95.101.143.195:443 r.bing.com tcp
GB 95.101.143.195:443 r.bing.com tcp
GB 88.221.135.1:443 r.bing.com tcp
GB 88.221.135.1:443 r.bing.com tcp
GB 95.101.143.177:443 r.bing.com udp
US 8.8.8.8:53 177.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 195.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 1.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 login.microsoftonline.com udp
IE 20.190.159.64:443 login.microsoftonline.com tcp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 fortchecker.com udp
LU 198.251.84.100:443 fortchecker.com tcp
LU 198.251.84.100:443 fortchecker.com tcp
US 8.8.8.8:53 100.84.251.198.in-addr.arpa udp
US 8.8.8.8:53 mc.yandex.ru udp
RU 87.250.251.119:443 mc.yandex.ru tcp
US 8.8.8.8:53 72.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 119.251.250.87.in-addr.arpa udp
US 8.8.8.8:53 mc.yandex.com udp
LU 198.251.84.100:443 fortchecker.com tcp
US 185.199.111.154:443 github.githubassets.com tcp
US 8.8.8.8:53 private-user-images.githubusercontent.com udp
US 8.8.8.8:53 codeload.github.com udp
GB 20.26.156.216:443 codeload.github.com tcp
US 8.8.8.8:53 216.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
GB 88.221.135.32:443 www.bing.com udp
US 8.8.8.8:53 32.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 r.bing.com udp
GB 88.221.135.58:443 r.bing.com tcp
GB 95.101.143.202:443 r.bing.com tcp
GB 95.101.143.202:443 r.bing.com tcp
GB 88.221.135.58:443 r.bing.com tcp
US 8.8.8.8:53 58.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 202.143.101.95.in-addr.arpa udp
GB 88.221.135.58:443 r.bing.com udp
US 185.199.111.154:443 github.githubassets.com tcp
US 8.8.8.8:53 camo.githubusercontent.com udp
US 8.8.8.8:53 aefd.nelreports.net udp
GB 2.19.252.146:443 aefd.nelreports.net tcp
US 8.8.8.8:53 146.252.19.2.in-addr.arpa udp
US 8.8.8.8:53 codeload.github.com udp
US 8.8.8.8:53 api.github.com udp
GB 88.221.135.41:443 www.bing.com udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 41.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 th.bing.com udp
GB 88.221.135.57:443 th.bing.com udp
GB 88.221.135.33:443 r.bing.com tcp
GB 88.221.135.57:443 th.bing.com udp
US 8.8.8.8:53 57.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 33.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.108.154:443 github.githubassets.com tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 154.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 fpt.microsoft.com udp
US 52.167.30.171:443 fpt.microsoft.com tcp
US 8.8.8.8:53 fpt2.microsoft.com udp
US 8.8.8.8:53 171.30.167.52.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 checker.proswapper.xyz udp
US 172.67.218.10:443 checker.proswapper.xyz tcp
US 172.67.218.10:443 checker.proswapper.xyz tcp
US 8.8.8.8:53 10.218.67.172.in-addr.arpa udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 unpkg.com udp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 104.17.245.203:443 unpkg.com tcp
US 104.17.245.203:443 unpkg.com tcp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 8.8.8.8:53 229.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 203.245.17.104.in-addr.arpa udp
US 172.67.218.10:443 checker.proswapper.xyz udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 fortnite-api.com udp
US 104.26.7.220:443 fortnite-api.com tcp
US 104.26.7.220:443 fortnite-api.com tcp
US 104.26.7.220:443 fortnite-api.com tcp
US 104.26.7.220:443 fortnite-api.com tcp
US 104.26.7.220:443 fortnite-api.com tcp
US 104.26.7.220:443 fortnite-api.com tcp
US 8.8.8.8:53 220.7.26.104.in-addr.arpa udp
US 8.8.8.8:53 proswapper.xyz udp
US 8.8.8.8:53 aefd.nelreports.net udp
GB 2.19.252.146:443 aefd.nelreports.net udp
US 8.8.8.8:53 fortnite-api.com udp
US 104.26.7.220:443 fortnite-api.com tcp
US 104.26.7.220:443 fortnite-api.com tcp
US 104.26.7.220:443 fortnite-api.com tcp
US 8.8.8.8:53 www.epicgames.com udp
US 104.18.20.94:443 www.epicgames.com tcp
US 104.18.20.94:443 www.epicgames.com tcp
US 104.18.20.94:443 www.epicgames.com tcp
US 104.18.20.94:443 www.epicgames.com udp
US 8.8.8.8:53 94.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 account-public-service-prod.ol.epicgames.com udp
US 35.174.51.154:443 account-public-service-prod.ol.epicgames.com tcp
US 8.8.8.8:53 154.51.174.35.in-addr.arpa udp
GB 95.101.143.34:443 www.bing.com udp
US 8.8.8.8:53 34.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 th.bing.com udp
GB 95.101.143.211:443 th.bing.com udp
GB 95.101.143.185:443 th.bing.com udp
US 8.8.8.8:53 211.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 185.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
DE 162.55.243.250:443 jmthedesigner.com tcp
DE 162.55.243.250:443 jmthedesigner.com tcp
DE 162.55.243.250:443 jmthedesigner.com tcp
DE 162.55.243.250:443 jmthedesigner.com tcp
DE 162.55.243.250:443 jmthedesigner.com tcp
US 8.8.8.8:53 use.fontawesome.com udp
US 104.21.27.152:443 use.fontawesome.com tcp
US 104.21.27.152:443 use.fontawesome.com udp
US 104.21.27.152:443 use.fontawesome.com tcp
US 8.8.8.8:53 152.27.21.104.in-addr.arpa udp
GB 95.101.143.211:443 th.bing.com udp
GB 95.101.143.185:443 th.bing.com udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 codeload.github.com udp
GB 20.26.156.216:443 codeload.github.com tcp
US 8.8.8.8:53 aefd.nelreports.net udp
GB 2.19.252.146:443 aefd.nelreports.net udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 7de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1 010da169e15457c25bd80ef02d76a940c1210301
SHA256 6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
SHA512 e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

\??\pipe\LOCAL\crashpad_3452_WKBMJPIJCYCPIUCU

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 85ba073d7015b6ce7da19235a275f6da
SHA1 a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA256 5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
SHA512 eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 855d10b15dbc69b0b0d8281fa4ea2f69
SHA1 2fa3c1a170f5598910194ab672d14e6a1da63c21
SHA256 e07ec9c2937be83bbfb399e05f2962e55b41d19b63c75f2a64fd75244eb05abb
SHA512 1631c589298834baec34c80f345afe087f1f64283ad644b706673eea2d04d5f47fe66fd3d956fff54f51b73da361a8ac6bb09d7e54cc88f283a3bae5c2e19c3b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 84ee715c2e17070366cae1e826846ea4
SHA1 95df511ae8cb5102d70551539daeb337ceffec50
SHA256 23b977886842620db6962028802f43a2da10a523e7df9d042dcc7bba0f247a8d
SHA512 457aab5c8f1bc9352509b83a1a6f56d31786e4111facfd952d8f791c6ee20d8b67f2edaf1ceecfdda7827eaf17513decca1f280febc333c72544239d51b6ce55

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8957a9aa76743c0485e841bd2f7bd3f2
SHA1 61ddbd8ca852955ee7eb06adbf9b75e69daac70b
SHA256 3289e74a1b8979e86d703936f6ebfa8c4312ccd63904900bf7344b65ba48f94c
SHA512 7794c6f00981ac6fa0a14e3ecfcca5eadf802d5c0f38d35c432a0aa9653cf9d590898e3a1ceb8b28c13c3d12c6a9e4223dbb746aa6ebf6d593550e3487a84851

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b1b01a003471e0d7303aa34b11e46893
SHA1 5d9fc7268beba2ca15116f238cb9750897112bcc
SHA256 0873bd80eb46e779c44b9f9b47db55a4856cec1d1f1cbae74c7c4cf23e345549
SHA512 4d7673a8e522efa94d62261ea36e5f2b0376dde11f24380556749eafcf92f8c99731760d29d72bfa1a75bfe4535dfe48974979b5586fa02fb2535b46394035ea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 3c8d8ceaa1efc6f4efbcec676af7a770
SHA1 89bb9abb11bd600d40fc7fe9bf7b3d6a08a17619
SHA256 97145bf3b037f1e47cbb0209bb468900e0ef8d5772d939ec85e4b81a703dbb6d
SHA512 561e208f82373c2c2735d5dc43cf0e0792db3de27b439652b08d1dad673ce168073e377d512cf64f727cd31a95d4249c7ceb4e7ce141a40441f13bfda01e0073

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 8ba995b210d163db3b05ae3bfeb964ec
SHA1 0016c35281e3b5dfe20f09f31da12559706ec5c8
SHA256 f37920acb2b69e983ecd88ad9d2f1d3ddf0f726ba013bbcf7cee65978912137e
SHA512 6683472e411b3ed47f36ceb9e762b08784f14b5862f326ff71c202f1fae9962687017e5750dd3ae691dbe7b112c993b6d682729bfe6921def7e3505dae37a81b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58cc34.TMP

MD5 1bf3a8e9398d56d3339013da1d094da9
SHA1 10f10252dccbd5008938f402368c4ba8d07bc18a
SHA256 3e784389a5922cf451f39d0c342232c067492181296026735f48b2301c12cff4
SHA512 a673abf682d6285c2c592832627935a3907a16db3686a8de062591641059e43cb9339083ae67f8bc7c80d1a362b99fec135929d8dae3ca96bb684e84735d05bd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8a531058e617413442ad64e9d71e77c3
SHA1 778043b3d4385239a9e35d2191d36d0ef5e256ed
SHA256 b7367f916f8062d5e5e049c86ca4bcd49af5be825e8e8ed5440052613a5ed9c7
SHA512 edf14bcbbebe5912a4b22a5cca7d61f93a3eb4cd084e0ccb8c2c6d22941a3765d921d0c02bf82d290b16ec31c95eacb66cc5dbeb5d605c190405879090c50988

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 566bc529d79c423268c811e43a30252a
SHA1 9230d36e91eccabc3d69a4a5efedfb1de9ae7e29
SHA256 97e317a10d565df2814eae1972aa43f4ba0a7e9ada155ba3c67baf7df6cd0922
SHA512 d1040f0a02ec5e42e5bea0a81684d1db34f69c1609f767d5439d98eac988d314e38dc5709ea591139914cf1b347d17d70ef0dc9bdbf38e13f4b670f5d180e06d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 57556577b4aeee4ef545bde404da47f6
SHA1 b843e0ad3fdd7c9e95f50ec56c9657625cdad776
SHA256 bc43bb1e8a42b1b5a135c3c55362fac5ec4d6ec4fd8454344113d64f81a4af4a
SHA512 e1d4a374f4e8a88640ded4f3d4473ab597cab270b4811b95323f9be8c9a6c05795af8304ad9d277c9dd6de912c8afeedcaa179ecd759dae78fea41ffa8d5d533

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 2b604af28e310ea4101c9dfe89a3e4a1
SHA1 aa760f2566193b5a704f15f48a200c717c616299
SHA256 4c84b0b2794a7b27d2cba233b02ff53f0a8188ecb91d454c0f4e09d97a8e85a9
SHA512 90d137d86b9cffae0a101bf2ea263471e2ccaf563ba19d1ae77fdd427f65af7924d0508a882f28c8df1f46bc8115f1f8938482b9f6aa62c57d9405b985669a42

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 ddd88f4029651edc1a66abb0796c431b
SHA1 fe358e2ee35d8fb8714127122e0c5e07f7946dbb
SHA256 4889e922fe2e07790202dae94d8d628943f5a73a21135ce8866f4613468dd73b
SHA512 3ef90fe02f4072f9d31d6b3cac20c5d8012e10f9a9fbe6f027d9f258189f8e25c4f7de89129db00ea48d975c54b1edc0a6a10278a8e2cc28fad223f83a26f569

C:\Users\Admin\Downloads\Unconfirmed 814160.crdownload

MD5 cc149ed422ed5ed3c9227a915c933af5
SHA1 f24d8f9504d12fd850810ad64376395e21d27144
SHA256 f02ea44d31cc9cf82ed0b50f2e0a18c69114b4bb5afb7cdf3c83cd7a80ad05ad
SHA512 d6aab60305af29c99c659ec3abf2772a88e4aa62087acb70e4987ba1ae931add9f84f115c2e981ba89637964ff5e9471704ad3e8205c2f82249325e1a8a77a3c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 39fc5d4136aa08e598fae6c846e3b950
SHA1 026e0a12c9c9dd33de8a238cb10f4862db7a4239
SHA256 146b3d3a6e106f4b4ae8724c50f33dab1e1bd54cd84de4be6363646fb77d4fac
SHA512 5b9c371a8cf32e6ffb1a5f32e9016379faf1bc10a0ea73e1df5f0a316e7e8399231f5be9cd6b6e1108909f776a4fc9c818f8f85ed1d8528bd218908243924355

C:\Users\Admin\AppData\Local\Temp\_MEI7882\ucrtbase.dll

MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

C:\Users\Admin\AppData\Local\Temp\_MEI7882\python311.dll

MD5 db09c9bbec6134db1766d369c339a0a1
SHA1 c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA256 b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
SHA512 653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

C:\Users\Admin\AppData\Local\Temp\_MEI7882\VCRUNTIME140.dll

MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

memory/1008-692-0x00007FFEC50D0000-0x00007FFEC56B8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7882\base_library.zip

MD5 83d235e1f5b0ee5b0282b5ab7244f6c4
SHA1 629a1ce71314d7abbce96674a1ddf9f38c4a5e9c
SHA256 db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0
SHA512 77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f

C:\Users\Admin\AppData\Local\Temp\_MEI7882\python3.dll

MD5 34e49bb1dfddf6037f0001d9aefe7d61
SHA1 a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
SHA512 edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

C:\Users\Admin\AppData\Local\Temp\_MEI7882\_ctypes.pyd

MD5 b4c41a4a46e1d08206c109ce547480c7
SHA1 9588387007a49ec2304160f27376aedca5bc854d
SHA256 9925ab71a4d74ce0ccc036034d422782395dd496472bd2d7b6d617f4d6ddc1f9
SHA512 30debb8e766b430a57f3f6649eeb04eb0aad75ab50423252585db7e28a974d629eb81844a05f5cb94c1702308d3feda7a7a99cb37458e2acb8e87efc486a1d33

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-crt-locale-l1-1-0.dll

MD5 d8302fc8fac16f2afebf571a5ae08a71
SHA1 0c1aee698e2b282c4d19011454da90bb5ab86252
SHA256 b9ae70e8f74615ea2dc6fc74ec8371616e57c8eff8555547e7167bb2db3424f2
SHA512 cd2f4d502cd37152c4b864347fb34bc77509cc9e0e7fe0e0a77624d78cda21f244af683ea8b47453aa0fa6ead2a0b2af4816040d8ea7cdad505f470113322009

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-crt-heap-l1-1-0.dll

MD5 546da2b69f039da9da801eb7455f7ab7
SHA1 b8ff34c21862ee79d94841c40538a90953a7413b
SHA256 a93c8af790c37a9b6bac54003040c283bef560266aeec3d2de624730a161c7dc
SHA512 4a3c8055ab832eb84dd2d435f49b5b748b075bbb484248188787009012ee29dc4e04d8fd70110e546ce08d0c4457e96f4368802caee5405cff7746569039a555

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 931246f429565170bb80a1144b42a8c4
SHA1 e544fad20174cf794b51d1194fd780808f105d38
SHA256 a3ba0ee6a4abc082b730c00484d4462d16bc13ee970ee3eee96c34fc9b6ef8ed
SHA512 4d1d811a1e61a8f1798a617200f0a5ffbde9939a0c57b6b3901be9ca8445b2e50fc736f1dce410210965116249d77801940ef65d9440700a6489e1b9a8dc0a39

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-crt-environment-l1-1-0.dll

MD5 f983f25bf0ad58bcfa9f1e8fd8f94fcb
SHA1 27ede57c1a59b64db8b8c3c1b7f758deb07942e8
SHA256 a5c8c787c59d0700b5605925c8c255e5ef7902716c675ec40960640b15ff5aca
SHA512 ac797ff4f49be77803a3fe5097c006bb4806a3f69e234bf8d1440543f945360b19694c8ecf132ccfbd17b788afce816e5866154c357c27dfeb0e97c0a594c166

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-crt-convert-l1-1-0.dll

MD5 33b85a64c4af3a65c4b72c0826668500
SHA1 315ddb7a49283efe7fcae1b51ebd6db77267d8df
SHA256 8b24823407924688ecafc771edd9c58c6dbcc7de252e7ebd20751a5b9dd7abef
SHA512 b3a62cb67c7fe44ca57ac16505a9e9c3712c470130df315b591a9d39b81934209c8b48b66e1e18da4a5323785120af2d9e236f39c9b98448f88adab097bc6651

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-crt-conio-l1-1-0.dll

MD5 42ee890e5e916935a0d3b7cdee7147e0
SHA1 d354db0aac3a997b107ec151437ef17589d20ca5
SHA256 91d7a4c39baac78c595fc6cf9fd971aa0a780c297da9a8b20b37b0693bdcd42c
SHA512 4fae6d90d762ed77615d0f87833152d16b2c122964754b486ea90963930e90e83f3467253b7ed90d291a52637374952570bd9036c6b8c9eaebe8b05663ebb08e

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-util-l1-1-0.dll

MD5 427f0e19148d98012968564e4b7e622a
SHA1 488873eb98133e20acd106b39f99e3ebdfaca386
SHA256 0cbacaccedaf9b6921e6c1346de4c0b80b4607dacb0f7e306a94c2f15fa6d63d
SHA512 03fa49bdadb65b65efed5c58107912e8d1fccfa13e9adc9df4441e482d4b0edd6fa1bd8c8739ce09654b9d6a176e749a400418f01d83e7ae50fa6114d6aead2b

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-timezone-l1-1-0.dll

MD5 2554060f26e548a089cab427990aacdf
SHA1 8cc7a44a16d6b0a6b7ed444e68990ff296d712fe
SHA256 5ab003e899270b04abc7f67be953eaccf980d5bbe80904c47f9aaf5d401bb044
SHA512 fd4d5a7fe4da77b0222b040dc38e53f48f7a3379f69e2199639b9f330b2e55939d89ce8361d2135182b607ad75e58ee8e34b90225143927b15dcc116b994c506

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 9ca65d4fe9b76374b08c4a0a12db8d2f
SHA1 a8550d6d04da33baa7d88af0b4472ba28e14e0af
SHA256 8a1e56bd740806777bc467579bdc070bcb4d1798df6a2460b9fe36f1592189b8
SHA512 19e0d2065f1ca0142b26b1f5efdd55f874f7dde7b5712dd9dfd4988a24e2fcd20d4934bdda1c2d04b95e253aa1bee7f1e7809672d7825cd741d0f6480787f3b3

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-synch-l1-2-0.dll

MD5 dd6f223b4f9b84c6e9b2a7cf49b84fc7
SHA1 2ee75d635d21d628e8083346246709a71b085710
SHA256 8356f71c5526808af2896b2d296ce14e812e4585f4d0c50d7648bc851b598bef
SHA512 9c12912daea5549a3477baa2cd05180702cf24dd185be9f1fca636db6fbd25950c8c2b83f18d093845d9283c982c0255d6402e3cdea0907590838e0acb8cc8c1

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-synch-l1-1-0.dll

MD5 6ea31229d13a2a4b723d446f4242425b
SHA1 036e888b35281e73b89da1b0807ea8e89b139791
SHA256 8eccaba9321df69182ee3fdb8fc7d0e7615ae9ad3b8ca53806ed47f4867395ae
SHA512 fa834e0e54f65d9a42ad1f4fb1086d26edfa182c069b81cff514feb13cfcb7cb5876508f1289efbc2d413b1047d20bab93ced3e5830bf4a6bb85468decd87cb6

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-string-l1-1-0.dll

MD5 84b1347e681e7c8883c3dc0069d6d6fa
SHA1 9e62148a2368724ca68dfa5d146a7b95c710c2f2
SHA256 1cb48031891b967e2f93fdd416b0324d481abde3838198e76bc2d0ca99c4fd09
SHA512 093097a49080aec187500e2a9e9c8ccd01f134a3d8dc8ab982e9981b9de400dae657222c20fb250368ecddc73b764b2f4453ab84756b908fcb16df690d3f4479

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 772f1b596a7338f8ea9ddff9aba9447d
SHA1 cda9f4b9808e9cef2aeac2ac6e7cdf0e8687c4c5
SHA256 cc1bfce8fe6f9973cca15d7dfcf339918538c629e6524f10f1931ae8e1cd63b4
SHA512 8c94890c8f0e0a8e716c777431022c2f77b69ebfaa495d541e2d3312ae1da307361d172efce94590963d17fe3fcac8599dcabe32ab56e01b4d9cf9b4f0478277

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-profile-l1-1-0.dll

MD5 9082d23943b0aa48d6af804a2f3609a2
SHA1 c11b4e12b743e260e8b3c22c9face83653d02efe
SHA256 7ecc2e3fe61f9166ff53c28d7cb172a243d94c148d3ef13545bc077748f39267
SHA512 88434a2b996ed156d5effbb7960b10401831e9b2c9421a0029d2d8fa651b9411f973e988565221894633e9ffcd6512f687afbb302efe2273d4d1282335ee361d

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-processthreads-l1-1-1.dll

MD5 4380d56a3b83ca19ea269747c9b8302b
SHA1 0c4427f6f0f367d180d37fc10ecbe6534ef6469c
SHA256 a79c7f86462d8ab8a7b73a3f9e469514f57f9fe456326be3727352b092b6b14a
SHA512 1c29c335c55f5f896526c8ee0f7160211fd457c1f1b98915bcc141112f8a730e1a92391ab96688cbb7287e81e6814cc86e3b057e0a6129cbb02892108bfafaf4

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-processthreads-l1-1-0.dll

MD5 8e6eb11588fa9625b68960a46a9b1391
SHA1 ff81f0b3562e846194d330fadf2ab12872be8245
SHA256 ae56e19da96204e7a9cdc0000f96a7ef15086a9fe1f686687cb2d6fbcb037cd6
SHA512 fdb97d1367852403245fc82cb1467942105e4d9db0de7cf13a73658905139bb9ae961044beb0a0870429a1e26fe00fc922fbd823bd43f30f825863cad2c22cea

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 8711e4075fa47880a2cb2bb3013b801a
SHA1 b7ceec13e3d943f26def4c8a93935315c8bb1ac3
SHA256 5bcc3a2d7d651bb1ecc41aa8cd171b5f2b634745e58a8503b702e43aee7cd8c6
SHA512 7370e4acb298b2e690ccd234bd6c95e81a5b870ae225bc0ad8fa80f4473a85e44acc6159502085fe664075afa940cff3de8363304b66a193ac970ced1ba60aae

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 eaf36a1ead954de087c5aa7ac4b4adad
SHA1 9dd6bc47e60ef90794a57c3a84967b3062f73c3c
SHA256 cdba9dc9af63ebd38301a2e7e52391343efeb54349fc2d9b4ee7b6bf4f9cf6eb
SHA512 1af9e60bf5c186ced5877a7fa690d9690b854faa7e6b87b0365521eafb7497fb7370ac023db344a6a92db2544b5bdc6e2744c03b10c286ebbf4f57c6ca3722cf

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-memory-l1-1-0.dll

MD5 c4098d0e952519161f4fd4846ec2b7fc
SHA1 8138ca7eb3015fc617620f05530e4d939cafbd77
SHA256 51b2103e0576b790d5f5fdacb42af5dac357f1fd37afbaaf4c462241c90694b4
SHA512 95aa4c7071bc3e3fa4db80742f587a0b80a452415c816003e894d2582832cf6eac645a26408145245d4deabe71f00eccf6adb38867206bedd5aa0a6413d241f5

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-localization-l1-2-0.dll

MD5 20ddf543a1abe7aee845de1ec1d3aa8e
SHA1 0eaf5de57369e1db7f275a2fffd2d2c9e5af65bf
SHA256 d045a72c3e4d21165e9372f76b44ff116446c1e0c221d9cea3ab0a1134a310e8
SHA512 96dd48df315a7eea280ca3da0965a937a649ee77a82a1049e3d09b234439f7d927d7fb749073d7af1b23dadb643978b70dcdadc6c503fe850b512b0c9c1c78dd

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 8dfc224c610dd47c6ec95e80068b40c5
SHA1 178356b790759dc9908835e567edfb67420fbaac
SHA256 7b8c7e09030df8cdc899b9162452105f8baeb03ca847e552a57f7c81197762f2
SHA512 fe5be81bfce4a0442dd1901721f36b1e2efcdcee1fdd31d7612ad5676e6c5ae5e23e9a96b2789cb42b7b26e813347f0c02614937c561016f1563f0887e69bbee

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-interlocked-l1-1-0.dll

MD5 4f631924e3f102301dac36b514be7666
SHA1 b3740a0acdaf3fba60505a135b903e88acb48279
SHA256 e2406077621dce39984da779f4d436c534a31c5e863db1f65de5939d962157af
SHA512 56f9fb629675525cbe84a29d44105b9587a9359663085b62f3fbe3eea66451da829b1b6f888606bc79754b6b814ca4a1b215f04f301efe4db0d969187d6f76f1

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-heap-l1-1-0.dll

MD5 6168023bdb7a9ddc69042beecadbe811
SHA1 54ee35abae5173f7dc6dafc143ae329e79ec4b70
SHA256 4ea8399debe9d3ae00559d82bc99e4e26f310934d3fd1d1f61177342cf526062
SHA512 f1016797f42403bb204d4b15d75d25091c5a0ab8389061420e1e126d2214190a08f02e2862a2ae564770397e677b5bcdd2779ab948e6a3e639aa77b94d0b3f6c

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-handle-l1-1-0.dll

MD5 d584c1e0f0a0b568fce0efd728255515
SHA1 2e5ce6d4655c391f2b2f24fc207fdf0e6cd0cc2a
SHA256 3de40a35254e3e0e0c6db162155d5e79768a6664b33466bf603516f3743efb18
SHA512 c7d1489bf81e552c022493bb5a3cd95ccc81dbedaaa8fdc0048cacbd087913f90b366eeb4bf72bf4a56923541d978b80d7691d96dbbc845625f102c271072c42

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-file-l2-1-0.dll

MD5 bfffa7117fd9b1622c66d949bac3f1d7
SHA1 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512 b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-file-l1-2-0.dll

MD5 bcb8b9f6606d4094270b6d9b2ed92139
SHA1 bd55e985db649eadcb444857beed397362a2ba7b
SHA256 fa18d63a117153e2ace5400ed89b0806e96f0627d9db935906be9294a3038118
SHA512 869b2b38fd528b033b3ec17a4144d818e42242b83d7be48e2e6da6992111758b302f48f52e0dd76becb526a90a2b040ce143c6d4f0e009a513017f06b9a8f2b9

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-file-l1-1-0.dll

MD5 ea00855213f278d9804105e5045e2882
SHA1 07c6141e993b21c4aa27a6c2048ba0cff4a75793
SHA256 f2f74a801f05ab014d514f0f1d0b3da50396e6506196d8beccc484cd969621a6
SHA512 b23b78b7bd4138bb213b9a33120854249308bb2cf0d136676174c3d61852a0ac362271a24955939f04813cc228cd75b3e62210382a33444165c6e20b5e0a7f24

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 f1534c43c775d2cceb86f03df4a5657d
SHA1 9ed81e2ad243965e1090523b0c915e1d1d34b9e1
SHA256 6e6bfdc656f0cf22fabba1a25a42b46120b1833d846f2008952fe39fe4e57ab2
SHA512 62919d33c7225b7b7f97faf4a59791f417037704eb970cb1cb8c50610e6b2e86052480cdba771e4fad9d06454c955f83ddb4aea2a057725385460617b48f86a7

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-debug-l1-1-0.dll

MD5 71f1d24c7659171eafef4774e5623113
SHA1 8712556b19ed9f80b9d4b6687decfeb671ad3bfe
SHA256 c45034620a5bb4a16e7dd0aff235cc695a5516a4194f4fec608b89eabd63eeef
SHA512 0a14c03365adb96a0ad539f8e8d8333c042668046cea63c0d11c75be0a228646ea5b3fbd6719c29580b8baaeb7a28dc027af3de10082c07e089cdda43d5c467a

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-datetime-l1-1-0.dll

MD5 c5e3e5df803c9a6d906f3859355298e1
SHA1 0ecd85619ee5ce0a47ff840652a7c7ef33e73cf4
SHA256 956773a969a6213f4685c21702b9ed5bd984e063cf8188acbb6d55b1d6ccbd4e
SHA512 deedef8eaac9089f0004b6814862371b276fbcc8df45ba7f87324b2354710050d22382c601ef8b4e2c5a26c8318203e589aa4caf05eb2e80e9e8c87fd863dfc9

C:\Users\Admin\AppData\Local\Temp\_MEI7882\api-ms-win-core-console-l1-1-0.dll

MD5 40ba4a99bf4911a3bca41f5e3412291f
SHA1 c9a0e81eb698a419169d462bcd04d96eaa21d278
SHA256 af0e561bb3b2a13aa5ca9dfc9bc53c852bad85075261af6ef6825e19e71483a6
SHA512 f11b98ff588c2e8a88fdd61d267aa46dc5240d8e6e2bfeea174231eda3affc90b991ff9aae80f7cea412afc54092de5857159569496d47026f8833757c455c23

memory/1008-702-0x00007FFEE0D20000-0x00007FFEE0D2F000-memory.dmp

memory/1008-701-0x00007FFED8D80000-0x00007FFED8DA4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7882\libffi-8.dll

MD5 decbba3add4c2246928ab385fb16a21e
SHA1 5f019eff11de3122ffa67a06d52d446a3448b75e
SHA256 4b43c1e42f6050ddb8e184c8ec4fb1de4a6001e068ece8e6ad47de0cc9fd4a2d
SHA512 760a42a3eb3ca13fa7b95d3bd0f411c270594ae3cf1d3cda349fa4f8b06ebe548b60cd438d68e2da37de0bc6f1c711823f5e917da02ed7047a45779ee08d7012

memory/1008-734-0x00007FFED8B90000-0x00007FFED8BA9000-memory.dmp

memory/1008-735-0x00007FFEE0B90000-0x00007FFEE0B9D000-memory.dmp

memory/1008-736-0x00007FFED8440000-0x00007FFED8459000-memory.dmp

memory/1008-737-0x00007FFECA4D0000-0x00007FFECA4FD000-memory.dmp

memory/1008-738-0x00007FFEC7D50000-0x00007FFEC7D73000-memory.dmp

memory/1008-739-0x00007FFEC6680000-0x00007FFEC67F3000-memory.dmp

memory/1008-740-0x00007FFEC7840000-0x00007FFEC786E000-memory.dmp

memory/1008-741-0x00007FFEC50D0000-0x00007FFEC56B8000-memory.dmp

memory/1008-743-0x00000172613D0000-0x0000017261745000-memory.dmp

memory/1008-742-0x00007FFEC65C0000-0x00007FFEC6678000-memory.dmp

memory/1008-745-0x00007FFED8D80000-0x00007FFED8DA4000-memory.dmp

memory/1008-744-0x00007FFEC4260000-0x00007FFEC45D5000-memory.dmp

memory/1008-746-0x00007FFED83C0000-0x00007FFED83D5000-memory.dmp

memory/1008-748-0x00007FFECA4B0000-0x00007FFECA4C2000-memory.dmp

memory/1008-747-0x00007FFED8B90000-0x00007FFED8BA9000-memory.dmp

memory/1008-749-0x00007FFECA240000-0x00007FFECA254000-memory.dmp

memory/1008-750-0x00007FFECA030000-0x00007FFECA044000-memory.dmp

memory/1008-752-0x00007FFEC7510000-0x00007FFEC762C000-memory.dmp

memory/1008-751-0x00007FFECA4D0000-0x00007FFECA4FD000-memory.dmp

memory/1008-753-0x00007FFEC7D50000-0x00007FFEC7D73000-memory.dmp

memory/1008-754-0x00007FFEC7810000-0x00007FFEC7832000-memory.dmp

memory/1008-755-0x00007FFEC6680000-0x00007FFEC67F3000-memory.dmp

memory/1008-756-0x00007FFEC9F40000-0x00007FFEC9F57000-memory.dmp

memory/1008-758-0x00007FFEC74F0000-0x00007FFEC7509000-memory.dmp

memory/1008-757-0x00007FFEC7840000-0x00007FFEC786E000-memory.dmp

memory/1008-759-0x00007FFEC65C0000-0x00007FFEC6678000-memory.dmp

memory/1008-762-0x00007FFEDC8A0000-0x00007FFEDC8AA000-memory.dmp

memory/1008-761-0x00007FFEC74A0000-0x00007FFEC74EA000-memory.dmp

memory/1008-760-0x00000172613D0000-0x0000017261745000-memory.dmp

memory/1008-766-0x00007FFED83C0000-0x00007FFED83D5000-memory.dmp

memory/1008-765-0x00007FFEC7460000-0x00007FFEC747E000-memory.dmp

memory/1008-764-0x00007FFEC7480000-0x00007FFEC7491000-memory.dmp

memory/1008-763-0x00007FFEC4260000-0x00007FFEC45D5000-memory.dmp

memory/1008-767-0x00007FFEC3BF0000-0x00007FFEC425D000-memory.dmp

memory/1008-769-0x00007FFEC7420000-0x00007FFEC7458000-memory.dmp

memory/1008-768-0x00007FFECA240000-0x00007FFECA254000-memory.dmp

memory/1008-784-0x00007FFEC7510000-0x00007FFEC762C000-memory.dmp

memory/1008-789-0x00007FFEC7810000-0x00007FFEC7832000-memory.dmp

memory/1008-794-0x00007FFEC9F40000-0x00007FFEC9F57000-memory.dmp

memory/1008-830-0x00007FFEE2270000-0x00007FFEE227D000-memory.dmp

memory/4420-836-0x000001D260A60000-0x000001D260A82000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_340rjbc3.bfi.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2668-932-0x00007FFEC9950000-0x00007FFEC9F38000-memory.dmp

memory/2668-933-0x00007FFED9350000-0x00007FFED9374000-memory.dmp

memory/2668-935-0x00007FFEE2260000-0x00007FFEE226F000-memory.dmp

memory/1008-934-0x00007FFEC3BF0000-0x00007FFEC425D000-memory.dmp

memory/2668-938-0x00007FFEDACB0000-0x00007FFEDACBD000-memory.dmp

memory/2668-937-0x00007FFED9330000-0x00007FFED9349000-memory.dmp

memory/1008-936-0x00007FFEC7420000-0x00007FFEC7458000-memory.dmp

memory/2668-966-0x00007FFED91A0000-0x00007FFED91B9000-memory.dmp

memory/2668-967-0x00007FFED9040000-0x00007FFED906D000-memory.dmp

memory/2668-971-0x00007FFED8FE0000-0x00007FFED900E000-memory.dmp

memory/2668-974-0x00007FFECA350000-0x00007FFECA408000-memory.dmp

memory/2668-973-0x00007FFEC9260000-0x00007FFEC95D5000-memory.dmp

memory/2668-972-0x00007FFEC9950000-0x00007FFEC9F38000-memory.dmp

memory/2668-970-0x00007FFEC95E0000-0x00007FFEC9753000-memory.dmp

memory/1008-969-0x00007FFEE2270000-0x00007FFEE227D000-memory.dmp

memory/2668-976-0x00007FFED0240000-0x00007FFED0255000-memory.dmp

memory/2668-978-0x00007FFED9330000-0x00007FFED9349000-memory.dmp

memory/2668-979-0x00007FFECA8C0000-0x00007FFECA8D4000-memory.dmp

memory/2668-980-0x00007FFECA8A0000-0x00007FFECA8B4000-memory.dmp

memory/2668-977-0x00007FFECFB30000-0x00007FFECFB42000-memory.dmp

memory/2668-975-0x00007FFED9350000-0x00007FFED9374000-memory.dmp

memory/2668-968-0x00007FFED9010000-0x00007FFED9033000-memory.dmp

memory/1008-959-0x00007FFEC74A0000-0x00007FFEC74EA000-memory.dmp

memory/1008-958-0x00007FFEC74F0000-0x00007FFEC7509000-memory.dmp

memory/1008-957-0x00007FFEC9F40000-0x00007FFEC9F57000-memory.dmp

memory/1008-956-0x00007FFEC7810000-0x00007FFEC7832000-memory.dmp

memory/1008-952-0x00007FFECA4B0000-0x00007FFECA4C2000-memory.dmp

memory/1008-951-0x00007FFED83C0000-0x00007FFED83D5000-memory.dmp

memory/1008-947-0x00007FFEC6680000-0x00007FFEC67F3000-memory.dmp

memory/1008-939-0x00007FFEC50D0000-0x00007FFEC56B8000-memory.dmp

memory/1008-940-0x00007FFED8D80000-0x00007FFED8DA4000-memory.dmp

memory/2668-981-0x00007FFEC89E0000-0x00007FFEC8AFC000-memory.dmp

memory/2668-982-0x00007FFEC89B0000-0x00007FFEC89D2000-memory.dmp

memory/2668-984-0x00007FFECA2C0000-0x00007FFECA2D7000-memory.dmp

memory/2668-983-0x00007FFED9010000-0x00007FFED9033000-memory.dmp

memory/2668-988-0x00007FFED8FE0000-0x00007FFED900E000-memory.dmp

memory/2668-987-0x00007FFEC8940000-0x00007FFEC898A000-memory.dmp

memory/2668-986-0x00007FFEC8990000-0x00007FFEC89A9000-memory.dmp

memory/2668-985-0x00007FFEC95E0000-0x00007FFEC9753000-memory.dmp

memory/2668-991-0x00007FFEC8920000-0x00007FFEC8931000-memory.dmp

memory/2668-993-0x00007FFED0240000-0x00007FFED0255000-memory.dmp

memory/2668-992-0x00007FFED9990000-0x00007FFED999A000-memory.dmp

memory/2668-990-0x00007FFECA350000-0x00007FFECA408000-memory.dmp

memory/2668-989-0x00007FFEC9260000-0x00007FFEC95D5000-memory.dmp

memory/2668-994-0x00007FFEC8900000-0x00007FFEC891E000-memory.dmp

memory/2668-995-0x00007FFEC8290000-0x00007FFEC88FD000-memory.dmp

memory/2668-996-0x00007FFEC8250000-0x00007FFEC8288000-memory.dmp

memory/2668-1014-0x00007FFEC89B0000-0x00007FFEC89D2000-memory.dmp

memory/2668-1018-0x00007FFEC8920000-0x00007FFEC8931000-memory.dmp

memory/2668-1033-0x00007FFECA350000-0x00007FFECA408000-memory.dmp

memory/2668-1032-0x00007FFED8FE0000-0x00007FFED900E000-memory.dmp

memory/2668-1031-0x00007FFEC8900000-0x00007FFEC891E000-memory.dmp

memory/2668-1030-0x00007FFED9010000-0x00007FFED9033000-memory.dmp

memory/2668-1029-0x00007FFED9040000-0x00007FFED906D000-memory.dmp

memory/2668-1028-0x00007FFED91A0000-0x00007FFED91B9000-memory.dmp

memory/2668-1027-0x00007FFEDACB0000-0x00007FFEDACBD000-memory.dmp

memory/2668-1026-0x00007FFED9330000-0x00007FFED9349000-memory.dmp

memory/2668-1023-0x00007FFED9990000-0x00007FFED999A000-memory.dmp

memory/2668-1022-0x00007FFEC8250000-0x00007FFEC8288000-memory.dmp

memory/2668-1017-0x00007FFEC8940000-0x00007FFEC898A000-memory.dmp

memory/2668-1016-0x00007FFEC8990000-0x00007FFEC89A9000-memory.dmp

memory/2668-1015-0x00007FFECA2C0000-0x00007FFECA2D7000-memory.dmp

memory/2668-1013-0x00007FFEC89E0000-0x00007FFEC8AFC000-memory.dmp

memory/2668-1012-0x00007FFECA8A0000-0x00007FFECA8B4000-memory.dmp

memory/2668-1007-0x00007FFEC9260000-0x00007FFEC95D5000-memory.dmp

memory/2668-1011-0x00007FFECA8C0000-0x00007FFECA8D4000-memory.dmp

memory/2668-1009-0x00007FFED0240000-0x00007FFED0255000-memory.dmp

memory/2668-1021-0x00007FFEC8290000-0x00007FFEC88FD000-memory.dmp

memory/2668-997-0x00007FFEC9950000-0x00007FFEC9F38000-memory.dmp

memory/2668-1025-0x00007FFEE2260000-0x00007FFEE226F000-memory.dmp

memory/2668-1024-0x00007FFED9350000-0x00007FFED9374000-memory.dmp

memory/2668-1010-0x00007FFECFB30000-0x00007FFECFB42000-memory.dmp

memory/2668-1005-0x00007FFEC95E0000-0x00007FFEC9753000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI31882\attrs-23.1.0.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

memory/4288-1133-0x00007FFEC9950000-0x00007FFEC9F38000-memory.dmp

memory/4288-1134-0x00007FFED9040000-0x00007FFED9064000-memory.dmp

memory/4288-1135-0x00007FFEE2260000-0x00007FFEE226F000-memory.dmp

memory/1008-1158-0x00007FFEC65C0000-0x00007FFEC6678000-memory.dmp

memory/1008-1157-0x00007FFEC7840000-0x00007FFEC786E000-memory.dmp

memory/1008-1148-0x00007FFEC50D0000-0x00007FFEC56B8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\CheckpointInvoke.mp3

MD5 b4e270f8c39ffcf30bfb76656eba2f92
SHA1 9c1f19e5c7f6d7f507263a390e4ae77805daedbd
SHA256 d4b746c853482ba68f9d0cc5e19acb16fe0bcb73332465ac0649366a442e0921
SHA512 7d18fc014af5c5b5b2d78c694a82fadabbe5cc493e7930549956e5324c8151c3fd21bd6d7f74d3af60bb3cb49d98d13e59986878c872b2b66377406f2404b746

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\BackupDebug.ppt

MD5 2565dff58287a4025080cd3ee7e4898b
SHA1 829457bc150e0d40202e5a3f7fceca16e9bc7b9a
SHA256 47614afaa01d816ed5cc68682f5b4e631fb62a75c8a63cd12da6ef768ebbdb9c
SHA512 b3d296dd808a099d2e88c992d5c84b82709eaedb46ef532be96b7d53057c00cd077f2a94b5de9039102d1b394f1d5157b4103c371bdce95283bdccedf37249bd

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\MeasureRemove.xlsx

MD5 f7ba2cebc41dd3312f7e0c4d2bdabe6e
SHA1 5c281eac1708b406f12e210a0ee744841f2f81a2
SHA256 2d8d171b70060714f8f0bc28fd717e0ec57ffd98b0bb00c3910e98c019cdb468
SHA512 3d10ef18f8a6729bdbc7c87ea3e306d763ecf8b6e643fd1137d5e0c52a2276b23f1f70416d854a51c0a6f62f751cc1a56443a9c8f4dfe8286604ffb6b489716c

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\MountUse.csv

MD5 0eed7734c6e7d0ca6e77f5af1f00e0bf
SHA1 7f437b871309becaacea7123267fa2c7837e97bf
SHA256 38b8ce802fa1c7286aa68b1ebac927d86534c7db31d10a3bbbf061e3a053ef02
SHA512 18672d72f95510c899840eb9c42460bffd12a0dac0651c3e380b578f82fb90c91072435c06a06f29d8824e584fd7ee569450ca36f8fe392bed69d78dcc21e0da

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\NewReceive.docx

MD5 277a105996d0f6d2749633d97a1885f3
SHA1 0e1e6057e0e41a0993f5ce8d32effaa086b23a34
SHA256 c2e4e92b447586e877c3693199c7c5485c544ddc889969d1a8bd76432618d408
SHA512 42fc3b86aba6e16a11fb38b7b629574dae8460a6b49641c286b933d6f3f07db8c82fc7b55a070a197258e26c82e42190b3f806faf4de84b86ba0f20fb0c43246

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ReadCopy.xls

MD5 c477e237c05ceb7d95aee3aae919d4e0
SHA1 dcbb1b6d389753f7ae22284f1da8fd0eb945d900
SHA256 89b24d213bc2c13e5ce734ccbdf6544b0f48ad1420c9598fe0b3e0104c1554ae
SHA512 d788c1a22091620b815ef7663fc1035937323526ff58e1d2dd0ae9e3901e10d66aa9b2679c75db8800736461992d46ea080767adb6741fb223ac67096befe969

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RedoConvertTo.csv

MD5 800ae7e814d6cfb74cb0e601b9abc6a1
SHA1 1cb012df8b23eca474bcb9655ca16282aa0b14c2
SHA256 776daade4c6d093dd09e83efe3616fa306abf1bf167242ccc5f8940617fcc4ef
SHA512 de7c5fc7aa044321561ba1a3ac6e896b8e03c1a577a5598ec01d65d75b76f85e07708e4054465c29354ee0b560a72c2f4b84e3f381ddbde2013c2215ca68e125

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\InstallWrite.mp3

MD5 a63c0cc80014034021f2581bda536d19
SHA1 409a7fe58db63791dfe504f2571e27c34c5cefe7
SHA256 4595e57bcc74af056ffb21e3a275c805188bb1eb93f82a055728cea77993968b
SHA512 6f2699dfe1ea4ee78f8ff4216927221f8616aa6e30f9e61356b5da204a6d08dad652902055296cbbdbac1fb9c7e17f2b4970d6a331b05e8bf7d3b162b9c2ed93

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RevokeWatch.docx

MD5 2a8b6513cf92a26616e278a960205719
SHA1 fbf61d628981bc09058a0dd9914be1d8d1a68d4a
SHA256 327f810babf06f3fe72d362b4a9d14c0ed1abd405cc4071d0bcd1e258a2441fd
SHA512 c1dfb0f4948612e3c971b8e31fa6bd622f49c8ddb350cc17f6dae56cf53d0ade46242bc54555b78d9eebe44526888e883a0349e65d3617f0b73dbeb2cb39a3cf

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\ResizeConvertTo.pdf

MD5 b4d17da5c03d1ed18e7d96ec4b8d5aee
SHA1 aab17944661a70c0e029639f155a1bd0f0f5448d
SHA256 acc6898c4694ed80235625628bb901918f6eb80c990d1cab898acb0eb1b19bce
SHA512 a01ca5aab0ca26423e2e780c6970e96232fcd33dee413ed0c49c83c55d3320a8c344acee04587d9fa3f71d74e9a135118d580f36c51e8e4bb8e0b7ee467f8972

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\UpdateJoin.xlsx

MD5 2f1b6291118a67d078f3064932e8bc88
SHA1 d74a1efa17b2e9c4e46b93e9cb41c3c6c884a80e
SHA256 4be47a2bf3b61ca956553e40f5b4c25bc139b10490f35045bf1df1368684fd15
SHA512 2b7ba74e561dbb7e8918c2a97b851e7a3a29849180b5330107a870fa53ac5ef7a18a9ed9b72a998867081c68c9043041ff5afb37fd3a094a3a7177b00f677a68

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\UpdateReset.zip

MD5 b862498bc9473da1f512879030e95f83
SHA1 0d2cf48686f86796dab59e4a8c256ad66a13acff
SHA256 cbbe9e99391f1fa87a633ac333930233ca54565ff81f3790d75a10557be18d5b
SHA512 3e330c10a03b2e250bb7ddfc9acc17e0b0d84e8dc80f660fd86e05284a268de7e7c268bb027b3f05f45c3251d74b163ff8e2488a516e692eca83c5358af8db0f

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\CopyUnregister.txt

MD5 0f46eb68626e0f13af1c7e96c4a7a20c
SHA1 425b9ac4604784c10b3e12515d4f9bc7a2e9d954
SHA256 51f4ef4c5ee1815e828b683130d6dc60900b20c6a32af08aebe988e8e255611f
SHA512 ad7991b43b5e21e6d787993f8e36c66c615639387d2289bc06654e39b4345af5f3529fd43da4ae1fe4cc3ec313876348a46776cefd31d595677826bd439ea8ee

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\RestartBackup.xlsb

MD5 ae57152752391fa694cf27519a779884
SHA1 593373c0270bb3a0a9f00ddfd161133ff4fad2d8
SHA256 bfbd33f96cb11395d8616191194bd78510d33a0f5ff188289019a5effe5fad51
SHA512 a739c228511bc11dd780b2cfe901d9a1d0ed33a3ab4809f149edf2ac924c95cafd2dcb7cb721114a7906a2740ea690dd1e28b1e56ff77f71d1ba66e9aa04ea8f

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\PushRestart.csv

MD5 261354b528b2d9a796c7ef80b4e9f671
SHA1 f1e88cc61322beb9a3caa900792278bfed27999a
SHA256 712e7c8c99103532088e7d0076968d6db21f7a0369c107f3d8bbc9f997ee38de
SHA512 057b184f8923ef4791cb1476f40048c5fdb6d393760d08170e32e94e9e72e600a7b2d2fc66994aaa03dd58ff08b928cad4e2d9cf12d34f46f5c8773a7131189b

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\RevokeConvertTo.png

MD5 e29c30f898c927935569c3fa67cdd7a3
SHA1 3eebb041911f69a3eeecc546801c5d64b96c4dd1
SHA256 f138caaadddd664d73a13e73f6bc50a951e171f8245249dd3b5d8b370e404c67
SHA512 9a429df8a3d58656e44f53e951e88ff9a65784af3c7aeab46482f05f5f6d43d386769daf974ca6c30e2867319491a596ba4f4dddb62f37fad10e505e8158a60e

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\SendConvertFrom.xls

MD5 0d7f3e870c7d83077a307ba5f67653b2
SHA1 afeeee70e05496b2b2943ab0694e4ad5fd844b3d
SHA256 b7c0715590e7b61b242765a0d75d955358b3dc129f190f335017037f04a8a10f
SHA512 170c7f43a2c0cd0308d8bdae7b57ec8e3e728bf01dc168335fd0baa70a7102f49406404968a0e18c7e0399fcc32b4bf978d3c792c55d5fb14c548894d3cc8a8a

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\SearchConvert.zip

MD5 2af9f8efeecbdd9f74dcf56f0a3ffd6d
SHA1 4d8d6c9854046d043fd8887c108755e1a77fe868
SHA256 6a26580dd46094e8f79f2df7e835f82ff34420e26af0c35c53d1e14a2216e7ea
SHA512 3f2c601dbe37d8dbf61d6fd46315d9aba75d14251f90b13e38a62f71b152e3f1ae159bad82ff0b09c3f4b611a565f99cba0c6588a5a318af30462c2296fe6f3b

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\SetRedo.jpg

MD5 3d94238fc171f7e0dc2ee7e4e268f41a
SHA1 eb0b2718c02073dd4b73fa8debbf379655b49b03
SHA256 724997db12a37bc5a21cf33db39c8c69665d6414eaabe67f360065c2c661f3af
SHA512 67e6884207be26cf14009189c80e994425d3788ee82a00da58b5c0a9c1aad548b2b14c3032e97c5ec52c29551f600c4e04f0ab526d6b8f7332935b7865c13bc3

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ShowOut.mp4

MD5 9d5014ed5a3dbbe39768a449c341521f
SHA1 aef6379b70f1a51d5cd9b2c82bfeac5f6addf0d6
SHA256 85614d71a10869758db697af8c22883021df786cbc346ee9bf303cbab46dc0a5
SHA512 c1f46bd20f1353f2955016efffaa01e9385d91840c1d0017c4451d6f8f433ab19cbd95da538489cee4d451a0c3cdb1abad9a29cfb4b59c2dfc908a19fc2ac1ff

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ImportWatch.jpg

MD5 57a8a4cfdf03731151347e293a0e708f
SHA1 75528143a19a2e0d687bcc3cb872f7c29f4e5257
SHA256 2108e23bfef95071f8e0f821d62936e5179c63f685ac080205133c1ad7812f72
SHA512 fe93b72c5e87bb4f5c690b1729c711e80b0261cb2086f1b26e293d360daee4decf6cc65ffc1e64436097a09b3fea1f766d27a07e295182eb11465a151064aa9f

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\UpdateBlock.png

MD5 fd64a369cbc02bd242283cf39090b928
SHA1 31d610066f97fc5fee7e058dfb4e3fe73ae4a894
SHA256 b72ae854a116acbd96084f2565f9e4e97902f2b86592da6f6c2c838ac20c12f6
SHA512 0d615fe54e6b9362ad359f01fe1332b2c3d59d316e9f5b5cafd791585e4f5ed64125f84394022b11160ed60c4b78b56fc280867db7896974afa5de3189473d36

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\RepairUnregister.png

MD5 394cf70d3a64f011dd6a9e38aa34ead8
SHA1 20a9895e4e5d6d23698bab5b0e46aac65fc5579c
SHA256 4d1d54efe261bff45e4c3c08ab3e6e74b9bedffd138db127b8f40a14f8cdefc3
SHA512 a6a47256581e56b27094bc45b53350c2237898565846605e8d738fbd78799c09199db0872f820571af480c837a65c78e3267930d2b2b44a23fc6e744743298c4

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\NewStep.jpeg

MD5 5c782c01c0ac815d797684f5902e9883
SHA1 f1af4bd0e37720e864128dccfb424e60ab1befb4
SHA256 810fc59057ccb0da606cc443f1f23f646d226a20491e8fa42dee00569f97778e
SHA512 711e73378ef2f25eb4034aec582884cc5e911311a24fa8d3c47508854d72af2c838ccb4a42767f69a01960e36bb38758adba619ad372cec0d5b03ad4965c6ab1

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

MD5 a51464e41d75b2aa2b00ca31ea2ce7eb
SHA1 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA256 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
SHA512 b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ConvertBlock.jpeg

MD5 7ff0f6af330891ce10636ee6c2202e64
SHA1 78a247acb6432363790a52fb3e1578770d331069
SHA256 25b2717fce2777ac3c9a7178da702a5eb7de97e207523e2f701315e30724f777
SHA512 3bf581593617316d6da0859b306765bdd80ca657d3dcc0c8c525745bf97568dbb73ef6f2724c0e2002193f4c7aacd832427f8cbdffd1c50d37f7e4c26ea6ab0b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e7713779dbc4efa46db5d94c21277b7a
SHA1 7d00ef0cb816472e69f4ee386cb974bcf4e2b3ce
SHA256 293ddca1ce3900aa8db455bbad673948043b6da3d039b3fb62b3a8944eb1c3ec
SHA512 d92c7e4f199c129041f36c704756a07584229c3a816627e1320127079a247a02c0179982df9bd2599a4a3919049e0a9ef1f0e3a3c7b1b21ec0d3cef6dcd2dad3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 44a72e78295cabca88e82108270f6cff
SHA1 dc45deb1fb33e101492ac8b8cdd3e1d6412278ab
SHA256 78412470b9e831ab2060dc5ac7c816fba7be0b0b608f709672112ea584019585
SHA512 5ee8b5477360cf72973158007ae475d3d1fcbeb602d90e14bf54966745668f0021bda0d7a40b2a57302b81ba3d7e6d00b5446c5e759019773807b1c65374a39d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 11631ddc9bcc4df0c2179f8dddc2b6e3
SHA1 65a74afabe4b1fd22d34bbe1da7bbb1b7b2ff94a
SHA256 128cce267e16657f0756d4a8627a18ad57fc1c41c156fd3c958a0cf07685ab39
SHA512 139d19fc6697b9b03889df8cb5a2c04b3e8bd3da58ec51782f8e17502a108bd66daecb36424a8edef6fbc8ae35c6fe82255d92fde708059f9b4305f753ba6817

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 5b71aa7451dfe977b0e1c764b3dcd4fa
SHA1 aa211088b34a725baa647b73ee3f446eb73bc456
SHA256 b0db1e7a7f87c4c66e33d6fb0d97aeccecb8269304fb01d0527adda4e76ecbb6
SHA512 46ecd0c5edcd5efd8259d8df04122371b3a34673b78cadf044baddfda1107b2eee0f69755b150be4dfbc766672eec6c0d41a7555780ab30c4487f4f6c0deaab6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ed5219299a3cd258f39168d6858889a1
SHA1 ee595e8835b6c041f0439e22048fbe8014386cb3
SHA256 39fa18ce2f830d2442ba63effe8399eaacad6c1560fb77b60642c766ab83990c
SHA512 3d83ef68008b2f8f974c82785d0f9ccdd1d093c0353c96fa9be4c5565fff10b6b67e19338708307799978ea991cf70249d8695498e16b8642315941ef15fab7b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6080bb98-ed56-4dd1-aee9-d6858695f7fe.tmp

MD5 b446185e0e062ca237481d5fefefe993
SHA1 150e9680b8785c28708467a7cedaf3ba2bf9762c
SHA256 432a5cae27bfc8a0e5324395f95cbd7aff9b416df1477f462d1f02dade70cba2
SHA512 92f84512fe5c56b78850823321f4d66aee1bdbeb874da9b5a86bf227c22e070ebcc64174ac3bf94ac6374a7e07b2ab5899d5cabd613c03383aeae09388e74d03

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

MD5 5ab0c2a66ed1fe87ab76702e9a3ff173
SHA1 556a492b11ebd598de7f5d3dae65d05ca3775537
SHA256 dea436fa34d73827856a329d0cd9430b885ceaef2eccb48e052b8354ef26f5fe
SHA512 b3cc04316f6a2c4e3b3b6883df3c71b3ec3794525a3eaf1ff823fe63a2c425d4fbb2ddade81dc10d4f32a4e0b10d63c8474c1454557d3bac0589eee1dfd9c7f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1ac690602b234b1e237f97bbeaa7927b
SHA1 66af125312a39be60edcd0b5a7990b64a64fc1d9
SHA256 138665f8a10f0485628de64ea5e7e076182d98782004dcbf0d741130c03b3e99
SHA512 4dd4d211754a060030a6c713fe8eb67f53bec434248af4687048a4d59fc5b5c3257e01953a7737d384aba7cc922e8f242501abb6b4054d970014733ca9d67ea6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6e09ffd7a350229b30fd354632da1038
SHA1 dd0d3b2c699c2ef66b9268a29ddeaf5ce90f6a35
SHA256 f8b31f7b82c1206e4f82da017b6cc52a6790379bb37124e125f0ed9dbd0fb540
SHA512 6b9e8adcf0cdaa9b9cc158f0855dff5620c15e1e0da5e9a6e3bdb2c474e6dedc63c0e290cab2fc9bafbac3dcad56ae169d4847ab798c61645c3425bf2ca09d32

C:\Users\Admin\Downloads\BoltFN-main.zip

MD5 c35932a99031339159abdf5982e7885c
SHA1 9dc3981eef509415034231408dd079f5ab03d85a
SHA256 a6a521e35408c363b5dd6ae6e6265fb63713f36cdef67ce580dc515c530dbdff
SHA512 9bbd4ce022cd041569b8a06b50aebf285d6a2de52e0c6bcd144722e6bc9c1e5831180ac9c0c8107b6b4eaecef4406aced38e2bfe5d73a4b10adcb578d81057b3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 562b669e61a8ba29d04151a5e027e2a7
SHA1 fb493f277c3d75cc68230dce3f927acfdda7fe67
SHA256 a1dc11967e88aa3543f46f86263f9a36a2b5da27207adc25a7601d0a21bb6608
SHA512 897a3ab9d19765ac05d171e9d5babc52f289c694cfeaad5576c8878b3f511ae1a721fa4a720390ed1640a9f90a42124a8167d756ed5e72b865ea485f2a016cdc

C:\Users\Admin\Downloads\Unconfirmed 997626.crdownload

MD5 e94bad7ed8b8a749fcf0a6288f819a72
SHA1 a005a49208d0986fd56f050f21479256014a95ea
SHA256 6627a3868c3b9b01c68297da1234e6d9c52dadd756b5c20dd6b965fdf337c16c
SHA512 5ff430a4096afb0b7f511b6ab7818bdeaaad2ec2afd8f4f6739d0552dcc7c83de8a508c617130176f9624599d6ab83a4f29d0a73deac181e5db04afa155d943b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 64b7fd9eab03c6708fe619f9437b975f
SHA1 086c477e5ea5ca3cca0509508886dc389359e998
SHA256 2a39dd90d9834a38539dfcd0dca3a86a1fe61befa98dd2d653ee4835d8595dd6
SHA512 b70cde3e91b1dc49dc18297ecd61dba3159a23c2783334dffa45d934ba675cfeecb8a895e9afd2f8bb54c4bab7b6b35f20595649cd145fa3f14487c5257bacfc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c008a4c4b3eb5452d8b8ac4f1d32498a
SHA1 ac09f0c5b5aba705613f7c686bb84072239e81a4
SHA256 f72c325de86404c9f6280315e689c1036ffd32302fb2b6268aec149c72f38f9f
SHA512 51428eb8029cf97f26636848310c36ad1cda03f6355a2f082b598b066d101670c7bd6408ba31670b2cf2f5c71871bc5b114309994e9a1c61fc38cd995e4c2a22

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 37aaa6645a7b96ab55feac143b5ed318
SHA1 1adfb71b8302de72c45f10ed0cd131a7e9ba9977
SHA256 978459e7bc2c4e4c7924c1691e7b4b67162d30557ef7c364564f04f94d12c4eb
SHA512 ddb06d0615649f3bf4d7fcbb2876fe3d7cb4ced6f2b9facf2b1d34f238639afc1dce8ab9c853342d9ae9cdedad66df65297e01e455da86cc0d9d0995e5477131

C:\Users\Admin\AppData\Local\Temp\_MEI23362\cryptography-43.0.0.dist-info\license_files\LICENSE

MD5 8c3617db4fb6fae01f1d253ab91511e4
SHA1 e442040c26cd76d1b946822caf29011a51f75d6d
SHA256 3e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb
SHA512 77a1919e380730bcce5b55d76fbffba2f95874254fad955bd2fe1de7fc0e4e25b5fdaab0feffd6f230fa5dc895f593cf8bfedf8fdc113efbd8e22fadab0b8998

C:\Users\Admin\AppData\Local\Temp\_MEI23362\cryptography-43.0.0.dist-info\license_files\LICENSE.APACHE

MD5 4e168cce331e5c827d4c2b68a6200e1b
SHA1 de33ead2bee64352544ce0aa9e410c0c44fdf7d9
SHA256 aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe
SHA512 f451048e81a49fbfa11b49de16ff46c52a8e3042d1bcc3a50aaf7712b097bed9ae9aed9149c21476c2a1e12f1583d4810a6d36569e993fe1ad3879942e5b0d52

C:\Users\Admin\AppData\Local\Temp\_MEI23362\cryptography-43.0.0.dist-info\license_files\LICENSE.BSD

MD5 5ae30ba4123bc4f2fa49aa0b0dce887b
SHA1 ea5b412c09f3b29ba1d81a61b878c5c16ffe69d8
SHA256 602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb
SHA512 ddbb20c80adbc8f4118c10d3e116a5cd6536f72077c5916d87258e155be561b89eb45c6341a1e856ec308b49a4cb4dba1408eabd6a781fbe18d6c71c32b72c41

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 cc2cadd07007c74766ecb0af8459e069
SHA1 e63aed8e85e04b485ece8e37f0411c0003e72142
SHA256 2606a5156414f8f333bf10e52fda91ce3330c2c4b1666e5382b1342f59b7e15a
SHA512 5cddaa2664e288577560399bfabe0a3cc9cff392a88b7e66650cc12f1ce4031d6458773f1844b4dba2c7cf67cdecd68f39ef35b70a1f4d1cf50aadcbf41babb2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d8040fd14ae0cfee7ec9f7df9235f7c4
SHA1 6ae535255da6935b63753ef18353957d00b79d65
SHA256 f3b9c1c1cd009222514f5cb51cbcbf709a4d33fec74c2df9d54511613a8010fd
SHA512 a006ff2757294d9170c0b44cb1a1e4e9c197f17583bef16f080ea2f952833dfda95671489281e06d075f837ea077bcf58b82543b554c2da1daeafb82a3ad4473

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

MD5 72a399553c1c481c801bd0d675da2c11
SHA1 6970dfed470aab9fe88eec7ff782d51caeceff64
SHA256 c9c49c04134fc3700f2c27eb27628e9586fae5450e831234986b290132f469df
SHA512 c4198ee945864130361e2bd60fd686894169951ef0880dffb06c896fba7ed6e1dee28afc77ca54207db396408bfc27cab6a11f9e924de97672c40edffe5904fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 67eedaab236ef553e422fee000a1ab75
SHA1 ceca9453c8f17117414a69fc989b7984cca141b8
SHA256 815a07e21aa6d8e5868a6b8b2d251fce45157670b0a3ef61f1e59b349dc11ace
SHA512 56eccefdaba969a74cc79da0021ead81a127943fca23d56b71918629578b86188e2af5fddb1ebd6a037e7b6ea2f7446d64542647c911bc231f7d9e5a16fbe698

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\daf820ba-f36d-4d0e-ba24-5ed4a4cc0d46.tmp

MD5 6a456357691377cc3ea8242869cb32c9
SHA1 464601adead5304a7256b9fca11d17b38770291e
SHA256 0aaf7d620e7b8cc8502286a1c01cd9e4dfc762d09cc9a1ccb56dd5b19b8301d3
SHA512 0353d68e01f2eb645a3fa12d06b08936139854aa21946b1ac54745c88ee9b73781f0e895044d5687e2aea9befddced054233abbc7fda81a74fece9baf54e66f1

C:\Users\Admin\Downloads\Fortnite-Checker-master.zip

MD5 3c392ce6ba749d03706fec3a723ab455
SHA1 a2656f41253ab725783a1370460d247a1c4f4954
SHA256 ce59c446e4e2af033f8a357463541ae080f4244138fe611a3702cb09482e4126
SHA512 7a16096796b9946c3b7f76d0de299142cb1b151f5b80d8570dd4e916a18dbb3de64e8da1ee31641efb937d8f6f6931437fc959c051238ba78bf92108a478f750

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 0e0341488e02398df8266a73ae75681b
SHA1 e4369ee12f08caa0860e2260acbdccd8048080bb
SHA256 3ae8fb646783c07116b9b381c46d29a5994ddc72dd4b66832a3126c4dd812048
SHA512 869327725b80f0fb3a0113afec7c7be99f61c323ece2dde38719e4a514624f63c22247aa33a47c0b420d78da7c53b40b919e0fe5159e6158767c07f345dd3d5e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 25a331618d53e7aa42ca8f6a4ad3e1d3
SHA1 a73ec39243e6a5916375cfccd98a550b74926ac7
SHA256 0ea0a1fe3eadf3a9fbd6d7e19c31266aebd21ffc72318558aa6e33f101d18bcc
SHA512 64bce8cf17fb2e55a51ab18231b95d83ee45c896f85d1af6ae6e359b88fa5c12b74ea20569b6bf7e43159c1e2bda6eef9ed6600eca4035407027b4a62aca554c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d4fbe331a9a1ec5cd971e3fdf55d67f0
SHA1 f47df21da00e7f95533c3159b02983a85123a01a
SHA256 5459cc6349854117e816ee1d81147e153208c078f0dc43e87b10629edc31207d
SHA512 d9fb597f301c1f03ac6e2e9f520221d7e3bc22a026063cb73e5cb32c5c260ded71b618ba641aabda540b03127304033d8b0a0e0ad0e6e4d410bbc85390e7c10d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6371abd4de1ed606_0

MD5 5396b34525ee7d5373a451d2f47bafaa
SHA1 673d72cbe07372360184438cbe7911f7be1e5760
SHA256 4274e37dab83d61fea42a0d3a60d0b1ef193ecd27da0c733cff8cd5a05a3425c
SHA512 f44a1aa79586b130f5b66b7e87225e276c9f2d2f3ee3e4f04fdec819ddb3785b71c254984b5e2992c14b7907ce5b91b4e24fcf6d813cfac161a041deee4107b7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f1f2de415c03917_0

MD5 3a37933435c15c56883aef86de0cc729
SHA1 d8e7ee21ba14cb0f0fabbbacc70ade79ea1fd372
SHA256 9d2a4a9fdc6474777f5d1b08ebb7cff456b819436a57d0fe872008e28bfa03aa
SHA512 a790bc3838f66a1eb86e7feeb36f58127c1eaa56e060dbd0297507956f0e2c93e5593019a3fb5087a5930e49dae94f94db783c536654df860367b5ffcf4d5fdd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74a6ca90dc8a6040_0

MD5 1f5f1db090695769455618d46d875184
SHA1 82f3cc134284143862b0d91f405bd3833e5e2708
SHA256 b347926c780028d9b52fb30f06e1c5af18129f77b81e4f48ea2eaec99e461baf
SHA512 dbdaa577cd69a662e3d4d774e3be1fa265c039ab8746a10538b8a2c25cf8cd992b958962b7d923244a8037ac51c95057efe2901f77a201aad76be67cf2590d8c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c5bcdf5c0c582076_0

MD5 10a89de6606fc539bda4efbe4018fbc0
SHA1 ee333e7b6c75d6b6f8a23c3059ab02dda2b25e0a
SHA256 5b2ccce592bab09c6119f0dc7ab6283719ee0759b0ee2a4995c0b27f6ab21270
SHA512 d0d186af52c658f53c6c23f23f1843856f3f416968eb566e183444f5ec3e90573401c4a50aca3688c719b959c3c6227d6377a5de426b659152c6e1ede4ea270f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a68c55940f346823_0

MD5 62a7ddbb45d2c3d0675955b739b6dbf4
SHA1 d901130cfbabc9a8bf9ba9b164164a507e269446
SHA256 76bcf2b3efa9c0d7c0a64272cd2bfa87614c6d8514dd22da77e3e66842f1619b
SHA512 85256adbcd3cbd41af0e1802ac1d7a035b5d26697d835c6a9288d918c60b2c6347fc98dfe81b0105e3e937b221832a0acef4c7eca4898b18a2b3a37c21cf4cfa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\462c1bf5a778e4ce_0

MD5 fed1734be33bb17b3bfa2b8037145fb9
SHA1 915b66e8b929635df69f8d4c239eb5f2679fe450
SHA256 3047170c1d494a29a2ff236caada0255dcf6c821740922b303566b7c4cbd2fe0
SHA512 9326bfe6506419f42092d33fcdcbb031949084ca500dcabf4dedd25383d246d3e735bb8d86b3038c0e1ca3e804ac505035d507a67ad832ee50908d808d985192

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3fce2772ba8b623b_0

MD5 750106829b8a7cbea1ec70eb13b94d1b
SHA1 e69dc9ca4c9d63e0d36ffb3ca34e5697ca1237ae
SHA256 e2f8a1671e8d20bbb3446d86677162088674eb5079954a3f03514aa3d1b90f0f
SHA512 e0efae2ad549c8af3e7900140e711bf79d7f8fb0ec0608f686a741b1c20a1c0552bd33065a63f48333ad1b019fe9071d4a34d1b37d967c2b7f04e84ed6e1aaa1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 950fca1579412a53a03810fba27d0ba9
SHA1 4f89d2cafe24f0de0941f1241e7a95b4ff4111dc
SHA256 90179087d9098c8b7f745976e8f3224f029f5dd0615b57234ffd3a2ded7dc263
SHA512 26a68f6748e87904cda297a0db9cb16a797ca406ec98ba93f1b31491c7ce03080df261b31848e5fe85262f380418d06fbf93b910bc3829bbd41ed5a777a0f8fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6e422ebda6b0e8d7cea799ab598fc4e6
SHA1 a384358d166d90e6591b97615987756e07225fff
SHA256 24423f2681848fcde3d61240fefc1b4983750dbd444c1a74b1d931bb0d38f5a7
SHA512 423f4e47881e4bc5b960f115a78f02ca6efc51803ba3c154f969b6a7b24beeb51c882468e555dcecb9e29af62cecdeb632a48df02c4153cc8d14ce47cc69241e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0f055a90-926b-4f25-b340-94903805c718.tmp

MD5 b04c92f315f3b126aedec4f6088ea370
SHA1 c8d8b8f9a1da4590468def7b1fc0ff7ef53cb548
SHA256 2bcff00ea6096e7b4f199a46602687fc48c560dbd20a652ecdac1e65a997f553
SHA512 f8358ef96c5240c305ed4422fd3957e669e5595be87a7ccd139ed426feb4934b3783e72ed5cdb3c133455c2106329bd9a208abe25f327503fc32cd81439b08b8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 4deb6bc713ab8113f0b35de241515a97
SHA1 ab511952044699a72bd030d2e1d0bf28766c21f8
SHA256 a5fd8c1af2abfd84208f1afd8d95482ddbbd66da404a08364e94dd2cdce7a385
SHA512 587a9930eb90ec1cf8222094f2ba690fcb83cf76de15ab12e50a5ff9ad6ab2cdc1433d5390290e1acd7a8ab3260ac76a26c4b31218a9ef66f0d97c64f0dc3b07

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 44986c2bb19c42b33af452b910388b8a
SHA1 d4ecea50ea422b6223b70abf83f7cd24046ae7a1
SHA256 2600929d7880d4c03a648e944a007eceeb68a660b97c781e603e23dc0ba275b2
SHA512 dbbd21f5a4ca3f2d4fdae8144cb5bf53f38114f5f3d14df26312de8cf550e1a3c97dbcf1a94b3297595bf2e424909564cb6e8fd0f7fd194d64125c1772cf1303

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 82a26f523559788bf4a1a3ec92843b53
SHA1 7ad1a4b5278772896d3673c2a3835cfa5693ec3b
SHA256 e684109ee746d6c60708b62ffe72820a6d1d398518c27e9d4cc1cd153f28796d
SHA512 30ea04bcaee2f53f49357cf0fd67ad28ff3453f0dd9402a58f77123eab8cb45b5b15f2f6f1f938fe8bb643798e4a34d10876b46fe8f012a31f141801d941d57d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 15bc11ac57dce132fbb43e469dc3c34c
SHA1 43fc516c42d569b7a61257410dd495396a6baa9f
SHA256 8883bd7afaaf77694e537e18a00a73566d415e8295bd24cbddbd340739489ecd
SHA512 77cecb59e6247ef94ceaaa652bf5f320c5ba7c0212b940b08d28c33f62c340282cd858790955d0dfe84b265dc80f10149aa3bd3183098de0bd9133730583d7d1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e52d364588b6ef2523662413ee725908
SHA1 77a7907a3595025dc388296cf737bdb730ba2395
SHA256 cf5adc099bb99cc7eefc2b41a85469fa93e45494b6c05181dc248a0194414a67
SHA512 9ed5b8ea709983f2e208cc197ebfa803124343c89df8e4dbb43ba2f34b4fb1e4b3da280ca657010c26d4f11c84032353165e8515c70265604df1176b012ba23f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 94f7778135645f5234fcab40e9009e2f
SHA1 bca9201bce5f33f4e658abdadd8735477f570bfa
SHA256 30dbca85306e246e79dbbf6cb1c59983f19ad4417292899a03a0f1a3ace71359
SHA512 ff3710e4c36f5b06e97cd386879d472f9c226803546fe6281af55c73dfd930e6bc7ea3d7ee08990fe5d20f0228ea1c00abed576f91e9d4025cf7c3c71eb9dfca

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 50927f7ce125442c4afb37bfc498c72f
SHA1 6c56080aa767b9389f1ee70fa54f146c62f31e34
SHA256 d1032a93933aca68f33a31cf459595fab91e153e428e7aff788bafca755ed4d9
SHA512 2a056ce2812b835910bd0717f18179b84a926d451340f4bd0f9c29fbdba4d6b503a3e082f33ca9c67e74ca50454c990ea94c5469960191d002f7d1ac9f39cb6a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9e26e808a9e90d92d18c514fc20d0926
SHA1 6c69d81dd6a104ca316206a932d3cfe74fdddd59
SHA256 17632c6dd42eb754be96a3cbe8c200ff4338d1e0d7bfb29e7bcb7233303d5a44
SHA512 be48925a46368c3a43cc666b7f84e24d962296e8925d1c08fc5d1bde7f342818d6c90f28449b3262ce60d8bdfe50abf88b940919527203a4893431c95dda8877

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 bb95a5601c1ed2c45cc1810ea4ba942d
SHA1 7fbf07149e5121de51d83aa054fb9ede41eb7984
SHA256 574245854e543640334bf783b5076f5f9411063b3bf4b8efa499c80474c1477a
SHA512 a5cdce3e2c0def1df3385db6b8f1f6d0603306b6e0b611ca33d33aba90d59b8c1c7c81a816640baf0abc197b3438d0f6bb715a94885eb51ad28cf32050420709

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 618968cb380c7114d2d6c199f0ce545b
SHA1 6f4475599597fe96d372ea7016ef5bef7dc99111
SHA256 e8cdcdaf08d63c6371b846015e4dab4170bce05db97f15e9331933a68c8a0fb8
SHA512 b360782ee42c0e4de7a0210cd89e541f07613d9de721ea120b6e1e70b80df26d114bb0a598b4f8ff6a25306be741a45e89e08316a0db1b4d6883d518b61a9944

C:\Users\Admin\Downloads\Unconfirmed 935948.crdownload

MD5 a1034a761b7df61e145590597cf4df37
SHA1 b31600c75a4f5747230dedf50270483b65275f41
SHA256 f2eefedfc4ecd411ce306cf85b923f3859b95186de1fc9e9f43272e7fc10aa05
SHA512 9e4c40886ff727d3d034d024f862231072ddece46c5345b3b9270ef6d9d08e3d0fbc40bc5155e383e8635e19cd30ea6672cbff941ad8512ec355a5a1ad16cbea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 377aecf9e8aac9d24900f97c81d9f384
SHA1 bdde56936b638d3f3370d9bc46f7ed9eeca70fdf
SHA256 06e56e1f14e1ba55082c2555a006d27f8f79717b9dc8d418de7284e6009c2a2c
SHA512 ea61521b539ad8bdb966e0b5b8db117b004981a3575af70bba2304b449f2a63b78f5cb2751739f26c0638db0fe7a31b275cf1218fc43c42a5bb5830cb74c192b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 cb2c129f19638428e35d7d55ebe0df60
SHA1 61294227dd8727b0ef0dbb93843811ed592ee7ce
SHA256 9b92f35d42c028990dd8a9db0bfde666ad6aba3f9b6e09f5c73ce7964f1912eb
SHA512 dea576bfe4ae14f72fc6fcd60de2e3befdbab5f22303f98811e6991fbf67a8cd943424ddf0d74011ba290127e38a6476bdcddbe0e7b3ad73db3b24f2dec4e5b5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 ae9ffb46e0d4b59b2754a8d702f8e2e1
SHA1 146c32fa64c4a3ed0b85b756fa17a9bacef7f9a9
SHA256 d9240ae566367a41fad98a260c5fe797581d128a53f3b78abe7035f8aabdd6a8
SHA512 99c0cad32a7a62f62807e556fcb99c18d13a1624b37f5abaa79e5c0c55d62dac05c23844b0023980110146d2c6a65a9085202742a343a3f246a8203358d9e2d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 dbbb6263e71b362fa13a70b1e81a8c39
SHA1 0deecdab2987b87c793e795f08c90fc2186f0427
SHA256 04b3ec9e7f7bf7b56db95948818806f9e82a955ebbae203aa39f47c6a6de31f2
SHA512 fdf588d6128cb2dbdf512305e6e4fcb6544c6b5ec1caec91d64980645d01357a20e1eb70099c9c1da71586f00f67e79e9192a804299f6d691535b4c225464498

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 249ae94322b93cd099e8bfaee5256136
SHA1 154ee8294d37a2db8b8c5707755e138c13a047a8
SHA256 98ee244df2cfe883eed3fa8fc95501d310566373f011be502f6dfa1a8a9487bd
SHA512 43be742552736b049f97b6b70cf5f3754d92703fb12968363b213a7e472dc9cb05c9f8032e2de650df633edc87a448c5bea2e587182fa97fbbd84d247bd3b28c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d22750a71e1ef9275179ce9f50742f47
SHA1 331c5be143bc4c45e0a44f13a106d64a27142787
SHA256 b7c033c1e75d80d6bed37ce9b4ec0e20183a5b67007feabf512d511272e27f04
SHA512 61934d26d6093c86798b3f508a629476951c23285bb54b9041a2d57eedd22a40c7c22e290f55974432625fbff9318fd3a7d4a0de54c5f7f5cc63700a13a946ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1aff53954ca20491_0

MD5 dd5e25f251fde3ff95c852ccae710159
SHA1 ccff2cc165fdad33b51322584c27c5004569c4d0
SHA256 54ee0c72d0854617a09c590046a733c9f110890757016200d2c62222d079aec1
SHA512 b5933abcb2dbdbe00bb2f1ee8b45b830bc5ab0741d1e64f79ade3bedac6a619b3fa3f314aadc3aa3fbbb14df64d0abf12443c35629ff7b39b87d56e5608dab1b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\31f49bf54dd6ee3d_0

MD5 dfba5c552fbc7fd202f5ec67fa182bb5
SHA1 73ab5da03e36f09b54e2dc42a663d458c13228df
SHA256 04460fba942de8969c4a59998b75a39dd556a9eb93b65b70366ac33f75500c40
SHA512 d5064ecb063461730645d0075636114ffce7b9b64ba608be94ec96e2e047e7d441413ed05ded599b72159edc847af8c17e2279cd2b7a290f24d0ad1574ddfb7f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b3edcefa880dd56e_0

MD5 69a360f7ca96ee7e11c7b4dadf4944be
SHA1 e0efef52b6d27faffd636e3f4d5316f056f13c4b
SHA256 e05c6434c4017ea1d328619f0da962f61afdac27a5114169a4ffad8525f1d357
SHA512 e54d38cdc32006fceeda35f9663ce12f79e55cbe71bd3272b456aabfbb32eee3a07c8ee6b594ac8f2eea083bd9718cc88492c7e5f5057e08decea4c40be9eceb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f139f229e6f0497_0

MD5 f70fa92e0ab636a860ee1b670b5bb15b
SHA1 3312fae32b96628482e8186b3c18e32c77bcfb08
SHA256 1ac4dc90175fea796bfd2cda88f652f40b5829afcb0a3fe07fb05ec209f77741
SHA512 60aa736a076a44f04ae5416d0365d3966f187796656e4aa29f7838c8639dba45a7045ca326bf1ce4bf92e8cc9670b1d2aa3e4aed74610689c1dfad66734cd25c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c91c845c83814759_0

MD5 c40ecc45639ebfcc324412c70e7158e2
SHA1 e15c79297ab0b045ee9b397367f4ec701b76f7b7
SHA256 efc80b920774f127920116b69aed9b27501a25d9bf28e00f4080c10b1ddf5e1f
SHA512 99cd0d7ebaed0173b74e4007a0581b6f0b48a9a1f39e6f2d0ae3d5444136de4c1be4462f0d25a9101994ba7ca99786fe0bb5787d8f4097f2e7c83a95f35ac062

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0

MD5 1acae79b76922b9e22ffe55bbe1f2cef
SHA1 652b82ddc9b5ff9062f2e4af9e2cce52d94c726a
SHA256 41d51ded83be29cc56cd22e885755fd60e07f33bf009559f215b2346a64fa31b
SHA512 f2a2dcc6cbd6e941645b982cac4edd7944ce86013960eccf780f802b74e01723835f85ddb1f43f7dd2758c5a98aff16a9ee7e8ff992875aa7b5149a5f1d59cd8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

MD5 e770a163233a6d28459f8352676e1513
SHA1 50732c7031f82a8fef7de05b92314e57e8f0d2b4
SHA256 606afe3442ff10db5593fbc517efaf0a5e57bd1db35fbb3536c9febfcd256471
SHA512 7cc456ebbe97cc4b9f167770687de4889fedfcd5984f43d38ba2241714a8c49dcca16bc8a82c993cb50e3269a07ecba3936205760fd148ba4b539350056b4c1c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e1427d19ff38087_0

MD5 2aee6ead9615a442b4c84be890912a7d
SHA1 bdee7d49b66f4bed4772137abc5e963e456afb0a
SHA256 8e3937fac9426e680bed491502bdd174fb65b8e6c26dbc9e1d264392971fe9b0
SHA512 06ae1fdc32a078327ace359dd5519fec2f3ee4df00eda70215ac33a56d0057cdb57dbbafa7c287acad49adb459802629aff5da0992b9d560ccdef2e10a4b6000

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a4259a0181983ba_0

MD5 3a0d6fcdfe151da2a68340d46f97fb50
SHA1 ad612faf82a836fea8b99e122f8ea57ffbab03a6
SHA256 7212c959efa83296738385f0b812a17ba214a0a0e50ab5bbfd44cb25910a1a3d
SHA512 aac9b614e7af2b321e414e4bcd160a6edc1b3577a842e92b983010cb55a5fae0dbc8c24bbb40b1029bfaea5ae18a8a3e46d77591f6dd09916c27d7875254bfde

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\84f614e304fc3754_0

MD5 e7ba50174ccf024b10b272308694f7d8
SHA1 439b61d6f98432ce0087664c8514788bad8f5eab
SHA256 8db2ada58587d07b5fc14b0574f071a3d2059d069ac5f735ff41588280838fa0
SHA512 f7d69055ca795476bc0631ecf90f03d56b0792b427362c84e465ccf8391aba1b1889c305fe550e368047b633a24eab13871433428238c110cd5cab9082861e7a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90d7d7591a1b39bb_0

MD5 512fec96e98bf16e43ea4b0e10e63551
SHA1 55305dd5c8256573bb4cb9b4e5db62935e7c3d6c
SHA256 2fe7bdc44d610e8d773e7889aee8464a4250e0c5e3f15a4faa755e0ed28083fd
SHA512 63dc1c1b1f310cc82c16ceb98e12a37501594f24bb7c8fe2c3ced33daf0e1a93307242e500749a6b792759fd11f8ee5c390ee5dc047010564349c757b3cb3864

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\782d018d3f59e184_0

MD5 99cd6dfb26741f7195618c26fb6f8bbb
SHA1 d30e5aa0cba39511b8c3dc397c16230dce4f0c2e
SHA256 70f82a4043ca11ed8c698ed48beda0991d902959dc31b3ec99973e71348c1821
SHA512 5714749e269fa46affcc4bb5e52b7e156077f14e6ccd0fb7c3ad4a97a7b1f0c31136fdbccfb191317088ba9f25f8631b7b7490e4ceedeb9f0ecaf1346d755742

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

MD5 dad219f3ad7ad062b4564b485bc61e1d
SHA1 9b5bc3de70b5446ed033921ca7572ac81b779004
SHA256 b868ea36cdda400ff6191575398d79a29c5211c7f72e08912a0e5b88a4cb42b9
SHA512 dc66eec08772c2805f8d5b48f6f55f61ae8d0c6c2d7bff9c4b4e83d4f6d7f6c91cd968ac4f98a141f284bcbfd5f786ec0b1f70414a24695dea25420ac645bfcb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

MD5 79d87a71c983f81798f15f37e36f8d48
SHA1 2ca8e1af8e4c112c65610db802745b075ab19db9
SHA256 323bf2949f99546fe5ed5cbcb326536fe612bebc5eb4b0f9e965182af0034786
SHA512 f3dfe910ea6a3da46d851b4dcb03f516382e453165a43f5f4c9c488b1dd8975ec1d6730990afb8522ad713eee33d27e6d9b8bc3760a08815a456cb7ef980151d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be6d12311ce2b399_0

MD5 a1c46ff66ae12f308b362f56c3121f01
SHA1 e446ce58659fe17b91ec85cc605b0b913a4a7cf8
SHA256 ae41ba0608a14d0c867ca8e5f5376b9a80b3442f8e50ca75e6fa545fedac69aa
SHA512 b3c616b5d3001c41fd091c66eb8608e08105f289ca119ee16044e379a85242643f113f80e304acca80bd8b5aa9d79bd6b22e2c4076e6f8b284a315f55ec31b9c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

MD5 11f6108292ce5ee0337b7f04919eeaf9
SHA1 c0460189cb6ed89cd0cf50546e5d963d7ffe313e
SHA256 a897f06d0fbaeb26847fac4f25e081179fa4fdade2f0d738fd0143c77cac3f1d
SHA512 50b6e2ae93c4b5a9e6bd2fd19b4c92c02882b8d7614e6d971737d4796d943733eb379ceaabd2d7e9b26f29366788f075aefc79e0c8bc9bd2ec6441e8bb3d99d5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

MD5 8b35ece54d4fb4b8196db1557cf040f0
SHA1 5b16890513d3a3db5db3a1c19de7d5d32665c542
SHA256 83cb3a5825b04595e7632c67fcf508adff99df84a4195ca258c55ba2db4a4021
SHA512 f305b4a1da0aff17d4b3a87c88994023b175774a841decd7d20d36bde166e61ce9cb2579dc69e17ff430725ac46f72217b062b2a7bb86269c8ea2673fea1cd04

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b1d693ac0f52716b_0

MD5 3eefc38abe0bba3c3e3a6f461cc94d98
SHA1 b4d8b0dcc84db355e7f339c7d8e0ef0e6e2e6c6a
SHA256 c3046da38ec05053e198c07d522c318cf62b524bcef3d7fdd73ba87472f856cb
SHA512 280a83a22cd9d6b70fc8b929c149ada92653ad9f2f70c5a6a4b390c9e1f7f47fabd9675855ea4d088d6087675aecd084351c6f23cdb41750670f46ac5255433d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71d68e68ea4089fe_0

MD5 5ea40bda4e39c1a94b2e1b9bcd09263a
SHA1 90fc4cd85c16094b04a090bb298902ec0476d876
SHA256 d6a27063bed43e590ef6f5fb3ab2c9b5f9d6596a6274d1826c1ee0d480f19b7f
SHA512 9c3d3958798e86722b6f0d8744539a29fb9f80148434a644ab9a419d3ec430abb02ebb3e7753b8fc96cfe55358f25c8993a4a10514e68f510ede2ff8cd06fba9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5dd1e579c9681f95_0

MD5 b559f05b8971a3720bf26bfc0dcac8b6
SHA1 327431586d0e621e69d72954fc4d56d7579c380e
SHA256 ff8b58fa4dc99518dc9b50ccf85c9cffec4b3709783ec7ff8cfa25ddd5309a3a
SHA512 33b1a8c1471981045ca9ab5d701130c2e97868f0bf4358cb2bae1ea439ac3f18e91add42392b0520b7261217f81b2ab5a7f758a6c2caf94e31b2c29dd720d701

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e55f0a6d1b533c66_0

MD5 92ac74cce4b0601155c2c7432d06f22e
SHA1 4fe3e8b4f5fdbbaed963bbbf8467ed76d08812dd
SHA256 14c681e650bc104d0efbdea173c14a1478ee00073bd316ba005bcc379533e6f7
SHA512 d058b9bcae01c82362edc166cdf94a497193391ad80bee681781abdebcb6acacf1171de2a40b69847feb96b07231a84668d2c6fc83b4276e065aaff89e107860

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

MD5 a5b4aa8815e0d9db3c091414b516e3f0
SHA1 120b7dc26484515d955f8d541a4f31877c4c77dc
SHA256 8e0384881679a648cfb1c0658f629eccbab2c413e6121cfc681b0404819b3cb2
SHA512 ba95acbc5342690d7b9e3a00f7489123faa88a1cc95e4ec1ea9afe0e99f9b92be97b19ec2a2243eafb6e8b82bc48bd82bcc1c31e45e6d6b06e6ca8a30872193e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f4680e8f8f8a14f_0

MD5 48740fc72b2628f87a5cbcfcc29fab78
SHA1 c53fdda9dfbcb9653fc99efab68ed1eaa7abbde7
SHA256 4842de83a7a2291d5d873855193e808313cd4d5580854eaf95b0b7ea462e7f62
SHA512 d0d6a79734be7b8a440951a178eb1c7147e8a65b5c431029c0b178e7abfaae0bca33bb6fd4700fcb1ee997ea4a6ebf80da188a250538e8d9d16417d2f95fca7f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5ead99438b54ec95_0

MD5 d41f2b36addd1606c2ddbba21c0bb689
SHA1 4191f330121e6ffd063d78a686e0ee60387fb59e
SHA256 749e3794419c8b556038c0f88bab321f38b6f3b5728e518bdabf9ae6177dcce2
SHA512 1c216a1058a57c8c3f9f448519885a49cc85f19a6b5d3236bc215fb2071c8b491185d1ed7f68e9e29927c8b6fd323e836a8c4856690275185b0b698fa65873be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d79e0a2891fc014a_0

MD5 fbe26f6cf3c6a4cf8fb794e06550520f
SHA1 a6987b832c425c78c758fc18bb16dfe6477fb22e
SHA256 e2493b45618e8ebbb0827db041158f8484ab89fc4125ed7dcbd6542279d57917
SHA512 cab6d36fa2c0b965e7a891de4603fd822b5b106ce1d75161dee9962c6e4d6bc5a10cb9911ab3cc5d908154a33ab368130603052ef3233dee3a0270ce4ae3f592

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9c7e700cc3e33cf_0

MD5 be2e37dcd5152aeae995030d8ea0fea9
SHA1 4e8f2a5fe840bd5e93f5bf68a9d6cdded02d84d4
SHA256 3d2a1c242324603b1b268f2efcceabe37876ccb51f80bc59c7916f9235174d8d
SHA512 f39587e5adb481389eb0ab26b58f0bedb46c1094007873dbe9a791c2eb0e110188950ba746b86300a0d3cde0b17e19a0b845af56ccd527a5f52b320e7fb1932b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e146fd968644d345_0

MD5 866ae9e06c8f0ad1622835f44619d5f7
SHA1 7ce6890009089b3b30b547e6c65598c45fc1591c
SHA256 6640a3d1ae402d483060014e1933d2d84feb20afdae5933f789adce1faa4223c
SHA512 86cd81a7d1605833f07eeb4c8f57a23afbcfb71c64bd7e20b86cf2d179ae7248509d21d542b4773baafdd0b9f2249a8aeceec6dbecbee7e66176274a99586ef1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\766094f4b47e839c_0

MD5 e78bddf1734b3cf2cfaa48428b107f91
SHA1 f1d0a0b88b81792f463ea7603224ad4d31b0c012
SHA256 c5067108638b56877ad8a46578cfe0f95cdd7bb296aae75809c2d2395ab7bef7
SHA512 42d486b69834b1a90604f97d59a7c047a65d7dc4b653e4bdf5277534a9d9ff888510f9733437c6ccd8eb0390bd279a0fc65512556022ac11cb8441651aad6082

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9dbb949d27873cbc_0

MD5 2cd11efc1b2a3457f41c391945b44c87
SHA1 c1c1da5cc0d1eefc5e88b3c9cd151796bfa93cd7
SHA256 4a0c89c0935bd74c2fc1f77063ac1482db0478e933136a324c07efe082cfba7f
SHA512 badb5342189eb38a691faaccb8b817fe05b6295e67494ef31e731ccd6a26f4a9df3317e35a6dbb450e455d1ccf0a4cdc81da81248bade0b37228ad972d5c5b73

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9ba0d3d1ac7bd8dd_0

MD5 8065a2ad5a71b121ab24c392a9cbf489
SHA1 65f4893152a9bef68ee4f851798ede2120e32d1a
SHA256 6a58df305fed66a730eb4e2315a70ebf95196b745914d2f9dc2349dd39d2281b
SHA512 635e812b751bb95bf8163941f57ba5c0f02fe6814cb2a1a92fb9f824d3997a58979f5c7cea622ad578fb83184d0242cfb163b867805651b9bb839b9af2e8a001

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7d07dc3a67fdc3b2_0

MD5 eb6ab6a33219054bb0e725d7d3c16e82
SHA1 6bb12c24199f67437eec30314aacb6eade4eca10
SHA256 921c114549a73826b4d3556632a3a8c3d52cda1715c74f6c366d073e852f44c4
SHA512 f8381239b1b207a393bd23c615d138bd882eaf0c4fca087bb271d5666e8079df7a5e071244387ef711d563d3d80a482883cb19c060708f6b2f16f01bf85f785e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\478c519de6dea736_0

MD5 ad1febee98d6945742d716dbb3054bf2
SHA1 ec51d5cbd7ee3c0b3a7397d08c3444c167db516f
SHA256 24d97e1d8421980e9175087681be21200885830cc47d678f38c87b7c82023dc7
SHA512 e613da78b58b88dbf1cdf6920057c0d9c87cc92a1453905cac24811489da046f651b3eda3589e3a39e8c01d3cebd7f1b9fc397ae6cde6436c4be6c8c5de2a272

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3fd2be14abb3904c_0

MD5 6def45aaa01e191cea1be01e3a4b4b87
SHA1 eec735a300a31df9421634d28da482840f63676a
SHA256 360befb050e85f888b5112bf3412c8219b90c2d0fe4d178b1a1c3a9f3edafa1f
SHA512 20090c34dfca4b9b2bd87ebdbe3a36a8e6ff17f972f27350da21ce5395df9a12cce8895e93f2585295f0a4db36f2b4dc557b4c3aacaa45e5898e83d6322e2306

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e9b18b0f66a7183_0

MD5 6c1d591dc5de3e7dd311074f494f0dd8
SHA1 07c4f513cb93273406b29f7b1ddb676b3a814ad9
SHA256 50ddf40ff6c0ac01f0823df2e7c80485b71846cdd99c0cd028faf4ef094ffe76
SHA512 3f58b2c7afecae58010b078dde128e1a656899fda1b51a1f8ed005a101f7ad1935a66e3fc815ea32b9c60d7e41ed2cc7795e32354751e5701a48719a3e5ae833

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a5e8bb53a565b9f_0

MD5 c28081d1fd276a87b568250c2bc3f27b
SHA1 fcd04fd38383f660c46850127c6074d168460168
SHA256 2dbe08ec262787fada51f7359c467e52603f3e0847d894dfe298b4e27f6916c0
SHA512 5edfabc4c17cd34f52f4475d2f07c1af4001ea6c65f7ef35fa78532e2750cbf9f4b8f8b64427bf82fa58f3e1df083a5911db81655f0a64326cd196cb036d9499

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e06c2d3883f09c50_0

MD5 9025cc1723c12fd0cccbe3ccdea3d4e5
SHA1 86ab15b08ab5f192b896aca76c6f28f7f39d5ab5
SHA256 07587b8748cdc4622f665b0267845819d11f475067e822cc1fcd34a871328cf7
SHA512 639b66306ee89a90df0b2ccfea36f7f9decb34a7f27c4ffc59942e8d4ccfa91232ddaac2f3f228ec8c1257379b50e264da0582030c6188e4f2caece630a8a43c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ccbd22a91d9015e4_0

MD5 7ff909f3f47a5d87c9c59aabb221e0b7
SHA1 5f02ebbbee0abcc9f021bb6fd18c10228830b4cc
SHA256 36427ac1013a9e22cf9439332b476fbeb77bc35775a7119fd9e2edcc7fbfcfd5
SHA512 c649850deee01aa876a3cbae67bb9df411861e13636b8ee9aa74a2f3de656d19df51c2310b74911b915fe5b909228ad6b7f738804b687fa6ab4f9e856fc3025f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7e74f21ec4231362_0

MD5 d0243aa093f7df987722d389c2ef40fe
SHA1 9e5dbdce28dea4dd7641d1e2739422512bad16e6
SHA256 0ce5043d4bd97d7b95fc20f40b56b51e163a81c5c932ede9e8c1d21ccdb1e31b
SHA512 ae66d83ce4463b6ab220b56f341ed2bc0b41614a4a4ea76ec43444349e29617b5010a7f5d15b462193997645134540e582042fec7673bbe18dd22a229f8c40bf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9602585dd7685ad_0

MD5 393583745c35e69778363a9b952c7cfb
SHA1 7074eed306530529eb698b633c78be19cd17f1ca
SHA256 d1e60cee6ebd96ba21d564f4877f49b0c4f3250168bb380ce629fec4a689b346
SHA512 1363b6c722267f313279249c9ae02f7a535f21a49d6deeea7fe953e7c9638bcbc1df69f772c6f18699c3931b3bd218f76deb52fcf781cb1a3fd06310c6aee832

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5b0f71fcce6ad311_0

MD5 14c77283f7f2f312f67b669e9b9c496c
SHA1 6b6a506d956fc98b2420de8bbc5671a190fbd36d
SHA256 e14e9de25d49e98cac1d7c9f6d0f2dd9aa50f32fee1b52ff6cd3cfaca055f3d2
SHA512 8b44a7bf9519b768531561aeb30602892b084274a54149c1fad55cb26194180e277f6343604330a1c6e9c4f7bd1c7145f0f52ea5a042c2a808c47e822d744a1a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7c3094013c730abf_0

MD5 496b2967ba97ba1823580956844b40b6
SHA1 01a4bef6a514d3d288f1c5348344fc650b2c60be
SHA256 d4f1eaea141077885e272b75634e8c4a07a25b902176f788902c873f24d70d1c
SHA512 70801b679022efde4dc96d7d0d965cc8e5aaddec8c2bb1bf17fd5682e85b7457c5aabd2409ffabd9dca44802cb0cc552aa6792a87a8cf0c002a700cc3a552a14

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5afebdcaff027cb3_0

MD5 d092a8d4002693e98a050022e9ae944e
SHA1 0509d0a9ed22fee4b1c20359303e7a96d59e44db
SHA256 ec65bae9624cd21a313d9c9eb757eb3a9c85c4094c52e905b8b9452623392c54
SHA512 496cb5da6f7e1d9d65cbc069d7ca1fb317136d27d317a3641acf1499c696b8aa5168c9e5eab50de2229051d268ad54d4905a9150b52b8cba9498e144f6828157

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0ceb49e44acf34b3_0

MD5 4cef58459828019a8858d71817769ce4
SHA1 cf58b0230086e473c7cf83bb2707ea9750e98a3e
SHA256 2921e393a0db71f48c02aaacb810716a9bdb062a77a97691d44b851339f9d7d0
SHA512 178cbe49f796e69a28b14b9433af18df5d7b3f680d5640f765eff2a045da8b40738ff6c27693128b60f5bef2854f894b94a321a12cf21e9557ff94162d11ba37

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\921ea136d0de1c32_0

MD5 620f5d23dc98c2226ae5ecb5414aa47e
SHA1 39556014ecafce799260d56feccc3ea3b8c1763f
SHA256 1af91bdedda46e57be4fd4f6d8564377ce0afa7f81822101ca2fef428bae1ed9
SHA512 38fdf931a46a552bcdc136053739edb33b40245986105d6d5e2abc6838b7d18f27087080abfe45952cc5686d30bb9b3b7935b79b35dc4e648e4e684f3f2414dc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6857c7c71c420e16_0

MD5 2a5726974e0e5c01ec46ddbce574ecc5
SHA1 9b9ddcedbd767e2b208ee9d1fcf4cc51d07c0cd4
SHA256 dc198df6332fee9261f297a13e05e0994560ea110fc1c7f27ec71bafefdfc785
SHA512 ed5bd454e55089296975f3f32a5338646bd698426cfa97b922560ee22490811beae21588633a20737f2f09c73eb7f1dc1d8d111d4998beac5254db309d624bbd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2d0a297f59d7c0fa_0

MD5 8b405753525fde086507ee97a2130c50
SHA1 1c9cff973f02ff4839e3e169766d5bdc58107e2e
SHA256 c4c89d6526d2ba48810660983a9bac1594f747c9c69202f10e5a8c90e9234b54
SHA512 3443af7b4311a0897a2364c1b432f730d9fbd7a6418c9ed3fa74fe704ce321f3f074258f44c481e3dea1b20aa9dcf7a3f9b08d7d8bc8c6f0aa39f4029f8a2a6c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f299668f7f337ff0_0

MD5 a986d6f3b6ea1097c1083cedc08311cd
SHA1 2577ec1d524945946d41fdf91df6bcbf8f042258
SHA256 957508f2c51918ade69ca3bfe44167e7eaf3010bd0699b9988183fe6910b5653
SHA512 06c84a99e133fe8ec2c1bb3c536fb9e84fbf8cd74fe79b04edae79eef03423bf40ac8c5dc6d570d3a1faafadb35129bc2f27419c89ea84a2baf2c77b26804158

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\950822ca8a0f3b0d_0

MD5 88fe35f1c1311c6a146314f1d989bfff
SHA1 1ce5b231bc4a3d856ac6454eee16a1a339d51eb9
SHA256 180de94f88d01b4e7fd8042986eccdc2b644393138cf521a9dc11e121a28c33a
SHA512 445f9e322a7db8b10492bf18c2c7abbbaf2dc70f70dd8d51055a7bd58f2ba729334a1d8252805f4b11f63008c0008e1c64c8cb1c9ae31a48e0a6a3e5585acce9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\88959886ada0ac83_0

MD5 48c40110c00a78d8513d1f9024cf2155
SHA1 f3c8c6311f64e3d0a6df1beb9238d39500812517
SHA256 662cbb520636952c9b189c8051f8d63f2e132355f355f57c3da0b3a2d708b9f3
SHA512 0337eed442205822aeb3d86749970d02cc8966e35f44ad135cf7abe0777c5cece8545637caddc4bc0fc5047878317b522da93abd89b0ffbed1f2050cc72dc468

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\47149abbb223ce62_0

MD5 cf923cb7335bccc9bc0dac11bd5e6e18
SHA1 852e1b7c8f4144187014f266ca8f443f69f8a28f
SHA256 7e19ea2ee5de8ce534c181859690362252f7f22a1deab3f3bdbf861e5ec5db00
SHA512 23a5571c127756adf503ba35ca54d1c1ef0b65d6366a1dbb3ff555a29b931bb92eb8bd26bac2f3dd62e8a6c28045c05de7af663519a68f7ff19b2096eaa26d2a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cf93877435dd915c_0

MD5 2db2922deb8656421fa869ae2f2040c4
SHA1 e7345315bac9138e40e958ee1847cbf60551f44d
SHA256 a04487a9b8421be3bde18b00df34eec524a2bc31a18b323e225ee20f5d36419e
SHA512 ec4f16ea3ac65630cc132b56428440e1af59dc92d4c289a388f1917ab813d69393d604fc00880b38074e237ee524762961b466cc926eb5e1af5f579737789a43

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 67cf649f24467e7b443a7dfcb11fdede
SHA1 318fc433fbb2c26d0a29591a75c24b01fb0e4722
SHA256 08ea6e969e842ecfd50fa60e7e32c5e1a3e2f7e29786d31f48ae395d610a464b
SHA512 70cb24d2490eab9351f32cacc6428a3985753748a1de10dfeaee4cf541a90127008ac19cf83ecd8cae786e374b6a9d51ba70e2732e63cd4644dae981d867bee1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d5631bf79d25efb77109f489d8e00ac5
SHA1 edcece80ac470a1d82719c761d3760b9d688ce97
SHA256 e03c5c110925cf6a3797eecf96c296308d630bd84697563f5ff76cc3dc4d3699
SHA512 b35536383ff74d81db9cf57e05b23921f4864dc2b0988be1709d6ffa312b39a9c5b8f06b3216fa6f3b4084aab27fad06a218d65002d26dd90c8839a620fa6f04

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 7381efe9cf602223ed4823b17486d923
SHA1 1bdf8c2f821e9716fcf93d1b7ce6659d10cc3dbf
SHA256 07ba7249be2cd60bcdfb3d9b7318acf268279ba1ea2cd24225d5aab05e219cd6
SHA512 41dabc4a6b1ff38d0a1b2094246342039e180f1199ac631b3200137eb42c3e62070891c704e20516fd4c362b2283ffce7919818fd94ebb45aaa680c78421cb0a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1b28bf9dee0973b4a7293d629306a4a8
SHA1 23a1a400c72ae605276e3f766def3b8ab5d37cd5
SHA256 f5556852911c017d4f237708004ef2e3b9150158e6d65bcb175d5e2c3947e2c4
SHA512 04886d33a333a560e7cde1dec47392e0bb8feb6fb6a4ec3a9c750d328727caac6e46b951d7d995d4c187b49dba2a1da56a895ece0f81b4006d5663f13dfebbb2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0823bdad7050097f92e6e1ae8d749a6a
SHA1 a8a80598fb8c89465402452dc2f7f511a7dd3e8b
SHA256 a3fd75bd68a4d75d46a65fb7fdd4b9a83bf6100b4db4c9735c90e7119de840f4
SHA512 4996f65a99715739deb4e197c72b6b7444cffa5af7a8321c3d9ca634bc718c15b4ab9ce3de50687444ab98814682be3aea60b7ef5c0848b999cd86004897c57a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a05e3b07833241f9a561f2bddbfb8d29
SHA1 9f22289795031b093a04de4667d46a7b6d92a962
SHA256 984cffaa939f22f23803f8b2667f4a729813f666a9fdec60ba7226beeb127b5a
SHA512 ba627cc6367f78eb9cb2473961a65f35fbfb014b997a7c9b343bf13a36103b48c2570e266d342877dccdf1917be104aefcbec41f991a00b73c4b98edd2fd8c73

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2cf41d4ccb5bedb1347e5ddc59c61d0c
SHA1 8394fd03a5c0e62a8e07a23af128d5be36d9d4b6
SHA256 f4f7841b40a5118bcdc31e7aff6400ae3d66b8be01ca8514655d75ea8a09374b
SHA512 35c17d8271a9a92000fa764a53b505f22150a87a3987fa35030fc627c8b641bb84a8555c36e63a10b679357d1a3e09384241aa946d7440025aed3159bdcdd796

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 94638a3164edfc64d6d9ba09744f5231
SHA1 d695ca6e5331001539b54e8cdbb91d7581bb5d37
SHA256 b8f81dec3c93ff65a6301dadcf6c53c30cd818e3e83872959b0c9b998655c1de
SHA512 f51d6370762d0d931866f6d74aea4144eae0d9419ef8cc3cb57f5546c7ffcd8bb82e72191a8ba53a067efe7546fb28069855eb45c24a8b9dc9b7cccdabba5f81

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 07049b7f1695b29d9cfba610373a6132
SHA1 6da6137dc5166eb45643e00a6bc7fe975db475b4
SHA256 856f2be6f10ceeb15ae1b31536b47206c5b3f8ddf1697fd5f5c054a9f29bee34
SHA512 d7cb0dd709e0e88cd3ab2441bcf37aa0d04fa1f4be3fdf1da8a041179d49b5de784aa25238d8d30807a4a547c9a0331b3bd5de7a6e907c38055bfd6420fc066a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000ba

MD5 50844df75dd48cf9b240fb381bdb0542
SHA1 02ea5307e287d1c1e6456f0e474921b4a75ef05d
SHA256 40de8ee148f2c5f406a8aaa41d1fdf9af93627b14f91b125e9941d9ff7329250
SHA512 2e48ef1bb63511341bd83955874dc6d0b3f47af0517e192d3fd0743b26aa0c6361005e1d9a6c655afd62f849dc29389673ad2bcbed856c77944bbd2b4fc7ada3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 60325180013604307736df759b311828
SHA1 054ba18ca5774ed2837479a192edd4e6b26840e1
SHA256 20f87a963f5f3d1541afa2523338116749776963d0e58ecfc6a59f5b1c1013f4
SHA512 55f23a9b65ad7b4c6f6ffac2499f9d6d4c92b05851a176d13aa9a65a76b1ae415436796731f463ae3ac63e11f7b84e3e82f56927c104d8201e4e9d210365ca18

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7e3b72bd9f600bbb15d9373a8014c7b2
SHA1 6d424b43d2f568c28e1da65a6b69056ff27af374
SHA256 5e599f6064bded0144aff0733b3f52df744728f1a2d699fd16ba90d0535aeba3
SHA512 1d10993a2f9485507cd8e726cfcae22d1ecc8104062c590437f1358883cf061af9bb14735e6f21517c9b0114cacf464e6102f87c8d5e1dbbff8b97c11ae39c90

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000bb

MD5 cba911ff505a480171bff3fb24aa1edb
SHA1 df89138a5ccc811c5fb4f6ff09da1a01019cbb5b
SHA256 97d34780d853e1894d215e2b9555943232193eaf8eb971f3010d1ccc9f1bd2b6
SHA512 bef008679a95c67569d515b8f161452289d81f5cb00012eec719119861c6c00486a82f9c4e3c323558c4687f17b4e4793ed425c4bf37003990818071d9ed935d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 84bffe6295fc2c6b569e07050876dc3b
SHA1 8f99120f637635c149d7e492c4a3a3b7400579b0
SHA256 6fd3412fca52e058948eb70aa2f8be9ac6b6690046414415938641f7d58244cd
SHA512 273daf0731b19f337d93f654fb9a24cb6276f281b7f9f4c0bec501ac5734fb698a4e6718c9bdd74c5b8a44028a63a1721f12b66472bd882f4ad432fcf7db9355

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 64db0963476a5484113472df4d2368fc
SHA1 039af56cd2fae5db88212077ab9d0af6674d107d
SHA256 687d9c39b810f6f51efba3fd4895fe89eaac0ba46b90de1f68444fc6b42e8812
SHA512 332b2e205251e858e89b8d376ba117a9718f6c7d2d15be50f301c5afe1f8c5db4795afe2cec24774fb6a21cd0b64a48be44914ed42c2eae292a262b1779777ae

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 72d9b0f9703a827541f673070a4d3c70
SHA1 0b41d0225e2726b21e05311b6e3169880b3188b3
SHA256 bc51a87a94b6aa3cc9df66d7ce9fccd2b0eabaf4e0d7cd53e86faf4a4b7063c4
SHA512 876715cf07c5dba842e93f69d7546fa0efafab31179097342524876ca0f8099fe1255f19092dbf6239cd7fa004d33aad13451d05be6a96163abc879fc70abf0f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 af5e232671e27a01cfd667809c3702e3
SHA1 50046d9aedb8de4d8a47b6e33563a27ed80de683
SHA256 604f2f16c6467bd4dd176114ba0135e8fe5d7034fbff32b46eb5e5fd71224e5b
SHA512 37627a529bf5e8e76bf74af497aeb8210b3d25c8dc3f37e1ca6ab1ace58dc5dd58d332be247a73f3f5e3472a4d87f688d42686d6dcf40ad4de66ed37311c92b5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 8ba8fabfaa6c7a8e95a8d4072beb9187
SHA1 c625cb725759aa3084889c1f34adad260883a770
SHA256 6c425d6bcb903ca5c55783d0134b4d6bb345254bf5bb2d5cdffc559f4aebc050
SHA512 735ef38b550accd38fdd0c44046c685901500afffbd6a3bddaf7cbfe4b29a0454d3a7ac9d1269de2d2b252c745efa55f719f3c60171a05e2cfa21e6ee512f5ad