Malware Analysis Report

2025-03-14 21:44

Sample ID 250125-qy3jqsvmgx
Target CG_Loader.exe
SHA256 91b99f2ebbabad81a8804730e9671329bd79d4b5ccbbb22c4da2eb365da2c68c
Tags
defense_evasion discovery execution persistence privilege_escalation upx
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

91b99f2ebbabad81a8804730e9671329bd79d4b5ccbbb22c4da2eb365da2c68c

Threat Level: Likely malicious

The file CG_Loader.exe was found to be: Likely malicious.

Malicious Activity Summary

defense_evasion discovery execution persistence privilege_escalation upx

Drops file in Drivers directory

Modifies Windows Firewall

Stops running service(s)

Sets service image path in registry

Loads dropped DLL

Executes dropped EXE

Deletes itself

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Hide Artifacts: Hidden Files and Directories

UPX packed file

Drops file in Windows directory

Drops file in Program Files directory

Launches sc.exe

Program crash

Enumerates physical storage devices

Unsigned PE

Browser Information Discovery

System Location Discovery: System Language Discovery

Event Triggered Execution: Netsh Helper DLL

Kills process with taskkill

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Gathers network information

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SetWindowsHookEx

Modifies registry class

Views/modifies file attributes

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-25 13:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-25 13:41

Reported

2025-01-25 13:46

Platform

win10ltsc2021-20250113-en

Max time kernel

259s

Max time network

268s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\Drivers\srvsnd.sys C:\Windows\D53A22A6.dll N/A
File created C:\Windows\system32\drivers\etc\hosts.ics C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\SysWOW64\cmd.exe N/A

Modifies Windows Firewall

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\srvsnd\ImagePath = "\\SystemRoot\\system32\\drivers\\srvsnd.sys" C:\Windows\D53A22A6.dll N/A

Stops running service(s)

defense_evasion execution

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\Control Panel\International\Geo\Nation C:\D53A22A6\m2jfb0ts.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A href.li N/A N/A
N/A href.li N/A N/A
N/A href.li N/A N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\eaa3a6d1-cdec-4460-87a2-a37011c5a65f.tmp C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250125134217.pma C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\D53A22A6.dll C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\D53A22A6\D53A22A6\HaydiRastGeleBot.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\D53A22A6\D53A22A6\HaydiRastGeleBot.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\D53A22A6.dll N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ipconfig.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\D53A22A6\m2jfb0ts.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\D53A22A6.dll N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\D53A22A6.dll N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\D53A22A6.dll N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Kills process with taskkill

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\a6223ad5 C:\Windows\D53A22A6.dll N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\a6223ad5 C:\Windows\D53A22A6.dll N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\a6223ad5 C:\Windows\D53A22A6.dll N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\a6223ad5 C:\Windows\D53A22A6.dll N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\a6223ad5 C:\Windows\D53A22A6.dll N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\a6223ad5 C:\Windows\D53A22A6.dll N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\a6223ad5 C:\Windows\D53A22A6.dll N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\a6223ad5 C:\Windows\D53A22A6.dll N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\a6223ad5 C:\Windows\D53A22A6.dll N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\D53A22A6.dll N/A
N/A N/A N/A N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeSecurityPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeSystemtimePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeBackupPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeRestorePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeShutdownPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeDebugPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeUndockPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeManageVolumePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeImpersonatePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: 33 N/A C:\Windows\D53A22A6.dll N/A
Token: 34 N/A C:\Windows\D53A22A6.dll N/A
Token: 35 N/A C:\Windows\D53A22A6.dll N/A
Token: 36 N/A C:\Windows\D53A22A6.dll N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeSecurityPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeSystemtimePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeBackupPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeRestorePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeShutdownPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeDebugPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeUndockPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeManageVolumePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeImpersonatePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: 33 N/A C:\Windows\D53A22A6.dll N/A
Token: 34 N/A C:\Windows\D53A22A6.dll N/A
Token: 35 N/A C:\Windows\D53A22A6.dll N/A
Token: 36 N/A C:\Windows\D53A22A6.dll N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeSecurityPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeSystemtimePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeBackupPrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeRestorePrivilege N/A C:\Windows\D53A22A6.dll N/A
Token: SeShutdownPrivilege N/A C:\Windows\D53A22A6.dll N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\D53A22A6.dll N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4812 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 4812 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 4812 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 4976 wrote to memory of 3016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4976 wrote to memory of 3016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4976 wrote to memory of 3016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4976 wrote to memory of 3524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4976 wrote to memory of 3524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4976 wrote to memory of 3524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4812 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe
PID 4812 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe
PID 4812 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe
PID 4112 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe C:\Windows\SysWOW64\cmd.exe
PID 4112 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe C:\Windows\SysWOW64\cmd.exe
PID 4112 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe C:\Windows\SysWOW64\cmd.exe
PID 4112 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe C:\Windows\SysWOW64\cmd.exe
PID 4112 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe C:\Windows\SysWOW64\cmd.exe
PID 4112 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe C:\Windows\SysWOW64\cmd.exe
PID 4112 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe C:\Windows\SysWOW64\cmd.exe
PID 4112 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe C:\Windows\SysWOW64\cmd.exe
PID 4112 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe C:\Windows\SysWOW64\cmd.exe
PID 4260 wrote to memory of 3116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4260 wrote to memory of 3116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4260 wrote to memory of 3116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4260 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4260 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4260 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4908 wrote to memory of 2988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 2988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 2988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 4840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4908 wrote to memory of 4840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4908 wrote to memory of 4840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4700 wrote to memory of 4804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4700 wrote to memory of 4804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4700 wrote to memory of 4804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4700 wrote to memory of 4432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4700 wrote to memory of 4432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4700 wrote to memory of 4432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4700 wrote to memory of 2200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4700 wrote to memory of 2200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4700 wrote to memory of 2200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4700 wrote to memory of 4056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4700 wrote to memory of 4056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4700 wrote to memory of 4056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4908 wrote to memory of 1336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 1336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 1336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 5096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 5096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 5096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4112 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe C:\Windows\SysWOW64\cmd.exe
PID 4112 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe C:\Windows\SysWOW64\cmd.exe
PID 4112 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Views/modifies file attributes

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe

"C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|taskkill /F /IM D53A22A6.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM D53A22A6.exe

C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe

"C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|taskkill /F /IM CG_Loader.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P everyone:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|attrib -h -s -a C:\CG_Files & echo|RD /S /Q C:\CG_Files & echo|DEL /F /Q /A C:\CG_Files

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM CG_Loader.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\attrib.exe

attrib -h -s -a C:\CG_Files

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" RD /S /Q C:\CG_Files "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" DEL /F /Q /A C:\CG_Files"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|sc stop IObitUnlocker & echo|NetSh Advfirewall Set allprofiles state off & echo|%windir%\D53A22A6.dll /protection off & echo|%windir%\D53A22A6.dll /op:uninstall_app & echo y|cacls "C:\Windows\System32\drivers\etc\hosts" /P %username% & echo y|cacls "C:\Windows\System32\drivers\etc\hosts.ics" /P %username%:f & echo y|cacls "C:\Windows\System32\drivers\etc\hosts" /P alla:f & echo y|cacls "C:\Windows\System32\drivers\etc\hosts.ics" /P alla:f & echo y|cacls "C:\Windows\System32\drivers\etc\hosts" /P everyone:f & echo y|cacls "C:\Windows\System32\drivers\etc\hosts.ics" /P everyone:f & echo y|cacls "C:\D53A22A6" /P alla:f & echo y|cacls "C:\D53A22A6" /P %username%:f & echo y|cacls "C:\D53A22A6" /P everyone:f & echo y|cacls "C:\D53A22A6\*.*" /P alla:f & echo y|cacls "C:\D53A22A6\*.*" /P %username%:f & echo y|cacls "C:\D53A22A6\*.*" /P everyone:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P %username%:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P alla:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P everyone:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P %username%:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P alla:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P everyone:f & echo y|cacls "C:\Windows\System32\drivers\etc" /P %username%:f & echo y|cacls "C:\Windows\System32\drivers\etc" /P alla:f & echo y|cacls "C:\Windows\System32\drivers\etc" /P everyone:f & echo y|cacls "%windir%\system32\drivers\etc" /P %username%:f & echo y|cacls "%windir%\system32\drivers\etc" /P alla:f & echo y|cacls "%windir%\system32\drivers\etc" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\sc.exe

sc stop IObitUnlocker

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\netsh.exe

NetSh Advfirewall Set allprofiles state off

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://href.li/?https://cheatglobal.com/ui/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb6e2b46f8,0x7ffb6e2b4708,0x7ffb6e2b4718

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\D53A22A6.dll

C:\Windows\D53A22A6.dll /protection off

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|type "C:\D53A22A6\Hosts_list.txt" > "%windir%\system32\drivers\etc\hosts.ics" & echo|type "C:\D53A22A6\Hosts_list.txt" > "%windir%\system32\drivers\etc\hosts" & echo|ipconfig /flushdns

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\D53A22A6.dll

C:\Windows\D53A22A6.dll /op:uninstall_app

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc\hosts" /P Admin

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" type "C:\D53A22A6\Hosts_list.txt" 1>"C:\Windows\system32\drivers\etc\hosts.ics""

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2528 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" type "C:\D53A22A6\Hosts_list.txt" 1>"C:\Windows\system32\drivers\etc\hosts""

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|"C:\Windows\D53A22A6.dll" /op:install_driver_registry & echo|"C:\Windows\D53A22A6.dll" /setitem "C:\Windows\System32\drivers\etc\hosts" Read-only & echo|"C:\Windows\D53A22A6.dll" /setitem "C:\Windows\System32\drivers\etc\hosts.ics" Read-only & echo|"C:\Windows\D53A22A6.dll" /settrusted "C:\Windows\System32\cmd.exe" Disabled & echo|"C:\Windows\D53A22A6.dll" /settrusted "C:\Windows\System32\conhost.exe" Disabled & echo|"C:\Windows\D53A22A6.dll" /settrusted "C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe" Enabled & echo|"C:\Windows\D53A22A6.dll" /protection on & echo|attrib +h -s -a "C:\Windows\System32\drivers\etc\hosts" & echo|attrib +h -s -a "C:\Windows\System32\drivers\etc\hosts.ics" & echo|attrib +h -s -a %windir%\System32\drivers\etc\hosts & echo|attrib +h -s -a %windir%\System32\drivers\etc\hosts.ics

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /flushdns

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\D53A22A6.dll

"C:\Windows\D53A22A6.dll" /op:install_driver_registry

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\D53A22A6.dll

"C:\Windows\D53A22A6.dll" /setitem "C:\Windows\System32\drivers\etc\hosts" Read-only

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc\hosts.ics" /P Admin:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc\hosts" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\D53A22A6.dll

"C:\Windows\D53A22A6.dll" /setitem "C:\Windows\System32\drivers\etc\hosts.ics" Read-only

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\D53A22A6.dll

"C:\Windows\D53A22A6.dll" /settrusted "C:\Windows\System32\cmd.exe" Disabled

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc\hosts.ics" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc\hosts" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc\hosts.ics" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\D53A22A6" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\D53A22A6" /P Admin:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\D53A22A6" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\D53A22A6\*.*" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\D53A22A6\*.*" /P Admin:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\D53A22A6\*.*" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P Admin:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P Admin:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc" /P Admin:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\system32\drivers\etc" /P Admin:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\system32\drivers\etc" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\system32\drivers\etc" /P everyone:f

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\D53A22A6.dll

"C:\Windows\D53A22A6.dll" /settrusted "C:\Windows\System32\conhost.exe" Disabled

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\D53A22A6.dll

"C:\Windows\D53A22A6.dll" /settrusted "C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe" Enabled

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\D53A22A6.dll

"C:\Windows\D53A22A6.dll" /protection on

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\attrib.exe

attrib +h -s -a "C:\Windows\System32\drivers\etc\hosts"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\attrib.exe

attrib +h -s -a "C:\Windows\System32\drivers\etc\hosts.ics"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\attrib.exe

attrib +h -s -a C:\Windows\System32\drivers\etc\hosts

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\attrib.exe

attrib +h -s -a C:\Windows\System32\drivers\etc\hosts.ics

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff671b45460,0x7ff671b45470,0x7ff671b45480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6468 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4940 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5146290658643038591,7582617187405127986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill /F /IM m2jfb0ts.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM m2jfb0ts.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|sc stop IObitUnlocker & echo|taskkill /F /IM m2jfb0ts.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\sc.exe

sc stop IObitUnlocker

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM m2jfb0ts.exe

C:\D53A22A6\m2jfb0ts.exe

"C:\D53A22A6\m2jfb0ts.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|TASKKILL /F /IM HTTPDebuggerSvc.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\taskkill.exe

TASKKILL /F /IM HTTPDebuggerSvc.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|start C:\D53A22A6\D53A22A6.lnk

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|attrib +h -s -a C:\D53A22A6\D53A22A6.lnk & echo|attrib +h -s -a C:\D53A22A6\D53A22A6.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" start C:\D53A22A6\D53A22A6.lnk"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\attrib.exe

attrib +h -s -a C:\D53A22A6\D53A22A6.lnk

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\attrib.exe

attrib +h -s -a C:\D53A22A6\D53A22A6.exe

C:\D53A22A6\D53A22A6\HaydiRastGeleBot.exe

"C:\D53A22A6\D53A22A6\HaydiRastGeleBot.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1276 -ip 1276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 9272

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 22.89.16.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 7.98.51.23.in-addr.arpa udp
US 8.8.8.8:53 gitlab.com udp
US 172.65.251.78:443 gitlab.com tcp
US 8.8.8.8:53 78.251.65.172.in-addr.arpa udp
US 8.8.8.8:53 href.li udp
US 192.0.78.27:443 href.li tcp
US 8.8.8.8:53 cheatglobal.com udp
US 104.21.36.223:443 cheatglobal.com tcp
US 8.8.8.8:53 27.78.0.192.in-addr.arpa udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 nav.smartscreen.microsoft.com udp
GB 142.250.179.228:443 www.google.com tcp
GB 13.87.96.169:443 nav.smartscreen.microsoft.com tcp
GB 13.87.96.169:443 nav.smartscreen.microsoft.com tcp
GB 13.87.96.169:443 nav.smartscreen.microsoft.com tcp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 data-edge.smartscreen.microsoft.com udp
GB 51.140.242.104:443 data-edge.smartscreen.microsoft.com tcp
GB 51.140.242.104:443 data-edge.smartscreen.microsoft.com tcp
GB 51.140.242.104:443 data-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 223.36.21.104.in-addr.arpa udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
US 8.8.8.8:53 228.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 169.96.87.13.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 cheatglobal.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.179.228:443 www.google.com udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 arc.srv.lan udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 ntp.srv.lan udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 hcaptcha.com udp
US 104.19.229.21:443 hcaptcha.com tcp
US 8.8.8.8:53 newassets.hcaptcha.com udp
US 8.8.8.8:53 api.hcaptcha.com udp
US 8.8.8.8:53 21.229.19.104.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 104.19.229.21:443 api.hcaptcha.com tcp
US 8.8.8.8:53 imgs3.hcaptcha.com udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 142.250.200.2:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 66.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
GB 142.250.187.194:443 ep1.adtrafficquality.google tcp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
GB 142.250.200.33:443 ep2.adtrafficquality.google tcp
US 8.8.8.8:53 2.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 194.187.250.142.in-addr.arpa udp
GB 142.250.200.33:443 ep2.adtrafficquality.google udp
GB 142.250.187.194:443 ep1.adtrafficquality.google udp
US 8.8.8.8:53 33.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
GB 142.250.187.194:443 ep1.adtrafficquality.google udp
US 8.8.8.8:53 cheatglobal.com udp
US 8.8.8.8:53 www.youtube.com udp
GB 216.58.204.78:443 www.youtube.com tcp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 i.ytimg.com udp
GB 216.58.204.78:443 www.youtube.com udp
GB 216.58.204.86:443 i.ytimg.com tcp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
US 8.8.8.8:53 static.doubleclick.net udp
GB 142.250.200.2:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 yt3.ggpht.com udp
GB 142.250.187.234:443 jnn-pa.googleapis.com tcp
GB 142.250.180.6:443 static.doubleclick.net tcp
GB 142.250.179.228:443 www.google.com udp
GB 142.250.187.193:443 yt3.ggpht.com tcp
GB 142.250.187.234:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 86.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 6.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 193.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com udp
US 8.8.8.8:53 206.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 href.li udp
US 8.8.8.8:53 instagram.com udp
US 8.8.8.8:53 t.me udp
GB 142.250.179.234:443 ajax.googleapis.com tcp
US 8.8.8.8:53 xenforo.com udp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 8.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.34.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
GB 2.18.27.82:443 www.bing.com tcp
US 8.8.8.8:53 82.27.18.2.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 ntp.srv.lan udp
US 8.8.8.8:53 130.109.69.13.in-addr.arpa udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 th.bing.com udp
GB 2.18.27.76:443 th.bing.com tcp
GB 2.18.27.76:443 th.bing.com tcp
US 8.8.8.8:53 76.27.18.2.in-addr.arpa udp
US 8.8.8.8:53 aefd.nelreports.net udp
GB 2.19.252.146:443 aefd.nelreports.net tcp
GB 2.18.27.82:443 th.bing.com tcp
US 8.8.8.8:53 login.microsoftonline.com udp
IE 40.126.31.69:443 login.microsoftonline.com tcp
US 8.8.8.8:53 146.252.19.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 nav.smartscreen.microsoft.com udp
GB 51.140.244.186:443 nav.smartscreen.microsoft.com tcp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 instagram.com udp
US 8.8.8.8:53 t.me udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 186.244.140.51.in-addr.arpa udp
US 216.239.34.36:443 region1.google-analytics.com udp
US 8.8.8.8:53 edge.msiserver.lan udp
GB 142.250.200.2:443 googleads.g.doubleclick.net udp
GB 216.58.204.78:443 www.youtube.com udp
GB 216.58.204.86:443 i.ytimg.com udp
GB 142.250.187.234:443 jnn-pa.googleapis.com udp
GB 216.58.212.206:443 play.google.com udp
GB 142.250.200.33:443 ep2.adtrafficquality.google udp
N/A 127.0.0.1:9002 tcp
US 8.8.8.8:53 gitlab.com udp
US 172.65.251.78:443 gitlab.com tcp
GB 216.58.212.206:443 play.google.com udp

Files

memory/4812-0-0x000000007485E000-0x000000007485F000-memory.dmp

memory/4812-1-0x00000000002E0000-0x000000000073C000-memory.dmp

memory/4812-2-0x00000000050D0000-0x0000000005162000-memory.dmp

memory/4812-3-0x0000000005200000-0x000000000529C000-memory.dmp

memory/4812-4-0x0000000005850000-0x0000000005DF6000-memory.dmp

memory/4812-5-0x00000000051C0000-0x00000000051CA000-memory.dmp

memory/4812-6-0x0000000074850000-0x0000000075001000-memory.dmp

memory/4812-7-0x0000000005340000-0x0000000005396000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D53A22A6.exe

MD5 c25c2a6060a71bd7707444a6f6474250
SHA1 ce8bae5c3c5cfda3b3136644abce36c14ca5acde
SHA256 91b99f2ebbabad81a8804730e9671329bd79d4b5ccbbb22c4da2eb365da2c68c
SHA512 1c79d92c755faff11cbb89281e49ebfbb90c86b3b7101bbf6c5c6d5349a8daa281d3e6432306d752e84a73b4a20286f763500e68100194e9e1a90edcec8b4ac4

memory/4112-10-0x0000000074850000-0x0000000075001000-memory.dmp

memory/4812-12-0x0000000074850000-0x0000000075001000-memory.dmp

memory/4112-11-0x00000000001E0000-0x000000000063C000-memory.dmp

memory/4112-13-0x0000000074850000-0x0000000075001000-memory.dmp

memory/4112-14-0x0000000006E30000-0x0000000006E74000-memory.dmp

memory/4112-15-0x00000000091D0000-0x0000000009392000-memory.dmp

memory/4112-16-0x0000000009C90000-0x000000000A1BC000-memory.dmp

memory/4112-17-0x0000000009BA0000-0x0000000009BCC000-memory.dmp

C:\Windows\D53A22A6.dll

MD5 d33241881248aeeedf1f69c56116a0a8
SHA1 bea271b0b46b22194407758d0536f8567e191750
SHA256 6b7f866fe750bcf961b7c035cbc4ad29aab8890f3358fee94c2bc386b90ca950
SHA512 62e730da39b69a945844ba128a1b69af6f9c8437ebd0525a4fc23c0e8b33132664157fa506fd0f844301b5c158ab0ef5c32b9fee49d971e5f2d3dbc28a7c60db

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 7aea85a5d58b45db7a4d9dd361b1eb5d
SHA1 c6844a476f9b8396b0db499d50303a0f34b8ddc6
SHA256 1b33dfb5c90ef3794804742054d7fb9fcaf94b99dfabd14054df4cd81794c46e
SHA512 f83d365e93c894d00c926c09d383b5805551a7c96595278131c3f5d44259713e5bb47a1d4259e452743a5c5040e8502c4e979a8ca076a4ea53d32722fb2b9057

memory/1044-28-0x0000000000B40000-0x0000000001389000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll

MD5 69cdc240b3f2ad30b989e2c6cf705383
SHA1 07f3508c44d503d39fb4b7924ededaab2a9768be
SHA256 e42526f348de6a97f9746686e8409e396b42ce0c552dfdbe34855455c837b805
SHA512 25ea3582470e9fc42e7d4a8a652b8ba37b726cc03a1ab40dcac60b7c695bf9714f501be50b01775a6344d09856ca8d2b3a030f5a27efb34a7d9dc98a68eadbca

memory/1044-41-0x0000000000B40000-0x0000000001389000-memory.dmp

memory/4680-47-0x0000000000B40000-0x0000000001389000-memory.dmp

\??\pipe\LOCAL\crashpad_1880_KCUPMPZQQIUKIMUX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ed90a660c04943bc07a5a29de51d4690
SHA1 4c1aabb06ed20c50300c6fddc492f4c1d491a09c
SHA256 70a4394643ed5adc0b953feb18f2318ea59a6aa6daab3161c5ffbe476891af02
SHA512 d78542e322265eca647cd0d41ff33383b0aebadcaf6cfe021433dd0581d9605d5a1924524529607564a8eaa0bed940a8cce73d2450182aa67856385f435aea95

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 db2918f4489e539d5b023b4a115deeff
SHA1 4324ac540d3ba808808c20e532d504776856dcc5
SHA256 b41864ec658675f684c5a5803a67a91deb9743185ef192f5d0b445d47d3b0fb6
SHA512 11cd3cff1e5a31728b780dd10c2019e467bf674a7ca18aec92676f8018bcdbe635cf6d6cb68a47966d656ff258d846fb2a0939eb4af74bcdfe081f135ff2e372

memory/4680-92-0x0000000000B40000-0x0000000001389000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 55ac5035daa44e5169d4454fa40900cb
SHA1 a78cc59c2726ea59b71980fe2b80f4293af088e4
SHA256 7f8b0f40d1a6a8010e8d365f6d92c1dbdafcaeabf1ee492d745864ce78f4f3ac
SHA512 cfd5bac258a40a11f38346e74c8a43f18617c3742a83c51be6fd2caeec71c43c56a0684454b22b4adbb7caf7b3dc93cd7e0aaa5d4d7e7c528eda840374626c6d

memory/404-153-0x0000000000B40000-0x0000000001389000-memory.dmp

C:\ProgramData\{CF93D06A-43BB-4aa4-A4FB-99880124E1AC}.log

MD5 27c8860dd7a43d6c0471fe1a1a1022be
SHA1 e1e5d39b8cf3db263dcc6ef0621fbd2c1aed34bd
SHA256 91814d541304e7443eceb4c7717fadd9200aa5aac0dadc8beb3361fb3f68a893
SHA512 1700098f2c2b5ad2c58aa8b013067f0860c8fc00d4155cde38f9e8a018433c1b777aaf19ee811fdc82b90fca48c7ab9e2ea391e3f5fbf5306b65eda8efe42b52

memory/404-164-0x0000000000B40000-0x0000000001389000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

MD5 7b49e7ed72d5c3ab75ea4aa12182314a
SHA1 1338fc8f099438e5465615ace45c245450f98c84
SHA256 747c584047f6a46912d5c5354b6186e04ea24cf61246a89c57077faf96679db6
SHA512 6edf4594e2b850f3ede5a68738e6482dd6e9a5312bffa61b053312aa383df787641f6747ac91fa71bb80c51ed52a0c23cc911f063cd6e322d9a1210aea64e985

memory/4112-165-0x0000000074850000-0x0000000075001000-memory.dmp

memory/4572-171-0x0000000000B40000-0x0000000001389000-memory.dmp

C:\ProgramData\{CF93D06A-43BB-4aa4-A4FB-99880124E1AC}.log

MD5 9887e240eacb5f05d3923a7b47129b9b
SHA1 af5f465bfe3dc42acaca66ba3901b0565888dd6d
SHA256 18fbf32bf034717f89d07cbddd800bd928c676741d08cadf313cc4d320a9146e
SHA512 6e3395c675c978bfd1171658b3dca2b1397596b7aa0df2409497ce1007c21477af642a41e21c9ce90ff6d9e636998506702f1f10868954cc70ee88bf3377244b

memory/4572-174-0x0000000000B40000-0x0000000001389000-memory.dmp

memory/2892-176-0x0000000000B40000-0x0000000001389000-memory.dmp

memory/2892-178-0x0000000000B40000-0x0000000001389000-memory.dmp

memory/2996-180-0x0000000000B40000-0x0000000001389000-memory.dmp

memory/2996-182-0x0000000000B40000-0x0000000001389000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys

MD5 47aa03a10ac3a407f8f30f1088edcbc9
SHA1 b5d78a1d3ae93bd343c6d65e64c0945d1d558758
SHA256 c79a2bb050af6436b10b58ef04dbc7082df1513cec5934432004eb56fba05e66
SHA512 3402ca68b00ffd9e2551f97b3895990ee0274f14f117505c3588ea76c716488860ac2da07c1d9275bbc43eb87b88893c52fb04d15f1afe7b7bf7d9a524961101

memory/1812-191-0x0000000000B40000-0x0000000001389000-memory.dmp

memory/1812-195-0x0000000000B40000-0x0000000001389000-memory.dmp

memory/2148-199-0x0000000000B40000-0x0000000001389000-memory.dmp

memory/4384-205-0x0000000000B40000-0x0000000001389000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 e185798913e76cd959d6fec0f5a572ac
SHA1 b7beeb8ac16bef969c38c8edb9e5f491a0e0f7b1
SHA256 969aa6ee1eff9cd1676c9f94505940e2bf8a6130c474726509e07c17ecd0dbd9
SHA512 8d00591aa15b1047a68987b75f85ca1a47268f3e3bff6af2acfa5598553550b1cfd4519c1a034948266e56e975f950b803c8ebf6370865eaa5bad045b42fec29

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 7febb95ffb48dcec77179b403074efe9
SHA1 21647ca40c04a642675d100bd74a7cf2d61289c3
SHA256 f2d21e3a3a6de03d510cd56445491ce68db1634eb1036f6030cd8ff3625237eb
SHA512 4233eac10a1dc50ef93be10076a0a2b10215458615895a4d7e2d1749cdf53927f06669daabc74bb11b99755179c80a3a02c6bb493610cac1c1de93c7f4b43faf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4c188b6c-f604-4ed1-aeef-f3ff521985b1.tmp

MD5 f3ea4f67881e4422e8b69e9932e18bdb
SHA1 ac4685342a08140ef46815df7aaf8c727fa6f4e2
SHA256 889141b1b16668e806c88b53da9df9a344ec830d954cfe7441af530813119626
SHA512 12783eb3af72d5bad85ff955d0f7baccdae8e906432c523e3a113d3fc97b7594b4e61cf64dad12a0be651a76f662f2e1ecf5e7923a21ad3b39e912bccbca2f5d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b45f0ffab21837533f61dc4759bec471
SHA1 41b81dfa723d23572fbd5fc41ab786bb584581bb
SHA256 360f1853333f3e944bae348761de55134851e37166f1230e9446b6aa03ee5e13
SHA512 eef283a2968b42ff787949a2833faf444c7fc45a0fb415feccc1688fc0bc5c73fd45d23c4d172427a037f79d6b9757d21a26bcf49479cb02e68f3d89ec5b2f0b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 3197bce0fd2473291af7f959cb82b58f
SHA1 5747e270e0cb151ade7d29a1510ede74fc1e1a46
SHA256 b05c79dd0ad7e33bdb5e71f2fea8aee06d415a97ce2e9da76cbfed9f7b6f2c4f
SHA512 43e22facecb57e8a61671f4c6f76baf28f574291e46fda2d00fa00e6fc46800693947c2bb700976f983272f3c0f35f5ecce3f45ad4385ac9161a09460b2aa8ed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5421b1d711cbe58cba47d349b4516a21
SHA1 a390c930fc95412788d7dd5f89c05f15c2d39d14
SHA256 7a5d0ee5f5325a1bb35b01139a7b75ffe82f925b5e77dbd1098e4579b6c68ed2
SHA512 fcddecf77d2c9db9938747e3893a7018ad7bc97159e6b77d72ce48cc4733f2e9a5565eb8156b2489a879d0ddf19fbd4235e1521855b123c8103f899f99da7197

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 608d4beb4883608c4b399f07e5bb6512
SHA1 cc01ee15a4dbfb086b6aab3da8206d0361abed80
SHA256 e196d633ed9da4b4ef10b14f84609b7e5d508771e5475fa11602789a500001a2
SHA512 26538bed6f3f27c9a184800c6f0796cad1ea33966e5da2e0e7fbd87c23c635a50b1376f2a059a6619901d8379c9183d23b0f9cb975d3e1c36842e3da28db251b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dc08.TMP

MD5 eece38e16b750b60ef1202722875cafc
SHA1 fc55f7f2d522908a56d0090b0fdfd03bbca3f9bd
SHA256 24d0443c0ba52ee148054838e1ee2a9ad01e3e32ef0327c70f17a7dc701bcc37
SHA512 593be960ed7b09f79d53560980a5b3f71ddbe77c9ca3a38c138197f40d122d259679fc3ffc2ebf813a1db3c4cbae08740f43ecfc69fa87f83234d1c06729853f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 ff32001a4bad0d99f946daca8ddd2fed
SHA1 41d488af80d5df27c82af359a2ceb536e2983fb0
SHA256 c86f0a72254ed47142e7d7f094fd3150a6bbc12424eefd1e46eede8f6813f195
SHA512 7a972c9d7e0fd27e2423ba6874abe7880181570d20ccd1ed1acc7345fa4be57b9e8c1a12eb70c817fbd567a4c2b9c55fe1ef59e12349ec34d894dada494875b2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4faaf4de83caf942e729479f8847bc8a
SHA1 ce69f4a13c01a50e0b618c5fbc5de519eb8890f8
SHA256 b7e36ecf53ba620455cbd5117dd3fb5d08d858c5baa682a64b10a59313d295b9
SHA512 5b11783580d445f8bb81c2b031a217d9bcfc3523696989f8c2bcf3f8593babd768b0ba5b5da8cffc5e8a0ec12983a82b1ef02cfd7528d3d5e09bbb6064c00577

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 31f1d555731c5faf53ec56252a394f95
SHA1 21020da7db64469facdada8bd026dd57f2dcdd75
SHA256 007015580aea53cd34c94b5c513cbc1964b2a48c9da8568dc7674c69c3af1423
SHA512 fac68d47fdddef502ac514dde10ed4ad76855224675ee57c0961c380414d8c533add6f8d0f3728cc84b5f5cd562e055dede94d5fc23cc0dd6fdc91cac40040f4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7a10a6de99e391daddbe4950403051fa
SHA1 d02b48f77864c76acfc1b16cdf5f8132a23146d4
SHA256 7a0a8a9701ae76cbd6c0e4c6c2d2033480125c230ed265746af62d20c155aa45
SHA512 f284acf0d27a9726271926b9a6ceb709e547502735aa7851a390db2584bafc19e8a26a999d4789d857cba27dc1923892d898761fa4d7e7f4e946a99e0da1b6ea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 44d248d0401381ca7e0c8918b192a9a4
SHA1 53618e52b17376e7ae1dd05fe525f4da02e66961
SHA256 aad423c976cacd782f46fdd8f8762126fc76aa4cf086a2e292d2cc2bbdd643bc
SHA512 42133ee086905e2e7725f22ba82802920255b2882849469881e2f8e46fa7433f82bb50bb1b65e2978d15504bc271ca2061c8887bf003bc4a22444a5202f39cc2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 eb92194513bfd1f1e2743bdca78bb44e
SHA1 21bb4db01a81a851e9cf91a98e9e183919231c3b
SHA256 d0609d2aba561cca07478aec96db64dce37bc064e57665175d8af378e2b73479
SHA512 b42bad56e9517ae18b9c31b1f9569f34d54f36cda8a0b9343f9a35a6c9a2437e7c047b6f4462cb97f7ee0e3faedf4ef0696152f1f4012535d5e37b6a0d8130c8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fd6cc25339880dd5211efe17d12cd63e
SHA1 52a1d6e9b34d5147a44ae7aecefaa3853d1a30d4
SHA256 ca0dfdd8325757459c0c29ca3be99ec753bf4ea951f3e4c7f94b55073ff4a792
SHA512 2522bfcaed1a66134e0fa68652b7424fec3dea28816633b90330032900eff57deca2fe2fa67ef8b2d0e9c6e2bc81ae6dbdeb9a96e7b5c059afedf0a08c12c5a7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

MD5 c63aaa172aefd138ea9e16ce0c2ba1de
SHA1 80f7c9c775eb6afb299922d872a5f56a1d8137d1
SHA256 e419822cb788fc4290763e71a6cbb8fcdf0e3f2cfdae9e65580c8ac543e91489
SHA512 85eef7c4e8b804b29141e2c54fb71b78269495bad1a0122e56b5377983ceeca568a957997e5ff1847e9acf023e91b239d92bfa5c2f47642d6087766e687fa266

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

MD5 d52003038b8b8ae9883937be4016ee83
SHA1 be22935e533b3ea5cae4db9737dae844784d3e19
SHA256 1dc184f8737e35db11454eeb0c2b16ea0c841ef8fed457c07f9398deabc68156
SHA512 3d9ea661fe03f51ca78c6690f0b363bc3accae9a6e3199a731515e03f0181330a989f9f23a0893ea7c054b917f357eb1968c543d0f10442b15a00d08490cde5b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

MD5 e6b9b1b342afc8bd5f1184e9f2460ec8
SHA1 d5fda5004dd3462059fbe19fbe6db0966360a0b2
SHA256 f8bb31ddeb964dcfca0e831689f5225f02780501d022f2438a1de8f2fcb934f9
SHA512 459d5bbe6ce9e0cfe605a7e5845564dda75aa7c28b3f50fa6b7c21589f903304305e16aa17d9c41399f74231a0f6d1cd70ba20a9f7136174c9b36baf1ac08e43

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

MD5 fc045901a6e2beb2d8efcf50577fcfd0
SHA1 e3afaf06b5873bd7b89755805ab1f689001a1298
SHA256 617aa6d2c91319d7016096acbe9ccf19860d85251effff374fc10edfe3e07b0e
SHA512 b2a0345097691c5164f5d845e1e895467f70241e567f83d49cde6d66bf30889935606629ec9b634299feae840d2ff2365698c252343d70a7705693acbfa9db27

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

MD5 dac18388ad86ed5ec1bd4d3bdedd4bb9
SHA1 1e30106429e1e84a697db46be2dff99a6df0f6bf
SHA256 0bbf84d7088148e0a398ffa522218b3e0c12a56f95c613cd5b205fa22414ad4f
SHA512 9b108ca9cdcf79577525ccdc752ce6c753323ca918a23b8f4e99041be4e5411f702d185884494b57fa2f2f58083dbe067c37312a6d4663d6d923990b0c4e499f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58a3ec.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 7c0ca2426f5201bb1f415a21144e5a57
SHA1 dcec57e6243aec8ab4c72bd922de7ed1f878c63c
SHA256 ef518e81517ff46a4aaf0703527f1b3252c1b05c75050e6ec6b25fa538512ae7
SHA512 664ecce64baff717b3f11076c57dcfdcb57c679b73d0f2ec6c24e3d06e97e35e25c58a46dd8d2c7b275cb0358f5f7a07cd280cee54f5b65340be2f3e69e14694

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2f44d349dbedfe5c67e1a90ab1802312
SHA1 d1660c143e14ce4584c2f20709248629224a9263
SHA256 ebe7b35218eab8740b2607bb582a13ea802739c16fc55d94e89f8de1e2fd8d68
SHA512 45352d956397026ee4e6ad63ffdecd9bab560aeb6cabe4cbdfcd487f337dd89bbbaba04dc209da7d8f345d7bcad65d4a50342140be714ee270a101ef2623cf48

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2b485dc08148feced02ac4a7aa965834
SHA1 d85302a9bad3f7e79c1cf206c29c542ccce27583
SHA256 44ce16f59ffbac968c3cfae780da10aee0fc62e4ddbb1ecbcb6bee361baea460
SHA512 443ae5af5cc85869ee1c90bdeb94f3e7dc2c62738a1f44cd40a3db28fddafe64a2e692af8b00c0eab9b7afcc544e1eb37772006988047b4404b9ea6f8e3510a9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 b142cf61eee314c49d11a9829324588f
SHA1 d94d0f5aeb788ab8e071352443543b5cc6eab879
SHA256 923c0684c9440239e81048eb6c7d640219e9dbc825fcd141c3b531f9c8732f73
SHA512 2aa51a9f85e559ed219df6319de9b4a790e17d03a45b339f07d856da8a611d3a22321dcee0baf4ee3650aa4e114838893f17f58542761f446abab46d9b77ade8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590f19.TMP

MD5 71b348e143f6ec1c877e9944e0456a28
SHA1 2432a03ab3d819115fa86c6a9c8fac5079736592
SHA256 9b67ac071225b77c1be1a28b9a29873a4333ce797142abb16b781aceb9cb8833
SHA512 b2e9383c191f087d0b655cfee1acf51ea670a29c48b1e1c75831319b2305a1225020a4f3fe3f48ae80bcd757e931a53c85aa8a4e4d625b694709b67ed7d21a48

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 5f7996dddf6a388505a156ac416c517f
SHA1 d8b21e87d44fcd90860cc3144c46cc5140c841bf
SHA256 cd55879b178cbc7c8414e93431419db42c191e7226adcde8812984770cac1111
SHA512 cf90a751d056a792f26b3dc16d0b5e12aa7f38a87188f026b6508cd28a6c901e39230063ebb8d7b51eed97552a9be904bd8ddfe2682aea3edaf6fae139c86eac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c40373b1ad3418c01a3982fed8d9ff0083761334\e3859a2d-6d02-4fa6-ae0d-1798cd308c14\index-dir\the-real-index

MD5 1e7a27f60024660bee89be0dba7793e8
SHA1 6f39250d2375ab987a8961b7330264d05699152a
SHA256 468ae6a2684173b37d5bebcc9041773eb659036c6dbcb98dd1915b51dc22180b
SHA512 b788e025cfef62a4f23672d52ab4290a1f56bf2e91b2c493a53b7229f0df705fa8604e30338c1f7eac33ccf0382a1c1d2bcc2e45f8b07fead377310c584e9355

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c40373b1ad3418c01a3982fed8d9ff0083761334\e3859a2d-6d02-4fa6-ae0d-1798cd308c14\index-dir\the-real-index~RFe591071.TMP

MD5 f85d5f57ab2147510a6f99112bb853f0
SHA1 f247248f72c27094a49a74478715a8720c6bde51
SHA256 2072f371999564524ba0851c6cf582d6c547ced4e5ec51189cc429260da6bbf4
SHA512 366220ce990b5949bcd74fb5a427ca5eb2841ab66cceb26dfdeae9981caaa79ced3b0e9ea70a47210c2e14c5ae008b285ffc7fbafb4f0f877385d854fe03e2bd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c40373b1ad3418c01a3982fed8d9ff0083761334\index.txt

MD5 d855b9f7b3675b96f3bb78f5b18e194c
SHA1 1344c713e934b6332fe43c8c199beb8061d9be3a
SHA256 483df9586304aa8ad6af796d43072054964bac424c26c2dc418d87e34db9294a
SHA512 ba59e9d6009c87c3ed90ed0f57ce614d878c738559e13076ca8874e80ff6546f8573e474c164a18af9fff5290b2a6b8e74f3753e08399e46138fbbad6fa0c07d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c40373b1ad3418c01a3982fed8d9ff0083761334\index.txt

MD5 ee21f697d5b17964188f5b7de9f61d00
SHA1 d986d2110aa5ab1fd2ba8c2d28b40f966f74111e
SHA256 eabaeccc1bf4d9d88ae45ee68a1e43bfdc7d9708ba42c5a5924e1e35006ac684
SHA512 c44912d4eb7db9007c5a8c713d74bb6fb84041ba20cbaad4a3fe6083cabdb6917dbfa2fdbc294135752f924f7ddb60bac616bc91cd415f67e37a571267d24095

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b4181fad68ead95590dc7c4cac9f4638
SHA1 5e0fe714b5025afdf0d7ed822e2ea296c2553544
SHA256 6f1451ffadce200725785f73f51d43e04fedf3900827a58249621737a3fb811c
SHA512 49bfcd0033a501aa48435c38780ea0518eae112b301ff3581803519b901baabfe7822fe1c0140a0a5dcdb1d7654f556ffeeb2b5334d92229542c3675c9dfc5fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 80c83222f0279298b39e4867ef8d6be1
SHA1 c0a495e5746d75b67eb2103f375c56a0e3a6b8f6
SHA256 957349bfc382cfe47da9675aef89a6b0f794b2ed43ce722e4ffeaeb6a7f3eb1f
SHA512 28a9b49c0c2e8bd121a6a447e74be06ea5db13f422c0da7e8c5e395b5a8efd85c0cccfda4203f3c589cac725b612b993326557cc28a3a8c3098b2059a2d7c7df

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 3fdf104d43da32cd74a829400b6fc573
SHA1 9f1497f250ecbf990fb2ce9d4a8a6d2e6a93680a
SHA256 cbf05002728bad8f9ea0da3a1d39f4015868ef912e84986218a8d9752adf4dbd
SHA512 2210a4e3c93376a654c668cefaa3b794719b713801c225e755db693f4cfa1ba0edded6635213ddde9500c9f8c48a216ff3511c5756dc3f9efa90340be1e9933c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

MD5 69df804d05f8b29a88278b7d582dd279
SHA1 d9560905612cf656d5dd0e741172fb4cd9c60688
SHA256 b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608
SHA512 0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9aef9b95e7795fe9f92070d73f70e4a6
SHA1 415d378f6d786c89f4355e40a4384178d4735df4
SHA256 daa26b1e4dec9527185b37d42db8c46249ddd6edc9c400667bfeb6adc362f842
SHA512 f5a542b1337ba91071ef683b6bc2f27eccdcd078fa34f38a8f96cdb9f929fdbc06d587e7a54267ef058def307a2d54169816b2f473446953550d08f307bdd5ee

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e3fd18a8064b80945ced03f76e16a67e
SHA1 ac0d0f901c73e2f369701aac7f95af8dc29ee463
SHA256 81032cb42b384d6efb3f8b5dbbbfcafe237439d4236375dfa0b82f5afe8a2757
SHA512 50222d5d0072212ea019ea3142b68de82c0a724580fc6f7b0fd1d3195916f82f8c7cfc8521556d2ec9972c4e3c94d34656f42fc317802c55ad3dd943cf7e4db1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 257930575a4c4114e814eba400ff6b87
SHA1 bbd9e8bb0cc51fd76337325b115f568cbab2b6c4
SHA256 4ab23fe4271793bb06a64302c86a73037b0349eafe3c2e60a395ac7846f2203d
SHA512 e2158bf28b71cab14d465e22b0eaf650ba648b845c69600d8f0db05836ba2ba20cebb1ec1ea9c1d55daffdd5bd460f16a40ed36653d4fe3396bc7fb437810fd2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4936454f8d927e559435a22ccaff2665
SHA1 abdce22d1c6f841ba298c080c3c1d88e9e50c911
SHA256 ad21e4e209a2db1c0b0b6ff3275fa74623eb1d18bc4373a9a5b1e9bbe8d310eb
SHA512 54b24a7f9964fd1e8bb757a70b508b2ee3858e84aa086425ea1ac1c3b1f7a9afea00d8c12a7d0ff368a9292773354445f3d6889d4f73730c7779a2d649b840de

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 1f8caa260b095f6669f83b5f135e1f94
SHA1 6b70483bccfb3a7384287851df81cf46d62d1010
SHA256 5c05fd27d276b8744cb71221b3d35700438b3269c2c93fdeb06ee683a28b053e
SHA512 c5bc432e79b855e2d28873a5e01b78b9348b1672138753cf94517c15a0b8f7ddcb7fec1c973ab621ff3c5a1635bd0acd18a090a55232546c98e2dc55d8b4ce03

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f6bd7ca2896c51b53974859421cd6719
SHA1 e7f72dea7d6f509ca26f7d7214c33bfd0521e116
SHA256 16dfa2d5f46a2d5ff03c7878d9189d2ca2cdfd913e0651006092b2d4a90b63ab
SHA512 22cc33aa04ee293bb2eed323f97a2cbd0201f41385797652a7f741fb52e3dffa6b9c55c2476cac329b7728f3c2b3327945faef69c4523a8d2e5b0d03152a66d1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

MD5 908b7d2865c53a4ef46d96ae9140cea3
SHA1 ec7d152704b2585e6d6a832af95463b59a79c2d2
SHA256 88326e7ad02a0f336cb897f35ffd4d9870eecd621077f441bb276fbe6d2f8786
SHA512 c8effcaaa93e9f8119a8ca63950ba1537da268a71320a31a956e1637ca87f089810788e36a8a315d7327637a5c4f5019bf2c61919b5c4e9bc845032e10308b69

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ab4ea358fb71acf19c5628efbfaafc1c
SHA1 901196d3890e4d7c8e10d69c968a0d5d88883386
SHA256 f4847dca615fc66fbe7df9825086f1b6c9301ce98f235190dbacce0a1b6c7895
SHA512 838a7020b82d8c72c39669d5945b7b912322ce41fd2cc08b0b2a959a604db487060445dfdf4c620a497e3ad0219420c5bdc827d3a7bb069c653adcc2754c8c5d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 5564ad0df0d67a764a97de6165d37b84
SHA1 9e7be133f7b7bd353ca2335a0f4785e225509d53
SHA256 d175b67aec8cfe2ee9a84d570e8f17a1f76c859ce175e355d6518a2fc1fe3f56
SHA512 947cc1f7bf4619d51ccf1e1bab835f431f08b68f09234aa33ec4ababbc014222a6f76e9bd6d89b0500032958c9517f8061c85e9ecf06708ead7f64cbdaa5c964

C:\D53A22A6\m2jfb0ts.exe

MD5 6bfdc22583e3474b92a8bd201d473aec
SHA1 32d8ec632434dc388600c425a59f40520b01d9da
SHA256 c8bfc5fda6c7cabd6e672959b22d38b97d8e826e98adbdf9ffeb3e9fbf5320aa
SHA512 ab443ff2702f899bb35039957e1ef5eddaf8c45efd42559d69624434e14bf3def75d1944330b57524a4cfc1cc8201aec171853aeed27ccec445a7e4c67a672ae

memory/2772-1285-0x0000000000CD0000-0x000000000174E000-memory.dmp

memory/2772-1286-0x0000000008420000-0x0000000008E7A000-memory.dmp

memory/2772-1288-0x0000000005980000-0x00000000059F8000-memory.dmp

C:\D53A22A6\D53A22A6\balik\altinsudak.png

MD5 967d3880e4a2ee7dd90ef16a92142edc
SHA1 1c04fb9083bdd37bed8d85a180e47c8c6b4e1f5b
SHA256 0bbd9aa0ed8d8542f71f81df8200dfaccc342db84841391e1982bed5238422fe
SHA512 1bb6f2d1212198d2a49aaccf09cac6f937d39d4539940a6f2d84eb007dc537eb14664c5ec7d4708268e1c1b89a72f551b52fadcc6174f6590381c2b7594719a6

C:\D53A22A6\D53A22A6\balik\bilgekralinsembolu.png

MD5 abb6a348bcd8619e570c33100c696545
SHA1 bd92bdc1f52c51f29e224a9c6d2ff02700b2da78
SHA256 e039d726956918f4606e73b2cc72f996113ea76fbe990eced24d75efe3020a31
SHA512 645a9832ab799a91795133951de837bb4d343c626a76b876446ad2a17dcb67727c876a1ded7e49c2779365a38c197f90d40df5da9371805b3218ee6274070515

C:\D53A22A6\D53A22A6\balik\levrek.png

MD5 384be4a7241c17a03d3458aa5843b1f8
SHA1 8ba4e0d3ec26423107e9d3a7d1359310d436d938
SHA256 59f22ab547dce3f6f98c09310230ddd50cd2673253f6174392cc915c69378276
SHA512 f087268f9b469dccb350ce8f590a2d45808ae15942140651a498a67ab42a3c188f437be36439aa0ba9a91a20cd1fc5cd31af2ee04545e0edd25b8d871c65341b

C:\D53A22A6\D53A22A6\balik\gorunmezlikpelerini.png

MD5 d54ece7c40b60a9cc0763ee1142981c2
SHA1 44af479888e33a36acab11d31653c3d36f54cda6
SHA256 9f96873374910a381bd9c504e36242ca13326bf515e82d016d0b959030ba5776
SHA512 0c33ce0c2d37480ada6297fedbd101772ee06fc95e33d39278c815699e8cd92c7ab3d981f95d754562aea6333bd5d0e097e08485b0a5aec2fdc418ec7a4dc82d

C:\D53A22A6\D53A22A6\balik\minikbalik.png

MD5 06943938529d544241bddc2d09b1c97f
SHA1 c6db212bf48544c17d469685a1ae323ba060d30c
SHA256 09ce14bb48cbda903a29acdf9ceb56dd7eed6f8f9b87431fee8c1b63efe84b69
SHA512 33073b69d13627150d546eac801c2054e19dc653d71e10ec5c47df7cf3261e02664db0aee480deab0f1cd74a52ca095c5ce2511db5bac7f97b3e196347161126

C:\D53A22A6\D53A22A6\balik\palamut.png

MD5 4af95349a8209b8c0b93d77d8203a658
SHA1 ee47e95684858ea65b503952170c5d3768c19889
SHA256 a0ad7a69238d04f46b7721edde710f4040809ff90858bb1cf5379d78ebef1330
SHA512 20b3874a4b6f680b7c54030fcf201330dc1b3e9b352eabe3b0ed51bbfbd9a84c8004f0bdc7e03f0a0a6d4ff8dc0f807abcbdf2e41a32e67907a83d31068d8a8a

C:\D53A22A6\D53A22A6\balik\otsazani.png

MD5 275e5f36db9e56148b3d50bc9bccb21a
SHA1 401a0d07ad6d4d2dc1603c82e7d46b54ec77868a
SHA256 be72a5dd6f672214d2bedda9b715cb4f8e1c7b74a29a2dc636886e4ed659149e
SHA512 7f82a2bdb5fd1b857b3716d9ef26752fd448ef09d6978d90a674aa0a4315dcf1192798116b348af8572db8a128bc38caf894f0ff107e75ca399e8aebcc834171

C:\D53A22A6\D53A22A6\balik\nehiralabaligi.png

MD5 3b9276770d08b3fb07b4528d0f102f10
SHA1 1cf96fc56da2d8a473a891f6ac90510fc48319f1
SHA256 6c917ed5766763e4da44acdfe3755a42b508ee90227343b3ab95d040ba7ee4f6
SHA512 be00d21789743c0d790440e879f46b796f022404c26ee49615492e01bb326e1f23629c0fef646cdc24c478b9a1f0489e23769d33ac2f9e56257abda8b929fab9

C:\D53A22A6\D53A22A6\balik\lufer.png

MD5 d6b7d8b9bd9806e51208923c0d395495
SHA1 6bade63edc48f65f5590605763c47731bda4f94c
SHA256 4c00b1f6731e6791959976bfe189e212798ec00b3af6bf0f34264bd5ef9b828d
SHA512 036de056e90ea523537547db4eab84d1d73e8c4bceb29434e2309265750dfcfa389d2a1df9c175730a3bab4e4831ea413bbedea007f536f1c0f4d78caebe0dd3

C:\D53A22A6\D53A22A6\balik\sacboyasi6.png

MD5 81ea60cd83249853fbb7e310fccff9cd
SHA1 74056f815c82905296c0caa446184ceb85c9bf93
SHA256 24eb41dab39a24f34f5e30857e4873dfcdbcf80aac1c668f605b29800518f4f0
SHA512 976404ce50c767b1537fc4304421b20aaad2d6dd77e4445af3d58bfd480c586df59a9c4da6a65c62c4591885c50a321696236ad1bdd614dcbd89072422825fa8

C:\D53A22A6\D53A22A6\balik\gokkusagi.png

MD5 66a8281cd748e9743eb4fd921cf18114
SHA1 3383b92be47fb5e79b50a220a19e1aeabd5857ad
SHA256 bc14a847f92fb822d67d8ede1d994e581b0b6ea2da36f946e3a6109d30ff7fcf
SHA512 9001e759fb8ba23dac6ddd59d331eaac8640d262d9174a693f8411a314975f4b67decc7fdf9553fbeec233b7df4f23e688c974f2ceddf4dbea501097738d1851

C:\D53A22A6\D53A22A6\balik\derealabaligi.png

MD5 6c7a3a61d935fc174fb58fe54f440e01
SHA1 854f7b8d09fe2064d58c9563386ef36e9b7ee0dc
SHA256 3e912c9308d061cba74a78e6ab8996746089b0ce09f2a23dab6ab1575277c769
SHA512 6b25f6770bd7ae921c012bf43a8c806c26ed0278ee2d2e82fc9d67464e6cb6d39b416f5e2c2587af0e89fb5b1d4dd90e85589fd0e3a2877522625e015c73eb53

C:\D53A22A6\D53A22A6\balik\denizkizi.png

MD5 e105e9dfbb3ce777398b0c6ed00e340b
SHA1 c73424cb9203e77c4c8e40e5bd5835d0bd69dceb
SHA256 6fa1dec11efba7b154cd78599544775750f9a33fb4a054758576b59e9d1fb4a2
SHA512 ab704aa10e298cf5ad3dfa5e227f1e5b2459eeb7b15278e482de6e3cc3d4c276e14c3cdf8d90f33562c9cfb8221b025853f580c9b42dab88beccbd2e3ee137e6

C:\D53A22A6\D53A22A6\balik\lucy.png

MD5 c4f17014710b57090116fc298ce4a090
SHA1 cc3a1c07915f90f331fa6088faea0a90075a3520
SHA256 62000faabf5a43104525104b9a3c2bf41cbb08422adf49c1895b103a4a1bc1aa
SHA512 e27b6c1f7884db50ff084af592c9d92d8ef6c325dcc543826a6f75f77e7a3205038fd91201066d2588c56a751eac571be63e004d2e5c31442efcfad2ba786bc2

C:\D53A22A6\D53A22A6\balik\buyuksudak.png

MD5 cd17258adc7101650fb67c596839f657
SHA1 b5b9be6d72766c667d81317842ee5d255e14ab03
SHA256 ff9969facf56cb3e0e97a33e703adf53d0f516462c93a9d90b71e9ceaa987c10
SHA512 2fafd84f5e84030716b5949370f307170794aef24aaa53b4668234e791bc3b689d11acb184f0371c891d1f8299b947ff7beec11cf398f8d88411af7454eccfa8

C:\D53A22A6\D53A22A6\balik\kurbaga.png

MD5 ccea991ffd32c1e91a6b72239154bab0
SHA1 a8450444b2e30138c86965e5be8fd38871afa293
SHA256 45bcd34d8d1f6a16ed8e117d975a43458182d36516eed8f34863e1feb068e16e
SHA512 acd3b65669b2c9b4875e7fa446cb339bf6d7e8416f9e1e3c5f53391bd93b5440f8855b7bd2f2e70632a60fae3d54f24094e607e5317b2e0f583ecd2d9677cbd5

C:\D53A22A6\D53A22A6\balik\kralyengeci.png

MD5 6ded0911e484712d99049c03224d93bc
SHA1 1308cab6c76d31c54bf602427b4ce4787cc8c62d
SHA256 23008e19ee9351084f5f05b360023d9344deded4be38bf856b9a35cbb178f4db
SHA512 25ebcfd80aab98aef5ad3112af68eb1876786e30eb57c72e10f9fb071672ed334cb586049fc0c47e2766fb23d411f8b6ec78a8084cb64d529d650f70c1ee5c65

C:\D53A22A6\D53A22A6\balik\kadife.png

MD5 7827da04d251000652140278477a78fb
SHA1 058ccf44c06e3edc8c95d94791d9e0b8b3afaa36
SHA256 475d67c0b03fff4718d36af486bc9e5de4f2ce794fba01cf180e7055edbe8bd1
SHA512 a19837d181bf294cb7ae0c88b3bc0e63b92282c6a04c9163a20cff53e646c00573d0624d85884adce620393580886ceb646dce09ee5fdcebdaa171e078a382ba

C:\D53A22A6\D53A22A6\balik\istiridye.png

MD5 39518a93ebaa2a99f3d0100330232305
SHA1 3b99d22aae7ce1f7069b133b3e1457537506e46b
SHA256 3f5f5ed5a0bb21aef2ed1c0e421e4b44e6c9de070adefd351b15313b4e155402
SHA512 a63817c1da83e07be3fa413d48843dabe1bb315391f8d8f17a30d4602b0de7e7d09bf8196f62af94e2ff56b2f71af2ab8043d2a573b9af130f894744e3e392c5

C:\D53A22A6\D53A22A6\balik\hamsi.png

MD5 41f9ba4b507fceabaef2beb094368a45
SHA1 2645b1b44f355d2fafcef5eb2d90efd7d27d98e4
SHA256 2505025555a3d1c9f1a39ebd590eb9c7d152a6d6aafc185a90a08e9d6d923e96
SHA512 8670f614ffbe5d937de34cbdadeb86a48dee5122776d25254ec819455c41cecded5de60df18edf98e4c9fa7c5478892172aa7a45ce72101533455a2183650659

C:\D53A22A6\D53A22A6\balik\gumusanahtar.png

MD5 cc096d750818727aeb2788122f546d9b
SHA1 aa4a9881a10157694baa3d4ee71956b89ef7c0f7
SHA256 b6c08b0d74b648f4ced436c5a4b9d7263161faa8c2f387b22ff4f128f4494bf4
SHA512 c577b01f3f2415b30eab4f9528b0f6dcd77a67a508a3cc7579fc09a0fc44e7ee64d38e8d2d7ce5fc65a966b07705c04f090eac1077c3519845d2457b5cb0d99e

C:\D53A22A6\D53A22A6\balik\bilgekralineldiveni.png

MD5 42a1cee52881db21a9909fec0110bb8e
SHA1 d2b386a67ef92f38c5f9402ee6f195d98104b780
SHA256 d6afa46e760f26fa4f550579a76eae37051d8be7644cfb36c6abe40d63a8e511
SHA512 b1d90bf2ab2c9978651c3e4585421142fb90ec662234d40c7c2ac68dee7623fd190afc97f7d034a97378877fdbe7ecf75202380aad913f321975bd80b6edc14a

C:\D53A22A6\D53A22A6\balik\aynalisazan.png

MD5 f39bf8729eaeaad5408f9b461c4dfc6d
SHA1 837fc2c9f6392f1f50594dc6fdfb897ed4796c82
SHA256 654d62c986dbab0b433a4528e72682eb71683b331b489422e7f181fbf419970b
SHA512 b073be2b0a12dda0cf2656e1254d7ba9a890a6612fe1db7901ccd4d0a8436f1a2c82acbffb189e8a61a49aae093ef53aea569396a7854d7c04f8067a84abe025

C:\D53A22A6\D53A22A6\balik\altinyuzuk.png

MD5 ae19cc20ce6d6b4557a94406927c52f7
SHA1 a6c3013f852d5ea7c8500b3c380761096c8868ba
SHA256 3ad23496ee83d742d25b4b67a5cb9decb30ed71e4b1d20f2489195413fa23209
SHA512 5ee1fd790aa184bef4cd1e74e22de848e11ca6f57babb25f7348d851583648298ae62b27df8d9eaf366ad6de2faf34d560cf859b58fa6ef7ddbe23f3b2330e50

C:\D53A22A6\D53A22A6\balik\altinparcasi.png

MD5 5097e82e3e3727596b8567d685f25e57
SHA1 d57b5b101cf09deeab6bb5528eae834fae20407d
SHA256 8d2823d3fe422d92f3ddb4b3c6a249a385c930c914cf3142013640228da8eb56
SHA512 407b2be5e58e1802c4671c6875b2895e4e795849fd3dafb7c5bd38e63ff5d3d7248bead896765df205b78ed03e379cf22a5ec911766145653c7b9d48a8fc90e4

C:\D53A22A6\D53A22A6\balik\altinanahtar.png

MD5 c0f7f15b500e2bcc5d94a2bcb627635f
SHA1 7d4de298f4fbe1b8a620a2a75aad7f0ec941528f
SHA256 27e5beb32bc624dd101b8ff6cbdef21b70636d06b92bbe98b81a610f4d07f277
SHA512 5621a38ef8f55c56e26ff077a04cc75f7c745337b2625a13902f01830c812ca3b6a669d3f9f32fbff9b9df51057c30367d394905876a042218c6dad228043210

C:\D53A22A6\D53A22A6\balik\yilanbasi.png

MD5 98a1f7af5132e6de9ff51a7045b4bb29
SHA1 8ed446a7c1cd4dde5ccec20da60fc5db993ca77f
SHA256 9b1641882190e316cff06f334b67f1482b575b44b3bfbf41cdb0651cf399005f
SHA512 c8220d907712ba431837622749e0a49fb0ae4410dc29aba3b41440be6d83f2af62a1ce26b0c8f571d99c341d38604909a860f0cd7cb81bc4018caea8b42240cc

C:\D53A22A6\D53A22A6\balik\yayinbaligi.png

MD5 5c73bd5b3e1c1ffcf38a45d1b084be52
SHA1 3d5e81800dcb6d343141c3479721b567f79fca89
SHA256 00ed3261e9c6935c78eb3f871a6583a6b62c5278afc006c49713569bef8c20a8
SHA512 0ccbed3d7b9c8297886bb784745da09d27e24f8fdad083b0743b03db52cc5321fd0672697bc8d2478d64610d57dd66b2d76d17ec7eb1ed5850dac629bf85f947

C:\D53A22A6\D53A22A6\balik\tekir.png

MD5 907ae6675ad72e933ddcef5cacc43e69
SHA1 4f51abaaeb99faec0780947f216c95e7002cd6b1
SHA256 95cc66fe17be7c7e9a9285a562eb919a2c531f2cbf1b1a89506472f29d51235a
SHA512 fd73819e0f8859f6513411d06eba99b9315108e63023a8fe19f3688dca01d134e501e9c422b31278f304e33b6cb90fbf94f66f8bbfd44163a9157023f2153d2a

C:\D53A22A6\D53A22A6\balik\tatlisukaridesi.png

MD5 a79fc5d13576845e3f9d9a115c3135a8
SHA1 e089831691e2fa73bffe119c85ba34f5d9987a65
SHA256 1ce93431c64bd2680338658fe3161f1fb820729efc07b14ad82a01f5bd458bcd
SHA512 ae830ffef6a174fddc91494c3f43f22f42e5bb32fe0252eed168b220a2d5be4a54bcfe25ca1d854cae2622d7b65dc686f57824a2a032f6e1d85c51181b0d21a3

C:\D53A22A6\D53A22A6\balik\sudak.png

MD5 ff4fce76b17cc38113698f25c68714a7
SHA1 f6dab34c6fcef417d91d998b649efdbad92f20ca
SHA256 11c5e557a073a8fd71f8d44e3d528f965470a67756a5007682371df634a11da2
SHA512 3b29544499708a90e2df0785d4f7cc6af9bd050a900c92b3fef9f8f6f94edcff756b8fec255c7caf1c31d240f59e005ec1677bcb76e15b144f47be581cfec471

C:\D53A22A6\D53A22A6\balik\som.png

MD5 1b276ac1ad071f782be51ed7652c1141
SHA1 ab6251ecd563f8192b658c0644dd4ffb84aad8f4
SHA256 b6f1fc727bdebeea4d5973dcac638d6fb63f15ee3229fd426aa67b3e1be2899b
SHA512 23671d1acfa2df90d552c3da0c7ff6166cfce0641ef6131ceacc124648ef4034b9bceafd5134544df3d79e727824f1f12a86eff8a9afef1e402dca64787f9002

C:\D53A22A6\D53A22A6\balik\sevimli.png

MD5 eb250e0992b9f97c2eb75b89f62394dc
SHA1 3fdd710615a848dc310ca417283652c774ce57c3
SHA256 516a53fa7f380bf1d400b3b160da2e6b75ea894bb846f707a9f85cf0b4eaf926
SHA512 189bcda1633f42fe90117fa4f493d43d1a630975862e0c6cdf072ee98189e35583b765477d6c967e5fcebd9b9623dc401f82dd018ebde28f0b245b959a6e5ea4

C:\D53A22A6\D53A22A6\balik\sazan.png

MD5 3a57679c289bc4595e6f634414b83cb8
SHA1 9688b8fd3d723434737c89fed1aa75fcc6a7527a
SHA256 e800d8afd98aae368baef554e27edc5d2e09aac813a1e8626430017da07de6a3
SHA512 8a17f76ec602e83279e2860a7b9f513c378b2ac341ae094f3e0d727a4193a39a79cbb27b58562cdd1bd7389dce37d40b85ce6084637d19564a7fe526bb2dd700

C:\D53A22A6\D53A22A6\balik\sacboyasi5.png

MD5 e7216b2e7f44afb4dd848748a41a97e8
SHA1 8f55a742d5612e2396d4b454d42a9d70f2d77e72
SHA256 eab986cd4a3c0aeabf8a09103d6aa3058d4428c50a12b868d3e7903096df8975
SHA512 2e71c36353453946615948ef0640fff92cd5e79e7369ee1afa867823230d9aad3f27c8a252e475aa65744f83a4b7bf1813f5ef9a931e4abe844d8b568d4b78f0

C:\D53A22A6\D53A22A6\balik\sacboyasi4.png

MD5 eb5f63c633071a89d6d9b96c44278809
SHA1 c13fec80f25df24b27b818a669414174c227632b
SHA256 2e1f1def6bcbf65fbe585d33ef0ce198574d7ca22fec7db18b89ab9045804276
SHA512 c80c24eca2d05a8b05005f85604efb202ac33fbddc0bb253d5d80a7fd605f5c6980283f5e382d531e7360aba1a2a537336a5da88af43439ed48a9c45d2c4f11f

C:\D53A22A6\D53A22A6\balik\sacboyasi3.png

MD5 d95b4d93f09dc9b3d3f12c5a9a27a546
SHA1 8734923615db0de47eea162abd97cc2a0b367e51
SHA256 48b7effc5cb6a00348eb713bcb7b4dde654c8c112dea309c8886bc984a75bb40
SHA512 cc8b0b1d24063fcd00795f5c8248803844617fac86c845b97bc5b9bee089c85d5adc21bd17ba0a352c1f1a27197ba0e8cc267fa89971b065e8b0ea4d7f5c3dd4

C:\D53A22A6\D53A22A6\balik\sacboyasi2.png

MD5 ee8a8a16c18679f0a8c425f778d4fe79
SHA1 6ab8502456264efd39502f5d01327585c404d868
SHA256 2877165256c684c2e315f9d7b75f7af731238d102b58bcff17f346da4ab5520b
SHA512 da54e9ea74fbdefcd2aaaa7f211a706307300bd5372af1d03f937af0888fa2bf742fe1e59d32afcb1dd806c1c79be98fffb92417ed15b53b77f5f9e0decbbab5

C:\D53A22A6\D53A22A6\balik\sacboyasi1.png

MD5 854416c69178b1d93b2ae096456d240d
SHA1 7460d9830d171bd61ff9d1bb345717186bfa0206
SHA256 f22eb22f80b41f2a581033dcd945a143a52263a88bb9136f976b42cf99a34258
SHA512 7aaf157e6377332a799fdcf590afaa866fe17818c8b45e6b8bf38420cbe7889c5219accefba7f889597ff1244d6aa26eceeef3dec8e73be830345c30fe5179e5

C:\D53A22A6\D53A22A6\balik\ringa.png

MD5 f7f342b5222fdb5833e8a0a7da6d1577
SHA1 6d9e979f8b79d2ddff243bedf3732bbb47b47d32
SHA256 eee6da66f8c1adaf1d8672c67bcfb3f3e59eb686b0f6a03c1f3a5a716b15c046
SHA512 f7e872c9863ea6903cbbab4ce3ae29306dd015acf6126260bb826b71ab885be7164d2b7821a5066a83d8a70563bff9a4570eeaa1ccc9948c6e5ae559f057c086

C:\D53A22A6\D53A22A6\img\amija.png

MD5 d63d9fad41f38d686226dd29c1e4be54
SHA1 88cd373f2abd476f2f582b6733f326a7aa69d48c
SHA256 dcae9e540c33703307dd01aa701a17d02419596f5eae27a9736edaed7d69ab78
SHA512 6fd00855bb6d1ccd2d6d691cb45f0435858298f3b4d8049ea2757daf2ef3ec6ecfc91ecfab334c6d7ef4efb671ba5d6d5f680f2eaa5963af89f8636798cd7e09

C:\D53A22A6\D53A22A6\img\altinparcasi.png

MD5 1ae3d768189a1d0b71ecaf439e86f0a2
SHA1 36b1ffd11c8be56681ccb3c4058ece1295c60a4b
SHA256 9b03c4b28ba6c10780029bf14ca6183576076aa5548dde13c35013e643cd5f71
SHA512 ffa12ea240788cd7836abfba9c7430cb1e8f363eda1be096b1de7d85f86bf3bea775ef668a35b6fb4bdd5a279e26c559ca1efa8b4ce7e069e63309bf80577a24

C:\D53A22A6\D53A22A6\data\balik.txt

MD5 12acb6b78862f4c5ed5ab63414f85329
SHA1 b8165c948a3e80e13dbe0aa1a2e0700235bb77da
SHA256 96609269c5a7116fd6b5c79c4f82b3201eee90dd89b8539fc263d6e530d4a908
SHA512 23c71d5729eab24215c3f6cc54685ee1855e772449872b5fcef7b63dafb3e7f901fffc587018652f77596c65b24fa72f00c9b270421ca6abc4660daad4d03b78

C:\D53A22A6\D53A22A6\img\ayarlar.png

MD5 d415a14f9b6eeb4092d685ca07d37f5e
SHA1 d770cc15989f441673de3991501f589603edafdb
SHA256 ac134ac53344df282edc5067e1ca765a3c9ccc80ff9ad7f9e7e0ffade0a48c50
SHA512 81103d7b7e5bde28d3c651ab609bb0a8f43e84f47b4ebae1e653377d49675f66df5cd480650e0ff385b37f1accf9bc533f5e1eba5335b9ede3ebd668e6e24d87

C:\D53A22A6\D53A22A6\img\aynaliSazan.png

MD5 f80f72eb62a426ad2cf4230421d554a9
SHA1 15d5005e620bef90f7cb08fb8b4754c5ae963001
SHA256 8498f4eadaee07eacb5c229cd5c4519ac4d996960697507aa06fc6035daad800
SHA512 cd376b01df8d9d70a0ac546df207def0025f309eba60217eec3e984d0691ba9143b71ebbfab279b57e1619924a91bcbad8a324c93776a045b0388f5ffb51c8a0

C:\D53A22A6\D53A22A6\img\bosyapboz.png

MD5 355b780ac00e38eb714a2b908dc2fb13
SHA1 a5faadbfc2eb705226fca7705d99ef1e0af77750
SHA256 bfe5ee8f0f4404b55aaf96d95265f65cfce50f37da03cb9e78039d8acc1867d9
SHA512 1b57702f543319116fc1b85258327d55595954dfbe81b2cf59e2442ce7f92f1bd594f72b579afd723c788a58c647b7ed68f5678a288b20e01c662d1892de8a8a

C:\D53A22A6\D53A22A6\img\envanterIcon.png

MD5 36bc5ac8c62492344d139ccb5b84afd4
SHA1 893efdc7b2f19db2833cacbd66f301e328498b06
SHA256 bf318747fdf7e46a5d382018620bc54cbd2ecd053f0ddb730dae433040d674d9
SHA512 fa8df91ae57fb4971d2104cc2f1c600322e2094eb897bc6779d047dcd47bedff6b4d6bf3ba735fd14643374519a08a5a0da57c668d9a9d82f7649701435bb46d

C:\D53A22A6\D53A22A6\img\envanter.png

MD5 7a226aa4e07a6ee886ed09cf41cb2786
SHA1 e803ce3db93b7f114552b56616b1a3b744e257ae
SHA256 f1c47a6dd79cf553ec0e1049f2331eaac85fb4223b772a23ed6f8d9410b9445a
SHA512 15f7edcf11835b80f848e7e44327da828e22829db43bcc3ce9d6e95c833684ec8a7168b966545e5128cde8f1e534e51ba6167b3f96e604130e3d6d8aec8596c8

C:\D53A22A6\D53A22A6\img\env2.png

MD5 b74d55f970b05a964969284fa97022f2
SHA1 d514d246902041d9eb54f9ee70a5e466d0a5ffa2
SHA256 40a323a380cd0b820192665321f8c7c3a99f5c8b52cd7a0dd44a4c56fd538cec
SHA512 bca9c9c7dbb1cb433190d321b9b18019674463fe8ee1eab971cd84589594108c42fce115c6a0607e150b44ea17b4a4c6022fddc911025fc286b497c0d47f9a27

C:\D53A22A6\D53A22A6\img\gokkusagi.png

MD5 36804d195ecdd94310e436573ed62127
SHA1 b2d769de4b229e216c19df126378ba7e80482eb3
SHA256 692e0674d86e88a6c68de6fb8a2db030d03ecf19452d53bfdc49bfdade7b42e0
SHA512 b815debeeb0c2f80798b8c2c3f7cb6ee14c8c4979e3346c115175c59c497afa9b09049876907196eb94c2b151d6171f1fdcdbabf274122c972da4d3ebb2c0e7b

C:\D53A22A6\D53A22A6\img\gok.png

MD5 caa9782b4a9719a1787c4c4e0fe3abf5
SHA1 ad922b0b905800704663808880c5aa3d345d42f6
SHA256 b2b3d4fc0f15ed4d9511f4438bd6bce3f2e1c7d39c09f003958720318e7757ca
SHA512 2ab08b0d3f9bf75149183111fb20bf526dd4ceb7e67f6ecd02b91e0a9dc0732be95863b2ce4fd645cf9a950387480db5916ecab8390e8787644792d2322a6b9f

C:\D53A22A6\D53A22A6\img\fishing.png

MD5 d7604e4ea4cdd5482f804c3d41bd5bbf
SHA1 2ae2f2859d5b4180ad3221674e4e31c712306c83
SHA256 b399409a9b7ee9f6a3347aac92473b2f513d4105507ce9cbb4392413affbd552
SHA512 de7a79b8cd7f742567552c8a403d7588adc743b2ee15f5dc3d5f4f25faefb2f89dc1ae086262feccf2136ece0a55bddb02b7a1b431df907096107067d8808bbb

C:\D53A22A6\D53A22A6\img\envanterText.png

MD5 296d14bddcb3db5c359c133ff60cd9e9
SHA1 79c33101f8067eb7c34a9d822889bc68f73405df
SHA256 7821c3b9439c3381584144f46a6231d854d22d838ba3f689234378617d46ca68
SHA512 9b692fa0beadf61b263f376f09d33f2cb99ddc1336a38ba58fded1ecb56bc34df9ec2e608c3c496681d5e789562827c3bcc292692043e07c15062ee2108f4cc6

C:\D53A22A6\D53A22A6\img\env1.png

MD5 bba70938c1f2c171a2e797d97f8c20d7
SHA1 03fea354211cbc1819240aa73350276805f5e259
SHA256 6be8055e6dc2fc3f662ce4dbedfc21769d38a76c7d6ab64fd32cffeb416a1322
SHA512 8f30243da755e3d369d82e59b117990f74bf3264aff28ada404e9275a2f71b90e6726deebf1cdb577f8d82579263657069ef497e320699f19b0a0e3e8196a10b

C:\D53A22A6\D53A22A6\img\enter.png

MD5 3c4e1972d3917282296e92d54d8c00c5
SHA1 ce1d8a29d8961cc0f899b014c39b5bf3a7c56cc5
SHA256 8cdf971fda1b1abc13c665660565d248bb6be961ef8f73987cb487f85b7f8b8b
SHA512 7904c28adf00c5b3579a7c779da8932df6d4459a186e85699f69de39474a52e21c6a73f3d5b1c7cebfbfe277fe72c9a1b0bca0ba704ec055c177e24756592682

C:\D53A22A6\D53A22A6\img\dukkan.png

MD5 dd3c6454557125f7d423e0c089dc218a
SHA1 2b43507ab1fcadef6d4b51edb5ce85811750f666
SHA256 45df288d320ab5c1ef6f0d502f9c82da9f7fab46510701979310b1919153d489
SHA512 f567171ff568d324938594ab9af7fefaa2a05fee097d4a845111b871c66eb008e5c7cd76838e7783e536fff04801208dc0bd1469f167f32856ddcc3536ea0fde

C:\D53A22A6\D53A22A6\img\demir.png

MD5 8fa97146c21c8b864b85e1f79fdff4cf
SHA1 da32daf12ed4e55bdf8bd01e6b13afb20e71a978
SHA256 99eb7d994fb0c950e416722fae4315ec4433832f7e4be83766c322800adc6198
SHA512 5fe5befed87c81eeb3e978752982a78e5312d3b9049bce61890b0917dc9d70b3aee3e10b386c0de49be3c50f59a95066366e262f9d75c33b21463c83157d5df0

C:\D53A22A6\D53A22A6\img\cikis.png

MD5 6773d8d56ea5b337e5066e96388638d3
SHA1 735e7030e1db14e9589d9ebbe25788ad9b851685
SHA256 3d19eceff1e3eb8ec3b1516ee2e631d21751dbcd24da1f7db182a250280b8e59
SHA512 f319c8c99634879c10625a75f2273dc4a26eedcb5c6d0287972e78347b183d02a1652b377e394ce01183b99f7dbe7dc6c64328b2002678e3910f946d213a5955

C:\D53A22A6\D53A22A6\img\buyukSudak.png

MD5 522d29fb3a437498ade2ae035606cdb1
SHA1 0a93e78c4e802257ded71e6d058aa118eb766a9c
SHA256 5581789b730dd77eea4e489c6d86e427896386c149713562b69224e5716bea43
SHA512 a6c39bee2035f9e73ddb93a337dd5b96abe6645a38fa139686acca294fe4841c2fb9ca656e85577ce24077278bb9f0e6daf069ebe8b0c94682c16b7edd2ae7fd

C:\D53A22A6\D53A22A6\img\burada.png

MD5 5fb63442151dacd1c4548f51bda9f6b9
SHA1 d0c10b468e736dd4cd519be379f121c8ebb2f9dd
SHA256 4b877a1899e02ae517612ce73dbbbe29456fe4b3aed15d4ff8f78fc425a46488
SHA512 89e48c2e7cf113d920e4d162273523b1e26681acdc71a6a1b68f305a6beadd936a202258484f52aa2065dd70aae780691284e29eae552ad101788aa712c9eae0

C:\D53A22A6\D53A22A6\img\bSudak.png

MD5 99a08a3a8e3a3abe67ef8718810907e5
SHA1 369415ffc32973906606e6f42edf307e1f78267a
SHA256 0a4306b51bc8ed77481214b924ae08eb32539f9217538bd811cd0f15d0ebf377
SHA512 9c327ae7722b7eb8aaed90daea937e08afd2aa9ff2c51095abab1fb3580942470d0ffa2bfa2673ff846da90eac6cc2a9a27c4e2e891a4d9dcdd673c26e56ecec

C:\D53A22A6\D53A22A6\img\dereAlabaligi.png

MD5 7afa4cd02b14817217efe35c3ce3107c
SHA1 75ad16dbcd229b95cfbd5535b547e1fbf524f579
SHA256 fab6faa9a125044aa80361122d2aee0487aead4bd76701050ca0e24768a429ab
SHA512 35a1dfd8c19510575b1c84e9ecf6280eecf82738f7416675d7e76ca1aef95527336d438d91c0bd18421a7527f472b10d1b08bc4a2ba1f3b88e3877a866b8b1f7

C:\D53A22A6\D53A22A6\img\dere.png

MD5 d65505fd2e7c072da6c92a7f43ed846a
SHA1 a477497d1e29b00e21f083d33ada8d1ae45563b4
SHA256 6708136c419889ac5cdf05dd98ba2a89cdaa16f23f4f5fe764ae94df39f1b806
SHA512 973875a727401dcb5c2d3130c5e38b85aeb21ed6e9f44225dcb6e68fd558247f485d38ee47d8c6db29e10d9950d3ab36533fc9b665aa084fc1ee2666692db433

C:\D53A22A6\D53A22A6\img\deniz.png

MD5 30f0d48ebb41c5cb3edda1b39abfeda8
SHA1 9045775701c1099e9ecb445f146614a6a73f0a84
SHA256 891a2f649d857aec7b0367c8618d0ec7496ed2e59793bfad65142c5278eeab9c
SHA512 77422c726ad79b9671fa453ded836f65a5c6da449c9bf1d6eff9876e655790e8927f5a28bbb1569830444e0f3f8d086275f05ea8128ec64f02019feda5a68714

C:\D53A22A6\D53A22A6\img\bilgi.png

MD5 2ce66cf79b9662ab61c99ba5b1577dbc
SHA1 138a28208c0ae47b6d0305a2eef211f7a8fd1b40
SHA256 e7583caafb88f545dfdb23e87521ef713b4c7294670abcaab274dd6e35377a30
SHA512 ebe00f174449430b9708966c523c87256a3e4a5b2b3544eb599e4d23eb719b1b0386be9226b93f3936b4aa4926546a80cc31beaeec8fd89017433cbd90de6b7f

C:\D53A22A6\D53A22A6\img\balikTutarken.png

MD5 da48bd936395fae42890789428bd37b8
SHA1 50c963f473ddfefb34fabd514b9cc1f4ca700d6e
SHA256 0b310655fa824a0cf3bc49a3fe7705e9d4d80c6dff7e5d292de7c5f470c27747
SHA512 c468f7e2c5497c00505a6e293b573b4077c06ae88b245f7e6fcbb7f2783fa8bbc2ea1771fd731c4d98ea3159256bd0a2f8ce96c6687f425997e4dae9a758eff2

C:\D53A22A6\D53A22A6\img\at.png

MD5 cd30924defae734a944237272f1ecc81
SHA1 7662330738b7a01f6e0db3523def06abb9202af8
SHA256 c37d1d33e878b2065183481b8d02897adaf466aed15ee5937d04e9dee0b4658b
SHA512 6361773a35539e996a3f1fd6e117158719ab3e69977afce88a4a4938a75ac698eef36074886e99ea589f4763fd99726d02de5237f443e2e8033f99983ec79ad1

C:\D53A22A6\D53A22A6\img\asplanPlaka.png

MD5 591df1dbdd028fd52a46019c2c5a2911
SHA1 8ee69fa2b6c0e3372a1f9c9f3dfa0a52cc0fcd40
SHA256 d2779daf76af1edfc953704ac80bd2fe09f16d5d4b6994295233b2bd90e12b6b
SHA512 75115072c6599ad2351773a05f59de5620fa77281207a14de6f19f8cb4877c25b7407d78b7bbf929976a2417e5bd8ca57674c7beda4b5b64adcf59550cf12c8e

C:\D53A22A6\D53A22A6\img\altinYuzuk.png

MD5 edb7b045eee1eea823969d8bb510a2e7
SHA1 c39f13a49a18d0d21af099ffd787247588565408
SHA256 bc1eb902cf2f8d2f521aa8cd6cdf4196ca41b9842d2b3cc0ff68a4c6fc8c0bbc
SHA512 43bc3fe99cfd340143f3b5187c41cacfe11ff0dd7d030ac3b5c2d1026ef40c626cead86eb3f3ec5acc9aa8b9a05eac9303d672618b9c545e538cc4671a1e2262

C:\D53A22A6\D53A22A6\img\altinTon.png

MD5 ef028a2b2bd3569d7ed7f734229e54c3
SHA1 7245a161e9e84448af07c3d2a7868563bfdad994
SHA256 f3387b01bf013e44113fda20a36cb30db1d49393baff3f4f72c7ac7248851072
SHA512 88b94db369dea28e171fd402cf5bc1e9154b477228eeda91fcf7914350a934801f6c0418204ba9c4de012adddf0fa1f0237d931605812d7fef09370e0cd1a51e

C:\D53A22A6\D53A22A6\img\altinSudak.png

MD5 9c6ef86900a49fa36f27c8cad7c0fde5
SHA1 f76b35b87a2b968549041423ca225656c69f9b7a
SHA256 abdecb6bb9d6ffa892e8aa3871963e085a17e922df527cdd8b91646eecff952c
SHA512 cebe4be47a694acca38b6b60767ad36d303e6da20e26a5106cbe861ffadee6f9a134b643d62638d5a877a20f935309d33d0bc7379fe79225778da894303a0e37

C:\D53A22A6\D53A22A6\img\hamsi.png

MD5 7c025346ce10e4b25a5b7095e9e33457
SHA1 10bbb9dab376a85aaad571b87799d7e9af78b175
SHA256 311073864e1ca780c26971c3b40fb5d8307cdd9653f3e319cf7eda54b7a0c4ee
SHA512 c84ebc46abc9569f3c05e8b6a05164f9ba1b0e6e27d3f12b25aa06161f89c7ed0899fe1421569f2193b72a2c45291ba887a3d245026c12e9dcf26f697c14e493

C:\D53A22A6\D53A22A6\img\gokmavielbise.png

MD5 63e8f806fe3b6ed6c59a3e4f1634c46c
SHA1 6be4029ff5224245fc80a0063cffb072e58f2809
SHA256 d386c097cdad6f602864155eab97a10094346f4008aed93389fa73da4950b715
SHA512 1def03da0be1db77c9294780ea659c659204ddbe6321b760ad37286c20559be5df5e155d90d91f96fe9d93d6ce7d1fb14a2302691e87c69e326878e0e3b2eaae

C:\D53A22A6\D53A22A6\img\gumuscan.png

MD5 c96bd234daf1508ed349930caa516dc8
SHA1 6ec41829de3b679a41ef20034875f76a4c7c403a
SHA256 6be01ec6a5a94549702d1e6e4eae8132e4f62c3dd1943311c5f2c1da3db4a274
SHA512 62814580555e84ce6ffcc083a041dc7167dd89297bca9812c9a1ae6d22dcb18089c6e6f5821ddb18c66956a0bc757552ef45a4c726372fcb3a2cb490fcdf77fa

C:\D53A22A6\D53A22A6\img\gumusAnahtar.png

MD5 5b03d70415ccc38bb1e2c784334bd8df
SHA1 719a4cfe816ec342973756157b696b029122bb4d
SHA256 b8eb0c3013e204732510cd57c5a77b55c2f2b10fb1ec815b84e503e39d1384e3
SHA512 d962c2d63944964de00e18e0ad8098e87e05d35f091c0555434a7f909be9e58072e0dc03baa7a5e99d0b726bdeba94cc94001e1c765e238741ac58e3eb7dc9d8

C:\D53A22A6\D53A22A6\img\gokmavisitakim1.png

MD5 72048db344e7c56061017b1dab1ea760
SHA1 91e2bd35d65babbbc9ab7962f315203e1bbce811
SHA256 1f6f36a6727ef84e78c94bb831f9508f214b3a5911025538c152bf69f3cb061b
SHA512 d243c58671d21a3b0434ff6476669863ca1c2f5a83cf666ebab972deef0161da5c19e2b5fb07a89db37096e56f6a67d64f4b6a86ee0930d536921dd64a2f6d4e

C:\D53A22A6\D53A22A6\img\gokmavisitakim.png

MD5 bff7b50fe03149e963db763c49e34b3f
SHA1 1de88f4c213e33e24c9be994a32463a116e400e3
SHA256 dfa7d845c7e1f7dcd7ffc629d11b8002f55182f7fccc81ef30de150657aa9428
SHA512 b538b8f9e41e39077171236a2652907394ab93a79023521c1aeae28b4d7b01ca63da44ed8decbe8757cf356af95e7b399bf5b9f0b1ab402bdd209d8f3f3ef0e8

C:\D53A22A6\D53A22A6\img\gokmavielbise1.png

MD5 7d9c65780eba4e43538cb75c4ee21b98
SHA1 6d14eba7a6bd0294d5ed287c84afbd48a4cc2a49
SHA256 5b8c752bba2f6209137d76f7e0c9c5b335406732f130b50b9546ee3852e01b91
SHA512 0cf9b38fdfbc05baacad88b8b75fff79f7fe32862b95142db5775de25b84e5e190e578dd7db305c642654eff6157fd90d61ebe05dc604180f204578d81e953c7

C:\D53A22A6\D53A22A6\balik\zargana.png

MD5 3715026d388761aca501a45f6c1edd49
SHA1 2b1d912adff60365e50861f96259b34a5d038083
SHA256 4e0b006aa1efd1546186bf5ab72ae3789f9e9a8d29b2991767ead43495ce423e
SHA512 51b3ef9ad581be8b817fae2c690361eec1293084e013f322dc9330cf650913c378adb3023001fabccbcdde999b8152c222eee60b53b88f9806386e8dfd441a12

C:\D53A22A6\D53A22A6\img\altinAnahtar.png

MD5 05905cd8a7ae829782471aba8d512289
SHA1 ddeb392587e5dd98796e54c56e6056d310f88028
SHA256 c4b9a9433f1e9ed693ebb0660f0f293ee34e2d8ae6bc31f524e8357bcf12e1af
SHA512 a6be8ca3b018b75d41c8aded533e0e2e35d8b6ef89c5b0cd4983b1d73742769be21e75653d13f8bbda0e377db3975da8ecd104f353e4be665011b25e7f762d71

C:\D53A22A6\D53A22A6\img\agitplaka.png

MD5 f4c972d78fd97d5bc7096fd5e2cf488a
SHA1 43b1b4849abb7a6361e992a28b34a532301e4b57
SHA256 f4ab84328c20d20604af8824a14d5e1e93eb639c67fb29400d002726684adce7
SHA512 d74195b109f5dd2c9049edb795f995da265c3f850369c69c93a4adbf6489400ecd23eba0305269e278107346128a44f2fd1ed67e751ce8f5cba4c20bf3fbb11b

C:\D53A22A6\D53A22A6\img\2.png

MD5 12e3bf3b19a8a4d7a65571609a600cbf
SHA1 c86636f6ad53c0944ffb0a14885cc2429d635b6e
SHA256 d7e1d2dede7947bd33adeecd15bb4029dfd3a65d5840a2b42c65e890727a6a35
SHA512 a83918349273ffaa3f1e346bf1db933670d7a190d199c9542ad98f11a05bd6a1b10ab906e10e29e92af76d3d457e8baf1db17a37b143df6bfbcdf6b552b7e1ae

C:\D53A22A6\D53A22A6\img\1.png

MD5 1e8f6881ee73fccc07f280f426f7d85e
SHA1 91149f251b95560c6e33146c588ca4203abd6a0f
SHA256 75371c07dcc2dc59862eebb1a0ac9adc6a04c1c0a5654eaef0dd5614e154a03f
SHA512 80b2349acde1f1e2efb4b008c1286724f711a983688f88cb0116ec9e8fdb65bd4e71779edb18a16cda7282573bc283cd46506c2869aea2fded8bd7e68a790300

C:\D53A22A6\D53A22A6\data\kayit.txt

MD5 f39264176fde8b5e8d08d973d8337ccc
SHA1 fb33ff8f871117ec29feb7929dd79e65803ed9cb
SHA256 f0288f9c5131387bacda840780499138d18bfad35dc2f86f2f05a8da59de761f
SHA512 b1a6e78edbaf05ef5a42ab0c3c8300d2e6d303e458d461490556400564b8435db8b93a428d211e7db9c49c2a4ec4d97c50a31f388d8a98a99f5d46ae05f5d7e0

C:\D53A22A6\D53A22A6\data\giris.txt

MD5 4795a2645add7255940632fe4f33c9b9
SHA1 b0f24ba61df451f88b686a186dcc03b1bb5f59e1
SHA256 22f37a0b388f762dc1b8895e21844a47e6bbc1dc1aa159829f8afd366d1fc70c
SHA512 7f1808a9f45fae6c2e642e704ccfd5edd5006b9db4d417a1700d391f8ade526c3ecaedf246e69aaeb3abdae968679117e0c1f42adb073395e661e603e551f48c

C:\D53A22A6\D53A22A6\data\cb.txt

MD5 3d71696405c14614536656678cfe2b25
SHA1 e1d5b541c2c432db0904a7396c3ceda5dceae31b
SHA256 3092c3d8f374f835c828267d17d913cb341b64308296fa50b4387040944d276a
SHA512 6bc92fae3de10d0916e7167e4f645459d6ffb9b47391ec7972ddf5733fb705793d90bdfc83a542c1b53f2515c34425306f1732e8ab6c716116aab3bf310e0827

C:\D53A22A6\D53A22A6\img\hamur.png

MD5 8896c98d4a737b7a9f0df21ddc5096fb
SHA1 23cf6de0173e1b5ed24cf91a6804c41b5bd8b127
SHA256 e1fa8ef399be65c6e8d54c1dc682d4f9ce98f0b91aba7be31f4d840d0c8214fa
SHA512 b28f28824e30b0edd76d044136be0d986fd82c168e5ea43f357783e5d3e8141116d1e901fefbe804c95d26c931a1230a9f480b27fd5da9f8080f3b33cc93f4ec

C:\D53A22A6\D53A22A6\img\harita.png

MD5 573ad5cce02b94a80e14d96a5fc9f21e
SHA1 1ff66b81444aa7cb6cb506fe93976ad2be32baee
SHA256 5c82d990cd914f76557efe141473a40d842c862c6abb3bd033b817164def8b7a
SHA512 49f419aaa5900a20ed771d56fb194f497679182e5cf1a2191089605d88c134b83de65451a5a32c463c4759668fe3a2155621e135c0b1a980934003ce486d0de2

C:\D53A22A6\D53A22A6\img\ImageSearchDLL.dll

MD5 8b58c7745abcf4ea4d362b81f22d87ee
SHA1 c2750d694d103fcb5ef3db0ef719ccb0f8a16ecb
SHA256 020b326dd32e80668e0c21f1ac09c8b02bea846fd9ab1b1e9d2f079ddb8d1a47
SHA512 7a6bf8bb8c8916f3d2f08199131e15d1efced9a67e497c43f49098315b3af79b306c170924c59405524aa04b659d0bbfea0aa29e59a6b34398d76afa592cb558

C:\D53A22A6\D53A22A6\img\iptal.png

MD5 84d3453d1dfade99db3cf66f3d635ecd
SHA1 929929c764bf243493baf99fef605e8d33ad0e1c
SHA256 48cada590d021dad55f9401a5ecbe9b190b24ee6ff93a0b11fb523d58ad52104
SHA512 a01444b1e802169ac2953559ea755f338e9062dbd5a32673492153f70b95e7ddf960c6dfe61547d0e1ecb0ec9d703fc00586746761a4c04a6f7c7d8298941e1e

C:\D53A22A6\D53A22A6\img\karbonolta.png

MD5 2e6b341bb5436e4ddd228396588d99f1
SHA1 952fea72799f7e45411120dbf6e68c6975a3fadd
SHA256 26538baf8052dfb4bef9c2e82e6cf8a61d0e9f5bf842c816b39aeb190d8e2be8
SHA512 f85f3cfb2db8ab04075255200362d0b7c3a1217f92707d5271022bded9dfd2dd5461378299981b23bfb19440a6599eb8d928c864b8ce244a53bf138ff136ec2d

C:\D53A22A6\D53A22A6\img\iptal2.png

MD5 2fb1e89f7ba1c948a7f5fb43b04a2193
SHA1 37f87127b806a1a9a052366db7c2825a8d27f90e
SHA256 ccf5d04724cb82e842d7b4cdc9d3d968ea8c6bb34907e88fad0ba411fc6a9422
SHA512 de6ad85d867f48ad0a4f06d3d60e4f5dc135e1f92b154a21bb6d7a36a329421f8b14831ecb4ae5fe761e48da54ac4fd7a13ecc197079214424017476483a4356

C:\D53A22A6\D53A22A6\img\karakter.png

MD5 800b22ae6682ccb6ac8f75e44ce9b854
SHA1 5a4325bc4f24ffc102e41244f359c739ca35cc0b
SHA256 bb0af362ba02b34ddbb064e47d15e910cda81346494e3104d19fa07fedbe4ae8
SHA512 a79379ff6d73318ab614638fbe4fd62aa5b232b29234842505090c16f178609a6b1c0619c2b6b4afbea21fee8b3bca4f814a359768a3264e960f1127cd68ad4a

C:\D53A22A6\D53A22A6\img\kadife.png

MD5 d11e2d456cb79803d5ced5a6f129989f
SHA1 c542ec5775b10e60fc904829d64fb7bb830d1167
SHA256 a0fe5b8ff37d59628a9fdf39932d314765511179ca118bd71dcee42db32afc71
SHA512 7c56917fe6deca90a3b4e70b19e904e53241b2d9fc571a08dc693fc542b02d39a4be93d865a7b6dc19b0df436688d1d67cdac174374c40cebbb9ee16a0aa07a0

C:\D53A22A6\D53A22A6\img\karides.png

MD5 3aaf6eac4e3ac7b6388993cd871ce2e0
SHA1 a74206173ddd22e55c1b2169e8bfc899ef84fb8d
SHA256 4bd742a91023674a631fe1502c2b8b1c354cbe0d529156b37cfb64f3ca9ae615
SHA512 7d59f255c37e2a14910e9c2453cd3770b5034cf6a4af93a45c551bf96dcef98cad4edd556e1f1e6ca8a83093b9cd247c58bc0a8320e9641765f56cdaaba66242

C:\D53A22A6\D53A22A6\img\kesisplaka.png

MD5 eae7ccf61d0b47b4104dd630382557f4
SHA1 997936634bcdbc03433ff53e73da05963764b972
SHA256 5810a94e5bea36e4efc656c25690f560475799f2346a9178048be71b9ff1ef09
SHA512 2789f5c8f1f249d7531a99a89a640c2c6076fe793d6db610a6b13225a27be75605ce94a3f51f0fce79d9dadf40c5a894101d8303826778dc2ffc37cf2f546539

C:\D53A22A6\D53A22A6\img\kesisplaka1.png

MD5 d49c06eb0923ef93769b28056c10a57f
SHA1 1147fd5caeead765fb36233b54b85bcdce03d504
SHA256 fabcb00a8967a736cc0e9a9e1d85b6663eabc66106661fa7a4b8e0aef80f64ec
SHA512 a5f4a725e9cf0a85a47bd5f15023550be22065f2554123255577d089709bcf57279bb7ae78b5f1fe586a40b47a5fc5c708c7b699921e0f27f53474df4d2c2a94

C:\D53A22A6\D53A22A6\img\kilic.png

MD5 d3c2311672ae3bf0738959d533f2e819
SHA1 fbc6e48dfd274b3185b34338a230b31653154a88
SHA256 c267decf7678ac0482cc7a3075dacfe90ed84efe0974692b47f28db76abde3b0
SHA512 03575fe46b06d3b439245461bd64e10bf0ed86d02c53eedd6032b8d4c5cbe882c1eb02d76b886b2f6f7f27c1986ab2e2bff5f924551eb121713245a67df7a39c

C:\D53A22A6\D53A22A6\img\k∞sab∞cak.png

MD5 3e4ef4e050a4e518110ae5e07882570d
SHA1 832bd059484d74debef9bcd7a5973381ba4b5b66
SHA256 0470b0aa0af01e6dd9a793a9285d2c2d0311a1b30d0a4bfa6aa0bab58f2df815
SHA512 a955a7fd0bda244364d2a00a1703db1a4b1de67eec4485e603efcedac0775018168198407a6df5c7a94969b4432841125dc331e2e4fb12fc4e6848a2d5fbea84

C:\D53A22A6\D53A22A6\img\kurbaga.png

MD5 5d2e8b905ccad29de84a663d8d918a05
SHA1 c6780a5d0ff42369a168bc060dcae5ba7476137c
SHA256 ccc92440d851bf9c9db9d65303a3386bb7050e892649de95ac54bd7b9eb44e8e
SHA512 2017e9fceda3a11fb6dedffbf00c56c5954c0fc423473c84450930ff3ef2a4302d49d7af9efd8fd21b05d6e568a2fa208d618da18ba1ec19996e86ec463665c3

C:\D53A22A6\D53A22A6\img\kral.png

MD5 570562d0b3e43a22a1b4ddc957fd5c18
SHA1 71e849213fedcd8f9dbed58bc78003e18237e883
SHA256 7e596e9358c145d8ab9573a55f860088426c76fdfefd08c3c0c440b834bfab6f
SHA512 70395f752256777c944b36a56616e067a72e2bdaafcb9fb64f03c342bb0084d95df58b4e0a23e5de399bef6bfba02d45332e1d48d266674beacc5258779dbe56

C:\D53A22A6\D53A22A6\img\levrek.png

MD5 b6491be1df49691d0a29ad9db0a89aea
SHA1 30e0f9616334f08ae3bbfcb9c25caf0c8c092602
SHA256 56249aab2b93b8a7602cbc2cf35d31a5828f8de4865c0a8e9fa2a7d53bde0c9c
SHA512 ae39f3afce64b02888fd07b4e4cfc5c5acb626d312b26c1316b1a8d780dc5f64753384854ce1a0886f23e67a9b22316235720ccdca6f651a92cfbf31122c383b

C:\D53A22A6\D53A22A6\img\loading.png

MD5 d90aeca52111fa82cbc6f531edb8afec
SHA1 8e2a35c1855a10dceff7524dcae047eb8a5bc450
SHA256 ce87d5c3109c4b42016abc8ab77a1c00dc05259167a631d4c4248b0a4c7b239a
SHA512 e35d29b573d28d16f3097d70afbba6cc6e99bd1effa1c770a77002a104f5fa30e974360db3a04dced6d4ca32c4e53796a83629da715399647b8a28bd875633be

C:\D53A22A6\D53A22A6\img\lucyYuzugu.png

MD5 d25358e87b28e57bb395c0cd0458298e
SHA1 f683136160de759d773002b96be1a70db8cb2486
SHA256 f24573426215a4401df97c678d9df15a836a384407fb165f4726d6b243113b50
SHA512 245ccf28eb35363a02df3c890a83d9f8fb87c0725ce1216b27bd5fce9170721cc52eea72e48e522cb57a32f8f5bdd1510436100323e9b4d13d96f679d863af7f

C:\D53A22A6\D53A22A6\img\lufer.png

MD5 0ab257513960525b65752e2b245142bf
SHA1 14e356379e085aa0b3b392b2cb869e50336deb8f
SHA256 bbc3982e7e3986b2f39171ec6eb14f6b62f33eb4cca2a88d5ebe738965a36d21
SHA512 3794ca024ffe0e7a7e6f59094805173d7555f44586299940cdae34a1fabb9e414e918cde13bc9df53eada98c7b0c8e91a9210f712f8e5e384d6e956fc8762741

C:\D53A22A6\D53A22A6\img\lycan.png

MD5 b2105b15d38d1c6c452beebecb106dba
SHA1 1a0fbc5733146575b13aa43957c81fde2894837d
SHA256 17cb2838c4bc9ab92d8829aadfb74655a8b9aa4e026d8a554174c7f15b4b6865
SHA512 d2a75d70a1c5259b7d255bccb31484eb0cab1df633cac0bbc26ec26b7a295f2c5d9aed86acd9e3d95fc7f6fc9947ef41cb4b9ffcc7c56bfe0c8314bd6cdb7db1

C:\D53A22A6\D53A22A6\img\miktar.png

MD5 d8fa2cf47be8a98040de6b25200ff4dd
SHA1 a2e65d8adac9336b010915bd8b8b8e17c8166fd4
SHA256 9ae40c054c075c4225921aafe7326d4cf667433c8142d4bcaf9dcd97ee1da435
SHA512 c8afe153bf32fac35da44597afc51db11c1243878831ff9a2163cda2ff13902c0b7f374f6d4b4c160a79fe5f1ab81f81c050dd2d2bc9924e81309b2a7d0d75cd

C:\D53A22A6\D53A22A6\img\lycan1.png

MD5 121c46e7280a196ddb4653ba081f3e17
SHA1 07c9efc018d7a3055d1b6ca31f9a73b980c8b77e
SHA256 4d56ed5daac91b0305b8db231a845fbc5c5d5b79b16476836c7bd51e30983386
SHA512 cc585f396b532d6a1007cc75427c3445ce4fd340a531ae881a47d851a5a4c2112c744cfaf6b35dcf9639ff3783a72dc6d03234e1c2ee65e166fac45d8e4e6741

C:\D53A22A6\D53A22A6\img\mesafe.png

MD5 aeb256f18a67af7b6f79acd9d8db49df
SHA1 3c9811b9b1759fc238f4db86c890e5e17ef8a131
SHA256 272e3a700e383d2b6a3b3a69721cae914bb75422238e526b05f1c23fcf6dc176
SHA512 1723ab66c0802f6bb957de900b01ef30b70e0cb952b10535b0f0e9cc4ff4bb38f49402b8f9f96943e641dac0b64421fef676da262383cd632ecceafff0ff84d6

C:\D53A22A6\D53A22A6\img\miniGameOrta.png

MD5 30d86d3bcc0dee17f88bbb3d3400a839
SHA1 85262a90448c5b72cd0ffb53c21987b44280b530
SHA256 d50a3449e6471afb753c45b9d88cfc01cd6852e31ea61663975c89eb4a8145e1
SHA512 0741f0693d65273161407785e7072db3b3b1472b0b659d68960ee8df661d4f556298e300e320c14283092333fcd0d02a15decc8ebe5c41ad21bfb43f38055513

C:\D53A22A6\D53A22A6\img\minik.png

MD5 9a9fdf14c24419fc24b3dbc01521e8cf
SHA1 b6adb824c7eb9aeabf6129f9b20968ba7b419e34
SHA256 1ce1f0f6fa753e2e6fee5640cc57bd29dd2d15c08e636436ef01ed0f9c917933
SHA512 23f02d2ee798363aef68d0fa9b630b858b2103d7457b6f53ddbd2f329db1222d1190844297fd850ab9a2becd811c67a08f7068cd11c4b5ddccd967dfefc87d46

C:\D53A22A6\D53A22A6\img\minioyun.png

MD5 57be15419d0c79c5a8d2620aacca89c0
SHA1 60222aa43287f1a125b3ed008876c936733cc0b0
SHA256 5f40c0b884adfe96d768bf57a5d7ec9fa1d50ee261c0829f5bc829b5e0a72815
SHA512 a7c20e2748e9df6685f0bd319f19273348ec4b257e2c98a633665c243841c5df715a7dfdb2ddf47cd97ed3acd8255ec1536db9319afb6cdb0ea20412bc1e920b

C:\D53A22A6\D53A22A6\img\minikBalik.png

MD5 40eb66bf5778e9fc31f41ba25aa607fb
SHA1 2b4ab3fcce4f1b28e4bcfeb052a6d0861aa639df
SHA256 7b6dfcbfcfcc1cf0a5840db3db5bbf0c7e4cc5b6af3cbe853f281b90c34e643a
SHA512 df64a77beb1157351587322a94b568267f48c6c0ba4d5a35477e0426058dd71c2fdff2a040e226e93cbf0352d8df1331680340ee4671142511d6de3b97d25c67

C:\D53A22A6\D53A22A6\img\nehir.png

MD5 b1db9d85cdfdd389a35a4d02a9ba2ebb
SHA1 144d6617153a55f5bdf461878d582f0507456b54
SHA256 27e790ba4b43dac47ea8c9ee483019b3dc6fb0208c945ef320581dddab9b4d78
SHA512 bae176f4ebe2e3fb9e964070849734641f084bfbf556e99315a4ec958394deed82148922eb2bbfaea6afd172369bbc9d6c6ad7d2b256b7b736668b69c3ca3659

C:\D53A22A6\D53A22A6\img\ok.png

MD5 edb0e8699de2e7d5a9d410fe380a2146
SHA1 8dc24a1517012cfc5aefc6dde99c99831ed0d6b0
SHA256 3cda97b8548d4e2a07b1eb74719ff131b318d10c1a64913214f29a002abfe6b2
SHA512 f186162503321db77ca6bdf439af78bf7981d41a84e1e84ba8a8da3bc1603faee567d3210fada745099c49d1f9f83e3301d8f16e21f72ce37229bf3631140e18

C:\D53A22A6\D53A22A6\img\olta.png

MD5 ac2b9ff26702443f8d997897a47b67da
SHA1 7709a01456fd0e2a23f4fca82a73caad0ed18b90
SHA256 50d82f373bb1bf66f6780c6868e3fa80cbe54a1f46cbbe9070224691237bd929
SHA512 0263b60892f4d29b9bc7098005f406add8020361b0f9e175de353e7d02a4ee75d9289d7c45ce322f1dd333db43171042a18c1341bfedf50f37d11391083ed708

C:\D53A22A6\D53A22A6\img\oltaya.png

MD5 9e667419297f07679e8e47489eb21639
SHA1 2376311d3a206d99ddbce7bc6049169decc6f362
SHA256 ecdc260476a1bd1bb14dfcea8a1f99c13f2eeef8697a2a9987a71fe2bd0dc7c3
SHA512 56be776e07c1c88330a76b16e10864620427d7ee454a77efec036c6fb69e8bf96cb5b662293f03a192305cc47f6e75974827515133c738a53fac0661c9ec521a

C:\D53A22A6\D53A22A6\img\oltaya2.png

MD5 9ad592666aad7b3b7090897d78f8fc6b
SHA1 26ecff1026002b807f06ba7be132af71a42612f7
SHA256 0e16c5242a09748b51d4f4b86198ad4182e4015f04677594f83db1a0a4c02009
SHA512 48695501f62288c46d7831f72905f43c078c3746a3cb3b75b02f1d0254630d545ce39647682c9e11c820e2c3e3634e8599132e89159f5a3aee6ecf767ad96c02

C:\D53A22A6\D53A22A6\img\oltayaBirsey.png

MD5 0e8f32d7a53b6d021c423d26f5d1e848
SHA1 85fc92bdcdc76428f19ad945ce6bf31d5a1a7a29
SHA256 ef8d97d3aff115315e2885673927b33cc88032c060b671eab85339a05cb68ac2
SHA512 bcf175348784bb9f66672165786485aeb329a4960ac06f06f4ff88787aaf1d74c059865764428c86fc99dc7cc38408fd885b53521dc0527e353f019e576423fb

C:\D53A22A6\D53A22A6\img\oyna.png

MD5 a2e3a9fad443f601a9efdf34eb61c63a
SHA1 bd6cc1e028f5ed458688f67fb205a1c563350e68
SHA256 d5cd0c2432f9c22e394db19910f1711ad550884dbb5cd28d6ca9f92cf46123ad
SHA512 ac5593aa20a60b016983fb2b6eb7ffcae852620acf1f2add94e36ea06e988846ca5d03b8371e58f6b16dec4b36046d1e9e0f744ef9c8e6a20a7799dd9511070d

C:\D53A22A6\D53A22A6\img\otSazani.png

MD5 c920608e8b6d73d0816270ab1d2e3cc9
SHA1 4372d3a60dfac14d8d8932f4c3170f660a835c5e
SHA256 a716bd466ecf5c0be38923d65bd9939b96a8263fa58937c7bf27dd229aa5ea45
SHA512 7cf5cbed0feb2940e4bed9838febdab27452254cabf155102a35631c3ff3093bc7869c0d1e2a6f55e1f38ff86ecb5553611b9ab60834da7152213539cda6b80b

C:\D53A22A6\D53A22A6\img\pet.png

MD5 f228b00b6c257dab32761a2d1a4eac0d
SHA1 2f29d68e7d670933ad5846f2652938fb06e3047a
SHA256 1554464e494ec35f4ea08283751b167ceb6d6df7c637d63f28151424c1e48099
SHA512 0306e6d5cb68cc7436f70d32bd0e6c4f562d22e50836389ae116276d6e7e937fea91f98d9617913cfa6b570fce706c9da14c85014e1473bbb82db6d0c42597b1

C:\D53A22A6\D53A22A6\img\oyna2.png

MD5 83e344a0dcd2e7e5fe459095d5491f99
SHA1 94ce1e9a9a8ab35603c77b9d1f479b0ce2be6d23
SHA256 9e8f98275142b2295679b5172f69525922c0d20f4e6e700f38bed7cf71215831
SHA512 fd991af26288eb7a1b28e73f33a366c20d216e87443f4d7c2b8627f3fc11338c84c6942dd9dde4b78a7b11c93845887dfa3e2afdee53d01df86d5f3c9f2be48b

C:\D53A22A6\D53A22A6\img\pelerin.png

MD5 8b82e465bea56ce45ac5a5fe6d05a102
SHA1 bf0da730c70f75dae01a382d7a3dc6f2487a193f
SHA256 33f75f7962951e7faf08e435c13f94f52e9b1da970d53f5590385a5dbc5d2ada
SHA512 36474eae541a2a446b7264c9259e94797395d44d6cc9fae3c38d31b265f4e0b05bc351f913c9fab7bf17c36cc31b0ec8b14960c47e853011d4ee124b9d5ca140

C:\D53A22A6\D53A22A6\img\palamut.png

MD5 46ae8e2366a2b32aa62144232dca1957
SHA1 be16ddacd045a3b94952554c11a9379f53f055c2
SHA256 f72dbe73b1269d85571a2441c3fd9ce4e280885350c0413b694bca7ca08417f3
SHA512 9fc0163d3a6a0c547238730348e2e9387f2d6ba8b108348f74e6110559df30223e20088449d11dd5fdd7ef8f871c4b2cae207f078cd3d69c2940aaac1351f55a

C:\D53A22A6\D53A22A6\img\petAyar.png

MD5 6ad20cc4d4aca499615f405910544456
SHA1 e75781c816d9f0da1461f3e113989257524ffe46
SHA256 6f94e61f50634d92050446ac0750279ee748d4f01f1bfac76e2e50f9d6f8b72a
SHA512 7f1a639b8671215d5e8b96df2e1b2c659c9652ceb8613b47f02d2c97a2ec7675af9ebd1ed4c3582e071f101d333ccb0c7421431fd02ebb71b3e5d92eb92a7a07

C:\D53A22A6\D53A22A6\img\protokol.png

MD5 0f85d58a91e3c6febff98247078bb58b
SHA1 6e3264a9fd4740757ebc69e68a3cb10618ce98c4
SHA256 5bd061b74f4d29c21fb6a0dd0b494508235f6d1667f9a60de16dc3d9b9e88daa
SHA512 f93640c54b84b03973adbb6b5c38de2f21b08a61e5b8c2cabf958d01d8029fdd53315a1d67b3a3f63edce44e6f113b01f5166300b6d91ef1bbbfb2b8728e2241

C:\D53A22A6\D53A22A6\img\ringa.png

MD5 ed1d069c33a8ff4ae8ba30a59b153d70
SHA1 0a456f95c9de205f16af03583b0e847b3414cff6
SHA256 750f4a1806c93f0afc7fa3dbc1a621e86e983b3c0874705aa8a33aa1e653397b
SHA512 3cef3365b833e5197e5f9f5e98463b2889ac261f7e73f8122922cfa3318b3d35b6f4d5e1c678035322aac61d030f9e73857b574684ef13a7215fb26b2ed0650e

C:\D53A22A6\D53A22A6\img\reklam.png

MD5 befd7ed3ed4b0bfc894bcbf9a79b1c65
SHA1 01eaacfd4d14bffe8fab11a130dab5758a7306ce
SHA256 af77d6d17c5625c22a40a89694fd1652288a81846449c4505b688232deb6ca94
SHA512 243b2d499bc6994a7951732eec291d3813e5de9164ecd7f22bc9e2af98c8480c319e8c92a3b29881b3925a3f49a10fb4c9eac4526d37e901f7816bddc6b0af3f

C:\D53A22A6\D53A22A6\img\sacboyasi.png

MD5 bc27e884531274bcd700e95ca98a3832
SHA1 6b4b389cda9204137f455476c94774e845908300
SHA256 69b06afec943c34a5cbad44fc4fc6dc1cc98a8506bcecaf7a6b3ba2c02d0a8cc
SHA512 538eaf9c381d1c65fcc03382fa0442ccec341449ace7afe89cb9cde5077f037abac3d53627a6a00452ed75b23da8174a18e02f7bc4e3ec3f7753dbb4bafd05cc

C:\D53A22A6\D53A22A6\img\sevimliBalik.png

MD5 7ec1e7ee7ae55736f64cd3a3549554b1
SHA1 10eefb74219d29fdc1cc1adf08295ce54270facc
SHA256 3ed4dd78b09ac189b2586b85ed7124d700f048732aa6089975ec12e464de6e9d
SHA512 3911981357743826a5fdccd7ab6d3edbb9df64b6c59516a943d10c413d6dfa1488025ea34f74b2e0bb5d952d010de41562eba9a46ad55eef94bf4bc8f5f7ebcb

C:\D53A22A6\D53A22A6\img\sazan.png

MD5 c21e170c3e7115db555bb377e1b15185
SHA1 1b7e3b6236ec6d4f157ae32499fa1a67bf1483ff
SHA256 53e6912b3f180cfdb2a72a7b02e182ae0a17a8981f28c3ad434f4c94fdf0c740
SHA512 084bf5dde1b7db6119356e203f63a30e6c8660644b360669712842cd9a604de125032403cbe8bc313f2566a82a93ac79bd20005a84f108fa10de0733366bb79b

C:\D53A22A6\D53A22A6\img\sohbetprotokolu.png

MD5 9d7a86deced72770da263a9f9d0105c4
SHA1 f11d4f686c66c465ee61a522d1290069ef4703ce
SHA256 2a2511cee80c01ce2b6bba038537c2251e52b13833c0fb5c6fdcb06ed0e1abd3
SHA512 e93dcc0dffa6619ad5961a78a67c3a2239273364841dc6b4833d678950e5a0b6571cc3c2a79fa7d410f30b2932f70c686f2b72b4b7738f8117e4b05a636adf37

C:\D53A22A6\D53A22A6\img\sohbet.png

MD5 af60947ca2f62ac2dc3e9a16219fc21f
SHA1 8be2012095fad5e65f7a3124831467d61b21ac3a
SHA256 3979cb04d7a9b3b605ca83ba136c0a85507ea6451deff8ed645656884c8168d2
SHA512 8c8ab1077958b1de1508f6a074924b9af0ff6ee8a728db8f2908cc0169efdf98a066fc92af8cec7eddaaf859eb7384549c17967febbb1bc2f67b0e2ad6e1bce4

C:\D53A22A6\D53A22A6\img\sohbetAyar.png

MD5 00c26af4820e526879dfe02af06a77c9
SHA1 e80eca4654d1ba289393df5512ad54bc039cb68f
SHA256 80c859930381d6e6cb4b390b251e35e448b055528f1bb82202ec41e2ec8112e1
SHA512 3204a98aef9698b06440340cbdb7dee1a69eae4605de93c886e26509b15f8099119de112004895e2c699f4b2eb56bd5028eb91af4578e60429338470b07aa540

C:\D53A22A6\D53A22A6\img\solucan.png

MD5 a013d05482eb9d647056c1abff2a16a4
SHA1 fbf08b6fae8353fc0722af00dafaee67b5054588
SHA256 dfbd6de6fbd9fa4ab82a53f9e3a20756d47ce70dfa06db5b163a13b9f658d8eb
SHA512 a0f08aee810321822d0c4074b40d72dc8303b0709b83a9bcbf9dffa36a4b89b19897a1d9b889035a6acbc612bcbf77574f40561723cc27dc6b70e9785dd148a8

C:\D53A22A6\D53A22A6\img\somBaligi.png

MD5 28054a17cf3b83f9b00ce436fc39ebfb
SHA1 72c688efc2a7abb9b1826a53a52d16b1a3dda2c3
SHA256 c08588283be90068a2d0d7f4676788ad596fc07a5b0e4fe0716bfaf6ca5b9ae4
SHA512 584499c5200bcc2a79ac115263b1a494122093d6c909addc6317fac16e59f467cee1217062c306f897154033a5a627e937c83f2a48d23333b64594f4eeca7d0c

C:\D53A22A6\D53A22A6\img\tamam.png

MD5 fcbb5d270db67b277c7962eaf6496388
SHA1 877d889ce88dbee0834ff4cd16c4ec254fe6dcc9
SHA256 8e5221c11e56d118585db3b8db86e417bf0c9245b395d80f5563f88b693ca864
SHA512 550528da13bfc97849e216cf4680c5a3c246c337897f5be297386169fc8c2156b7be191a42d88eec6a8223a2708a79e115f8fccec88047c2b5e0f86f1af173c4

C:\D53A22A6\D53A22A6\img\sudak.png

MD5 a18ecde16bb0e636eb1fb2351d22e186
SHA1 edce2fd08354c1df7e41b009641bd8d4949611e4
SHA256 1fc901cb774e98304735a237abac2b03a8757d4171bedb97a9bbcb28442f7fd2
SHA512 6cc30cb45b18524ca566e55ab53eb42931ffb5b8eb0b01e45538a732af82cc0e99f12c94ca50c2eb49f10164343a33cf610f580253f0345344b43ef0da75d2c0

C:\D53A22A6\D53A22A6\img\yabbozkutu.png

MD5 d61a6a6d10271ee17b33c73801bc3bbb
SHA1 3703a717881f7a577a0a16bb1a9eb8d0fedd58ef
SHA256 e9833c98d2b5817075d460370ad0c25ca7da1d2c6770e4bc44c159cb1099ad8b
SHA512 0c182de63ff7627ddf7f5e74c2e4d0c9b1bee1b4289463b8a8fa32bd4eb66e1e9271f5714c5ff429f282ccb83eedcfc94e3c9d11186c922d2ceb9782fc9c83eb

C:\D53A22A6\D53A22A6\img\yabbie.png

MD5 207c4c5680abb43c40edc38a46f2f0c8
SHA1 f09631b72fcab0135a305d0b0b476b2f2546c9a1
SHA256 500b50be6246bc306de4ec170805306a99a2ed49bd4a1b3749e97a77e70ef7fc
SHA512 12054f8d2915be7f4a8fe37b882306febce2e61f132bdd2b2ceaf00573e93b284dfb78f295c4973727feaa7faca07e06390d7c659e8fe5055d8151cc562d27f6

C:\D53A22A6\D53A22A6\img\x.png

MD5 e47016f142c8bd13b0ec9ae7a8379fd6
SHA1 5987db6bf471946bfd441caf4ff3a923de1afcb2
SHA256 665d36fdd8018b318801b7c7a4bcfcb982188a0d8fe6aa18e39e50e5417b96c2
SHA512 e056b38a11da612d61e38addb7a4c77ea4a757c27bc23605f33b154868567c1b9c9eeeddd6ced1d89cc0c839dea4c169228702efde3abeb0db2f72e247afc25b

C:\D53A22A6\D53A22A6\img\ticaret.png

MD5 138ca23aab50594e2d05e9b3dd3b22c6
SHA1 6c978d916d2661dc468ac6305b0d6d818ae4c28e
SHA256 daf0c653894dc893e588d332af3485bd4cf05c2a30e20dc7b57c20fc70601666
SHA512 827f772be2c7db59cdc0a9ce73a0b929c76ed6fa052b319c517cb85e5def08bf94513f119b18ab2bbfe0cadce377cbfcffa9f805839cb6b5e598b450f4130b3b

C:\D53A22A6\D53A22A6\img\tekirBaligi.png

MD5 d0b12c44acf5f0aafb5143ed4237818e
SHA1 455f4c0fd610e1c545ba41769b62c8e737d6572b
SHA256 e721e57a09fd55add6f0e2a572931a1192b8604fd1f5adca9f780f9ffe8631fb
SHA512 1fe9dcd33d035c4998ce63bc04645d0c1a9fb70515883444d7862e505d1a6497ac634102689df087513952c7ac95b956626a0753258568d5cb39b7b8573d58b7

C:\D53A22A6\D53A22A6\img\solucan50.png

MD5 f6cdef29d06bf1665d098259bf3b3bec
SHA1 1aad99a1d5a071d7d8049aac9cd5266618bcf18c
SHA256 16feb57f79fac1fc7b5b0f0540d495f90438bd8a68f197aac348d331837aaa99
SHA512 88714c4ea0871b72354c551ce5ec8bec9f947f71a209ca50cfb1f0a926a5a2c1a965bbbe37e2fbf8e8574242e121518659fdd626f78e44c47b38be4a0d05300e

C:\D53A22A6\D53A22A6\img\solucan150.png

MD5 d4d17bf2e485f8b1da1305f37de19d29
SHA1 eb28b0eda2ee753ad33945de66d01496fe29e3da
SHA256 b020e30411a1879202b2803cbeb00776b8523d7928c45af531e301c5e40b5ed6
SHA512 3c0ebd5f36409dae0035b18671ad826d8078a414dde666821dbcaa6b70b6738c37634deeafcdd68eaddd829cb9f8ef4fe07199242a13a13f6ecf545f1a08deff

C:\D53A22A6\D53A22A6\img\solucan100.png

MD5 f2992ce2fff236ea4fb8fafdf620249f
SHA1 73424909cec72fb240d022635742dc2976f67d84
SHA256 9aa59f644c8da74fec8433c88878ea87d669b8e207c2485c7a4703355985405c
SHA512 f57e4bd39d4475f7026a4c6dda1a3030e69572fc6a6ff375fdf1172d347018108e4874c9a966e232103ac89053b7dee311b0e5b9ee2d327d1726c2fc9042df67

C:\D53A22A6\D53A22A6\img\solucan10.png

MD5 c39feadc9cbcd70e30b255365f41e050
SHA1 8b48254b040e9dcbf6a4333e2170cf687ef1ee5c
SHA256 059d772a4f2167741233bf7f3c7a58cd294034cb7321de98621c3a3563a9722d
SHA512 975536dc47bedf31e123f71ff6cf83db2448eaf025e62f54d4ce3e57a571b565a96b485ca8403db2ee4409f5c6a300271b60be7563551114ccdeafd0a7b78031

C:\D53A22A6\D53A22A6\img\yapbozevet.png

MD5 dbcac5e1d49aba66399656fd60d0b632
SHA1 69825d4538d553e6affdedcd43cb4111cc37ed31
SHA256 d357f9461aee1f35c322bdf36fb7b0dfe8ee9cbfd0f4d69657b77b57a40dd5da
SHA512 a1efa0f08510f746b8865679e812c2a587728ba53027ff84604bc661cdd0474a726cc04880fb195b3b01f392d0e5b496985a8de0879e98cedaf55006d47602ec

C:\D53A22A6\D53A22A6\img\yapboz.png

MD5 ea289d9cdd48376b09814d5a1311c4b1
SHA1 145a5aa002375de4f1e6439a9448e2f381e399f2
SHA256 c7f02beeb2f5ece2c2ef04d9e21b19c5aa8f794f5c39ec965a301d02fb054645
SHA512 38d90f9265bda998388ed5a322524f6c276b0fa7aedaca6c1fa424346c802a543f174022be7449711aeed05d64eafb113056e0e43f5588dccd2e66cf30da733c

C:\D53A22A6\D53A22A6\img\yapboztamam.png

MD5 a8a89d85874dc4d9485a61b1b6e4496e
SHA1 274b6be1b2fe29940ce1415808242ad3a0062fea
SHA256 b5ff8b7f3506c417c4fe68ddb220b1a06f8e56d6b9dfeb481c05b933c3271cbe
SHA512 887eeac6d882da46fa5f44e00aa7ac1d6c4f663f2e0398854c35aeed55f3dcc137048b583e72a1f97ae5b6329e442d658c011dea5be1a3fd51e03b7d3e03476d

C:\D53A22A6\D53A22A6\img\yapilamaz.png

MD5 59b1811badd06b480754f64901d467a1
SHA1 f2c1294a38ad3214c0e5e27b365e45d452bbf179
SHA256 4fcb044b97d298adb22aa35a0b6ee4a36f164db9dda6630b038bf359869a3b12
SHA512 a23370e31d07d9bf4a9304576a07032f3bd736d6076795bdc030ab38a2bea83702b21ba73fb15d7cf16ca975853555c97651f391ff98fdfe1e0bca32bac59235

C:\D53A22A6\D53A22A6\img\yayinBaligi.png

MD5 1375860b88775157345253e8f972b90e
SHA1 7c49ff0c3496c315515a81d07a0941bd5d382f39
SHA256 0ca6a8aa3a2e6d6c0d841ce058b3dc46b67a37e1473c06be626254791aefbe35
SHA512 e355f75b7ccb34a3d6f3f5aeb637df703bdca4c76749f6094bcaa06b9fabc45c6093965d565ca7a9c06a9b319889020740004fd76a3f419aea5eb32966324501

C:\D53A22A6\D53A22A6\img\ypbz.png

MD5 e2c58a23359f76d1bb1a9fcb8cb108f3
SHA1 a80cc6b343fe5bae293b158711dda323f3b9e974
SHA256 2198e42745bec559588b491c43e18a9f6d8901903287c094e2d4387eca75f301
SHA512 3cd7c10eb7ccb42a4ef3301285db4269eb1a586248ef081158226de22e8cd5922a744c278e270433a152a84261e0ed8da3976a25c08136c7c16f438d7c02c31c

C:\D53A22A6\D53A22A6\img\yilan.png

MD5 ef7b8488cefe28ae8e830706353e90c0
SHA1 6d81626005da6e67bccc4c9f2d48f4817b55ddf0
SHA256 380d058b3395662dd79b04333a8506d6713f3518e0ed52ca7cfddfd099159ad1
SHA512 3bd629f38ef9455fb293063ebee9cbaf9952c6a8b5d2f9888ee90dcfc90ad15f222c32b9af36bc58a5045fbe3dd94b91a5f7574c434178e5b706f3f43fcd23b3

C:\D53A22A6\D53A22A6\imgPVP\olta.png

MD5 df4915d726a00bc02dfee4354369c08e
SHA1 3893dfb512f8c13eaa7f0e327a2126d425c0f1cc
SHA256 d6b4886d2db336d79f5269ec51ed8a2883c03d2c96a8504d0dea33b9bec7d57e
SHA512 9355f72beb137784d8b3e91b3a183d8ecffbb64d79e6e748a29cb09f0f7f214bda6b3a2cce6f4172b132ef204df1950ee619108584b1b12d5a5574d7a66508ee

C:\D53A22A6\D53A22A6\imgPVP\kilic.png

MD5 d8e9f881f61d6114439ec37718e2c4c7
SHA1 ad552060d7b04eb9a0919469c6b9d1b264df6be1
SHA256 a7aa45f01bc8446a19813cf875ea0b5c5d11e6349dd44e99e9788b4ddc444a71
SHA512 6149d9eac5f74da8d4ad155772191923d4921802fa00dde40a522977a458e9f1b22828c4dc9beb7ce3752f95737889a32fed7a3ad1cf0acf6eb59c6a65133708

C:\D53A22A6\D53A22A6\imgPVP\envanterText.png

MD5 52655dbeedc7bdea4f9d6cf8400c5cad
SHA1 8ddd6ec4c90036220d314eadefb131b8b4ddb9dc
SHA256 5221b87801d85103c960799170b55fdd08560e3401b2b42980333ceb9dfe168f
SHA512 bc9e98162585913e5ca3dc8b7ba5f05448367cba8e0ad82fba55a462ba4633f61d245deeaeef6a4f7a70f38dacd77b9c0c06b29d636534bba8532d57dff60826

C:\D53A22A6\D53A22A6\img\zargana.png

MD5 a14e2d44c4c33cd1b26dac86995934c6
SHA1 49700e30ffa611b301723f04f6dc00d932e1a3cf
SHA256 3d8b824eccfa8244d17fdba060b5f7e297dd7e363e7188f7364e1f648c895550
SHA512 8bd37dc2266894533335bc9c09597967836bf526aa3877b69d2498718cf59b8be29a26d6b402455c0a4d73fd6353f0a85506ed806919e9a90872f1ea224ad12f

C:\D53A22A6\D53A22A6\imgPVP\tamam.png

MD5 48a4da78727145b0839e11a9012c4f4c
SHA1 fc29a8d165ecd43e28ce1301d12c0c4e207f83e9
SHA256 e144350c9bb0e22715468dd6d4ad95406d975ead741ba2209abedccc54aa3c6d
SHA512 64ca317b4bc079a0732f0e741a528f73feacb0d0d2a0334328709588d44660df28dc327aaa8c1f3c73ff722f989638629cc8832eb8a1c8a59f2b3100529887e1

C:\D53A22A6\D53A22A6\imgPVP\tamam2.png

MD5 b794045e1dc849078021006ad855cc1c
SHA1 0d6802a70f9aff4a245a61ce2712b430848d3f48
SHA256 bfc499def2e159dbcd8504fadbe5268d3f55a5f7afbb70596e9421ca3f32d545
SHA512 8e1143e8eab301cf9ea2501d89ff9820339bb59fc53a4f07be62bf799b4f6b9e8a687ef18c40884643814db79375cded54ff82408d69c4038b2b6ef5ed39e429

C:\D53A22A6\D53A22A6\AutoItX3.dll

MD5 eb86fb3ad4445983f7d2b7e11ef7fc21
SHA1 f4442e19970cd6fa82659855f49972648eb34801
SHA256 80e7e298e1d1a9cbaa30b34a896d71018779965d1e03be621d974a64a680668d
SHA512 3cf84ea50498ca897fe77515c17e02385beeee153aa6d2b62dcd89b97eda134d387ed55d62753919e2b299f0658611a991c66a70c96d3c31f6a915912d9743c3

C:\D53A22A6\D53A22A6\Ionic.Zip.dll

MD5 a7669dd35e5927dcc3577d0e5134a431
SHA1 1b2991af0f520c9b4d01f6fddf3ce11c8a700e78
SHA256 8777e7df1ac57f7b56597052c52bd4239a690a36301b6be9db1a94b9f393c1fb
SHA512 9cbd2f5d97ba92c17cfee37814b99b8fab20020471e185171d4d2b00913f733ffbc87cd9ef9e30c1e34cbc64d6e9297ffa59da966f204b1b5c10a9631475040d

C:\D53A22A6\D53A22A6\HaydiRastGeleBot.exe

MD5 ad53d5c45f53278433d4d01f2a703660
SHA1 fc84f5f3b27823577ae6c55b84ce2a34af391909
SHA256 c85380496c112a50e6076c9095f9f81b4daaee8c761c53882b53859395fde334
SHA512 4461cd0a65c102a541cbb59efc2feef1a18c9bc817afbec7ebb406a8c050beff4a0b4e80cd0de92561ef50ddb2c3b507ae0791ac25ef183c2b4b4beaf29fa9f3

C:\D53A22A6\D53A22A6\HaydiRastGeleBot.exe.manifest

MD5 0fde3bcd6bf7794078f29857d23b2b27
SHA1 3505d0b2bc7581e4407594b8255947e20e307e03
SHA256 1a829e4380a9ce6dc38eabf3542c90578803dc8d6f11cbd228794d5ec48d483f
SHA512 88218c1f1c332850ac4f2324ff462daed68f89172f3a7fbba91733af0c36f59a35dfabed949cee0a04bf3b81528dbab38a283e21360a7dac915049a742669c77

C:\D53A22A6\D53A22A6\update.exe

MD5 04b4359dff0fbf748ae09ecb31b453d4
SHA1 35f23a75d1a1af81c5145b153fe314eb0cba2b18
SHA256 8f7d217a992be3c92ed091e1a2fad0be435368b83bd3568ed0df2479be528214
SHA512 1d6e25d789d6707b9c9b34df8c21f8ba9e15decfaf6c667783541336862ecab6b84705c1dbaf51aebc5602a6d10bff14e84c16985d3bf52cbdfa30d6c64438f5

memory/2772-2304-0x000000000AB20000-0x000000000AB2E000-memory.dmp

C:\D53A22A6\D53A22A6.lnk

MD5 adf1715c35e56bbe992bc689237491df
SHA1 40c96b8096067f14d984beca8cb9402069ee397a
SHA256 3db00119d7fd1075f2305947fb86e8a841eaa39f29d44ccd0241c91a28ac08bb
SHA512 b86c0f35e750898539afd1a8e2326642a0a8b18402502620d2a48d620ffe52c8f6593b0106cb740214f9d3b3370c0838b36aea88ad1111f79e4120c554a23415

memory/1276-2312-0x0000000000010000-0x0000000000168000-memory.dmp

memory/1276-2313-0x0000000007770000-0x00000000078B6000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0be2d52daa910ce8af27ada76c035ee4
SHA1 c65aa4e4d95316dcaf7022f91a5d8bf1132090d6
SHA256 65592d05e4cca24d4110528f399e516ccf36ac93f1627c36ab5a6021b9daa935
SHA512 0b20007301bd4f178135f7e0071f268ad5d44709b5195d217904c721c3dcc93f977e2a877e8178fdbac3f8f95976da9fd6261a10041b376c6a9eb334c4ef05ee

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 2aa58e55ce34ba5cb7a452a1190c96eb
SHA1 5ee4f421168bd84ef7b3d2281c257779f37d757b
SHA256 51a5932d2f434b27b13e8c1b9583cc8715f2dc3da650e26d1bad28a84776ad23
SHA512 271f7a806e62fb4dfb758fb1392c4e851153d39cc169fabdc98c2e50f7d036e3184b73dc9c94693903ef109ff3c83a7b4d394b23b92cec861ed912e78ce6d366

memory/4112-2333-0x0000000074850000-0x0000000075001000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 7799dc967a62584dd02b7053c0fcc674
SHA1 b0b2162576316624750d213d770d2fee50b9f116
SHA256 00f0e82945e50b9082333b5c3c044b110533b8498d5765ca4279dd9b59ac400d
SHA512 b96012e382caf4a019111d9fd1c4927396777649314cd3318508a51890f525d0577d3e95b47bd8fa4d1083a78e8fd6712efb835749eda0cca41227ba210d8667