discordrat | 457d62cdc267486cc5abca9fb5f8c1a66fe280830853dba0e96d853de270c571

Resubmissions

02-02-2025 16:44

250202-t8tlcsslfm 8

02-02-2025 08:43

01-02-2025 19:11

01-02-2025 19:11

01-02-2025 19:09

01-02-2025 19:02

01-02-2025 18:52

01-02-2025 18:49

Analysis

max time kernel
542s
max time network
544s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
01-02-2025 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

the_watching_nightmare_updated-Reborn-1.19.4 edition.jar
Size

12.7MB
MD5

a718c31344afb79ab44968939d06e8b7
SHA1

dc7ea8bc0398e224c8a7cc13989289071483ab10
SHA256

457d62cdc267486cc5abca9fb5f8c1a66fe280830853dba0e96d853de270c571
SHA512

91e794b814f496ec3b27e30ab38ae2517f024548bc554e3ba607489cefc0823e30fa9ccde0f180dd772668117737fa5a957a0b0503d04edf8c76755a8e7c29ae
SSDEEP

196608:UCpW79MRAwoS6RnRbyMHLXlz6pJ21/bM51ux44+J9ZJi44+pVtSxjXaOzP2O:dpWZMmr2T21DM5184zRJdAxjaA2O

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Executes dropped EXE 3 IoCs

pid	Process
760	free shiny rocks.exe
2660	free shiny rocks.exe
5108	ok.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BSOD = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmd.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BSOD = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmd.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\ok.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BSOD = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmd.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BSOD = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmd.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\ok.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\ok.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\ok.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\ok.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\ok.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\ok.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BSOD = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmd.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\ok.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\ok.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\ok.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\ok.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\ok.bat"	reg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ok.bat	cmd.exe
File opened for modification	C:\Windows\ok.bat	cmd.exe
File opened for modification	C:\Windows\win.ini	cmd.exe
File opened for modification	C:\Windows\system.ini	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Virus Maker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Virus Maker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Documents"	Virus Maker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Virus Maker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Virus Maker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Virus Maker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Virus Maker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80922b16d365937a46956b92703aca08af0000	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Virus Maker.exe

Modifies registry key 1 TTPs 12 IoCs

Modify Registry

T1112

pid	Process
3320	reg.exe
3868	reg.exe
3296	reg.exe
3868	reg.exe
4860	reg.exe
3176	reg.exe
3180	reg.exe
3800	reg.exe
4708	reg.exe
1600	reg.exe
3004	reg.exe
4916	reg.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\release.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\OIP.jpg:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3564	msedge.exe
3564	msedge.exe
1348	identity_helper.exe
1348	identity_helper.exe
4668	msedge.exe
4668	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
432	msedge.exe
432	msedge.exe
2232	msedge.exe
2232	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1144	Virus Maker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	Discord rat.exe
Token: SeDebugPrivilege	1836	Discord rat.exe
Token: SeSystemtimePrivilege	4648	cmd.exe
Token: SeSystemtimePrivilege	4648	cmd.exe
Token: SeSystemtimePrivilege	4648	cmd.exe
Token: SeSystemtimePrivilege	4648	cmd.exe
Token: SeSystemtimePrivilege	4648	cmd.exe
Token: SeSystemtimePrivilege	4648	cmd.exe
Token: SeSystemtimePrivilege	4648	cmd.exe
Token: SeSystemtimePrivilege	4648	cmd.exe
Token: SeSystemtimePrivilege	4648	cmd.exe
Token: SeSystemtimePrivilege	4648	cmd.exe
Token: SeSystemtimePrivilege	4648	cmd.exe
Token: SeSystemtimePrivilege	4648	cmd.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1456	Virus Maker.exe
2232	msedge.exe
1144	Virus Maker.exe
1144	Virus Maker.exe
1144	Virus Maker.exe
1340	Virus Maker.exe
1340	Virus Maker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 4800	3560	msedge.exe	82
PID 3560 wrote to memory of 4800	3560	msedge.exe	82
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 1028	3560	msedge.exe	83
PID 3560 wrote to memory of 3564	3560	msedge.exe	84
PID 3560 wrote to memory of 3564	3560	msedge.exe	84
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85
PID 3560 wrote to memory of 2464	3560	msedge.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\the_watching_nightmare_updated-Reborn-1.19.4 edition.jar"
1⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb50f93cb8,0x7ffb50f93cc8,0x7ffb50f93cd8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2496 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6632 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4060 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7276 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1236 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7508 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1343497412272132111,7035526850545790813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:1732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2716

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2660

C:\Users\Admin\AppData\Local\Temp\Temp1_Virus.Maker.zip\Virus Maker.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Virus.Maker.zip\Virus Maker.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1456

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3520

C:\Users\Admin\Downloads\release\Release\Discord rat.exe
"C:\Users\Admin\Downloads\release\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Users\Admin\Downloads\release\Release\Discord rat.exe
"C:\Users\Admin\Downloads\release\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:2660

C:\Users\Admin\Downloads\Virus.Maker\Virus Maker.exe
"C:\Users\Admin\Downloads\Virus.Maker\Virus Maker.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1144
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oog2lhpu\oog2lhpu.cmdline"
  2⤵
  PID:1312
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5021.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA5414AB84DF24283A77FA118EC4BAD3F.TMP"
    3⤵
    PID:224

C:\Users\Admin\Downloads\Virus.Maker\free shiny rocks.exe
"C:\Users\Admin\Downloads\Virus.Maker\free shiny rocks.exe"
1⤵
- Executes dropped EXE
PID:760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cmd.bat" "
  2⤵
  - Modifies registry class
  PID:3448
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Virus.Maker\msg.vbs"
    3⤵
    PID:1692

C:\Users\Admin\Downloads\Virus.Maker\free shiny rocks.exe
"C:\Users\Admin\Downloads\Virus.Maker\free shiny rocks.exe"
1⤵
- Executes dropped EXE
PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cmd.bat" "
  2⤵
  - Modifies registry class
  PID:1616
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Virus.Maker\msg.vbs"
    3⤵
    PID:1232

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Virus.Maker\msg.vbs"
1⤵
PID:4436

C:\Users\Admin\Downloads\Virus.Maker\Virus Maker.exe
"C:\Users\Admin\Downloads\Virus.Maker\Virus Maker.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1340
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hx5gglao\hx5gglao.cmdline"
  2⤵
  PID:4692
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1CA9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB1C8422BA5C4F7EB61549F2811C83AF.TMP"
    3⤵
    PID:1364

C:\Users\Admin\Downloads\Virus.Maker\ok.exe
"C:\Users\Admin\Downloads\Virus.Maker\ok.exe"
1⤵
- Executes dropped EXE
PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cmd.bat" "
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- - C:\Windows\system32\rundll32.exe
    RUNDLL32 USER32.DLL,SwapMouseButton
    3⤵
    PID:4724
- - C:\Windows\system32\reg.exe
    Reg Add "" /v "BSOD" /t "REG_SZ" /d "C:\Users\Admin\AppData\Local\Temp\cmd.bat" /f
    3⤵
    PID:3320
- - C:\Windows\system32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\ok.bat /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:1600
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\ok.bat /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3004
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
    3⤵
    PID:328
- - C:\Windows\system32\rundll32.exe
    RUNDLL32 USER32.DLL,SwapMouseButton
    3⤵
    PID:200
- - C:\Windows\system32\reg.exe
    Reg Add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "BSOD" /t "REG_SZ" /d "C:\Users\Admin\AppData\Local\Temp\cmd.bat" /f
    3⤵
    - Adds Run key to start application
    PID:3928
- - C:\Windows\system32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\ok.bat /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3868
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\ok.bat /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:4860
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
    3⤵
    PID:764
- - C:\Windows\system32\rundll32.exe
    RUNDLL32 USER32.DLL,SwapMouseButton
    3⤵
    PID:1636
- - C:\Windows\system32\reg.exe
    Reg Add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "BSOD" /t "REG_SZ" /d "C:\Users\Admin\AppData\Local\Temp\cmd.bat" /f
    3⤵
    - Adds Run key to start application
    PID:4912
- - C:\Windows\system32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\ok.bat /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3176
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\ok.bat /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:4916
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
    3⤵
    PID:900
- - C:\Windows\system32\rundll32.exe
    RUNDLL32 USER32.DLL,SwapMouseButton
    3⤵
    PID:4140
- - C:\Windows\system32\reg.exe
    Reg Add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "BSOD" /t "REG_SZ" /d "C:\Users\Admin\AppData\Local\Temp\cmd.bat" /f
    3⤵
    - Adds Run key to start application
    PID:392
- - C:\Windows\system32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\ok.bat /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3320
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\ok.bat /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3180
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
    3⤵
    PID:3028
- - C:\Windows\system32\rundll32.exe
    RUNDLL32 USER32.DLL,SwapMouseButton
    3⤵
    PID:1344
- - C:\Windows\system32\reg.exe
    Reg Add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "BSOD" /t "REG_SZ" /d "C:\Users\Admin\AppData\Local\Temp\cmd.bat" /f
    3⤵
    - Adds Run key to start application
    PID:1120
- - C:\Windows\system32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\ok.bat /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3800
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\ok.bat /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:4708
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
    3⤵
    PID:3440
- - C:\Windows\system32\rundll32.exe
    RUNDLL32 USER32.DLL,SwapMouseButton
    3⤵
    PID:4108
- - C:\Windows\system32\reg.exe
    Reg Add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "BSOD" /t "REG_SZ" /d "C:\Users\Admin\AppData\Local\Temp\cmd.bat" /f
    3⤵
    - Adds Run key to start application
    PID:3320
- - C:\Windows\system32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\ok.bat /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3868
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\ok.bat /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3296
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
    3⤵
    PID:5108
- - C:\Windows\system32\rundll32.exe
    RUNDLL32 USER32.DLL,SwapMouseButton
    3⤵
    PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Virus Maker.exe.log

Filesize
1KB

MD5
8e0f23092b7a620dc2f45b4a9a596029

SHA1
58cc7c47602c73529e91ff9db3c74ff05459e4ea

SHA256
58b9918225aee046894cb3c6263687bfe4b5a5b8dff7196d72687d0f3f735034

SHA512
be458f811ad6a1f6b320e8d3e68e71062a8de686bae77c400d65091947b805c95024f3f1837e088cf5ecac5388d36f354285a6b57f91ea55567f19706128a043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\free shiny rocks.exe.log

Filesize
226B

MD5
4ae344179932dc8e2c6fe2079f9753ef

SHA1
60eacc624412b1f34809780769e3b212f138ea9c

SHA256
3063de3898a9b34e19f8cf0beeec2b8bd6bd05896b52abd73f4703d07b8a7cd4

SHA512
fadfe2b83f1af8fdc50430325f69d6172d2c1e889ca3800b3b83e5535d5970c32e9a176b48563275a0630d56c96d9f88df148fd6b2d281f0fc58129e5f4dba19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
48KB

MD5
df1d27ed34798e62c1b48fb4d5aa4904

SHA1
2e1052b9d649a404cbf8152c47b85c6bc5edc0c9

SHA256
c344508bd16c376f827cf568ef936ad2517174d72bf7154f8b781a621250cc86

SHA512
411311be9bfdf7a890adc15fe89e6f363bc083a186bb9bcb02be13afb60df7ebb545d484c597b5eecdbfb2f86cd246c21678209aa61be3631f983c60e5d5ca94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
25KB

MD5
e580283a2015072bac6b880355fe117e

SHA1
0c0f3ca89e1a9da80cd5f536130ce5da3ad64bfe

SHA256
be8b1b612f207b673b1b031a7c67f8e2421d57a305bebf11d94f1c6e47d569ee

SHA512
65903ba8657d145cc3bbe37f5688b803ee03dd8ff8da23b587f64acaa793eaea52fcb6e8c0ec5032e0e3a2faacc917406ada179706182ce757d1c02979986dd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
38KB

MD5
adf2df4a8072227a229a3f8cf81dc9df

SHA1
48b588df27e0a83fa3c56d97d68700170a58bd36

SHA256
2fd56ac4d62fec83843c83054e5548834a19001c077cdb224901237f2e2c0e4c

SHA512
d18ffc9a41157ea96014a503640b3a2a3931f578293e88cc05aa61c8223221d948c05637875d8e3ee5847b6a99341ea22b6a1aee67c170e27bde5e154cf1b9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
37KB

MD5
5873d4dc68262e39277991d929fa0226

SHA1
182eb3a0a6ee99ed84d7228e353705fd2605659a

SHA256
722960c9394405f7d8d0f48b91b49370e4880321c9d5445883aec7a2ca842ab4

SHA512
1ec06c216bfe254afbae0b16905d36adc31e666564f337eb260335ef2985b8c36f02999f93ab379293048226624a59832bfb1f2fa69d94a36c3ca2fdeebcdc3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
20KB

MD5
99c59b603e12ae38a2bbc5d4d70c673e

SHA1
50ed7bb3e9644989681562a48b68797c247c3c14

SHA256
0b68cf3fd9c7c7f0f42405091daa1dda71da4a1e92ba17dad29feb00b63ef45f

SHA512
70973ea531ed385b64a3d4cb5b42a9b1145ec884400da1d27f31f79b4597f611dc5d1e32281003132dd22bf74882a937fc504441e5280d055520bfca737cf157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
21KB

MD5
6ff1a4dbde24234c02a746915c7d8b8d

SHA1
3a97be8e446af5cac8b5eaccd2f238d5173b3cb3

SHA256
2faaca6a253d69be3efb96620ba30e53ecb3de12d5285b83ecdba8cbc36e7311

SHA512
f117b822aeb0a434a0750c44cbf4cdf627bfebc0d59e266993a4fcb17a7a0519659e13b3bcf8706eed7d80d0ce33b0ce5915afe5872c37c010a401dd6bb1187b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
26KB

MD5
525579bebb76f28a5731e8606e80014c

SHA1
73b822370d96e8420a4cdeef1c40ed78a847d8b4

SHA256
f38998984e6b19271846322441f439e231836622e746a2f6577a8848e5eed503

SHA512
18219147fca7306220b6e8231ff85ebeb409c5cc512adff65c04437d0f99582751ccb24b531bbedf21f981c6955c044074a4405702c3a4fae3b9bf435018cc1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
18KB

MD5
f1dceb6be9699ca70cc78d9f43796141

SHA1
6b80d6b7d9b342d7921eae12478fc90a611b9372

SHA256
5898782f74bbdeaa5b06f660874870e1d4216bb98a7f6d9eddfbc4f7ae97d66f

SHA512
b02b9eba24a42caea7d408e6e4ae7ad35c2d7f163fd754b7507fc39bea5d5649e54d44b002075a6a32fca4395619286e9fb36b61736c535a91fe2d9be79048de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
59KB

MD5
25b3d7b6beb44eb20ffd065656c15e1d

SHA1
59301a1a36a144715b51bdccde1eb2a328f7efd3

SHA256
00a88a411e1a1ba98f55fae99469271160c23d87b1f71f90f31a7810f063db9d

SHA512
8c71c4b268832f016dc20f68611abe976294421217f7834b5d409b53b0f0b137231c9364eaa84eb1afb05fbb121a0ebd263e52ba60cda157ae892219b462e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
16KB

MD5
dde035d148d344c412bd7ba8016cf9c6

SHA1
fb923138d1cde1f7876d03ca9d30d1accbcf6f34

SHA256
bcff459088f46809fba3c1d46ee97b79675c44f589293d1d661192cf41c05da9

SHA512
87843b8eb37be13e746eb05583441cb4a6e16c3d199788c457672e29fdadc501fc25245095b73cf7712e611f5ff40b37e27fca5ec3fa9eb26d94c546af8b2bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
18KB

MD5
8bd66dfc42a1353c5e996cd88dc1501f

SHA1
dc779a25ab37913f3198eb6f8c4d89e2a05635a6

SHA256
ef8772f5b2cf54057e1cfb7cb2e61f09cbd20db5ee307133caf517831a5df839

SHA512
203a46b2d09da788614b86480d81769011c7d42e833fa33a19e99c86a987a3bd8755b89906b9fd0497a80a5cf27f1c5e795a66fe3d1c4a921667ec745ccf22f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
41KB

MD5
082c469b33a31285b4c182bbe6a1b499

SHA1
d2525c741034e1ea6002707ef528a270fbd2fed6

SHA256
09ea9ec8594cabda1edc0ca1ee990be1f5c564d0dac06e6a07ac03623e5f4f1a

SHA512
a731c121e9438f8d5cc0fd28939b0493f5bb37013b60e78054fa6c4e3f72d4cd52c5bcd9e3dee36903fdc7e06aa3af879d706f360eaf6ebf750ba74d595263b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
55KB

MD5
c649e6cc75cd77864686cfd918842a19

SHA1
86ee00041481009c794cd3ae0e8784df6432e5ec

SHA256
f451a4a37826390ab4ea966706292ee7dd41039d1bedc882cbc8392734535393

SHA512
e9e779870071fe309bbde9b6a278d9627c7f2402b55ac4c0a48c65b1de5172cf9dad2992f8619d7e7aaf978e6ccd607620de88554aa963f3d45501913ed49f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
87KB

MD5
65b0f915e780d51aa0bca6313a034f32

SHA1
3dd3659cfd5d3fe3adc95e447a0d23c214a3f580

SHA256
27f0d8282b7347ae6cd6d5a980d70020b68cace0fbe53ad32048f314a86d4f16

SHA512
e5af841fd4266710d181a114a10585428c1572eb0cd4538be765f9f76019a1f3ea20e594a7ee384d219a30a1d958c482f5b1920551235941eec1bcacd01e4b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
107KB

MD5
11341f03f951333b4309822a7ebb0907

SHA1
fc813cb6a262e6ef9991bfa2711ba75e7a0894dc

SHA256
99aa368241f22add83b34dd05541d726ab42a65f3e9c350e31c0129684b50c1a

SHA512
089cbd6d797f4e086e945dbb1345f4023fb0ef4daa9d47368ae7f253cbaea7b6236cfebf0d19741aba415ec4f1c3443050cabad756c55514ba2bc0bd7442bac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
16KB

MD5
686cd4e029335cb803ea8b47ea727bd5

SHA1
acb03acb24c943d81a8e4822466201cc4114692c

SHA256
785ffc242cb18f8e9ccb9ab96c37df3cdf1612a38a325a2a9bcf8164eac6488d

SHA512
a54e055ca8e021757102aa6c7f9045959fa32a7db215595cda8419ac96f75f44e1f5846037e14b6a20d0db51c4b1e974aff1718e16ff5d7650e0b667ca09721c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
18KB

MD5
ec02df94928186d3c6b59ce65f9000a3

SHA1
ff25873724d5bee7c3a1b0f70853f3f4db93056c

SHA256
31d2638dfacb6328063cfadac99239427e0eee86cd28e2deddfe4daa39c55674

SHA512
69ddeb0dd61ed03bc060b9399504988ee0c72c4de46e3a6efc967bb3686a593dca9362121d9b5106e9f2e355238614c5d108cf28354b53e5aff6f5e2e112b873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

Filesize
2KB

MD5
fa2b3083386aa6d3ade190ffe88b8d13

SHA1
993da2392c1583fb11fd6f751a0a8e09214fa256

SHA256
5eb77bd064a73679c029f49b52ac2b5c6d83e6a71f1ee42e7643229ef40f23a9

SHA512
419d076bbf2a0a3cc3b36a1114677616d861fc3f066b73b1a9f21b32507e2a4fd7fdddac451306ad851061dd8efe366a6da7370fecec8bc7f9e664112e219707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\14ff8116b518ca2d_0

Filesize
2KB

MD5
966d9dde42a49104aad2d10955bef284

SHA1
d804c0f0f9d5c31ed7a26a089ba65c46fb7d9c64

SHA256
56c4f163c1cb0711909342a4cb758e30e527bde1c4709bc22a303425f91280b7

SHA512
1a0772b11ea03445882d43df856a5dc7c5ac1ccf70537c34f935b5cfbd2029eede1fcf6b125393bdd5705a34f8e3f2154cefd3467e987358817e94e382ce4304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\15a6bb62016961d9_0

Filesize
1KB

MD5
42460378a845038cdcdf1544b623263e

SHA1
d72684dce70dec2446fa0fc0d20058b50af85be7

SHA256
273b1b5a8b767837143a8b3ae3cbe9812477708b3e048c86f3a10563514539da

SHA512
466f1818a853475a8733d0eac75454dd8afb29e4448a9ecc0c3fd0ccf6be6aa4115e09754c015825af57bd1d465e77c721a6fe70fdda8a2f0c6c5b574ab10bae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\163cfbbbd670a71e_0

Filesize
4KB

MD5
8ca5b64dd5aeb4177005a38f16767374

SHA1
ff5c171e280faee2a60105b3e5e2504d975ed625

SHA256
be8beb7440198599f3fad36b21bbfc56ceb6d39aa49c22c142b8c95687f10b52

SHA512
08c1354578c0b661af95006de6dd816b8e24522a8a90a70574447f7ab6449d36f594270895344260e3c6a718ae4ec40036cd620895d87acb61a1e098ddef1f01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\18dc191ab0a13887_0

Filesize
3KB

MD5
602bfa9052492e9c6d1e24496d167a31

SHA1
45e82c6cd8ebb329892d79444f063d1b3e5de0fe

SHA256
b83887992f05d2cbd70efc06b2840b34a0fec675505f4af2167229400c1db0b2

SHA512
1b88378b9c46f7532aadc46b0a65d7bcef7f8b6c853beb14162c15f4d7b8a0c13bc7af13a9f3928b9ea58e49db68c2901825436564132c9c5d349e25604b72c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1a914eb5fc51fb84_0

Filesize
9KB

MD5
e88cccdf98dffaa4810609c90d5721ec

SHA1
7820650496c21b2f551ffeb1ae1df7f5ce5623d4

SHA256
e835238bfdc3b4dcca3030c757efc35095f51bf06005623a5cab58eadd89ddd4

SHA512
41596ac5f3e4e5ea52cb0ef93a67a26cf77b2e02aefc3609d33e6f8bca22955435884c5fd34a806c9ea8f63eb1bca6d30b1e1c8c7c188637b2089f59f8168365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
5556859792ef11cbad65c7e9e0872f63

SHA1
b472671feddf970a5526eaecc18a87199fce4e8d

SHA256
110e362d0519708d1f2c3fda8021635df0d4014f8788027e97d960370857ef75

SHA512
2bf43665c8c0d22c797c54120780103b046a7ccbec01ff71123f5e0a151377a59a006800de70841402e0477a29eedd27aaccc1c26af6a4aa144bdf2b95e6677e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2692617678c042d9_0

Filesize
3KB

MD5
1e41b7d8d57ecab86cbcd4c1f088f20a

SHA1
4a6153369915a25731d82c1abb6e749659c7d766

SHA256
f294bfe278db5688709a1cfbddbcdd4e7884e0989e56ec20f7f46099a7d948f3

SHA512
695a2f08fd5a514f80c9beb381e9f0ad3061db9841ad5682fcb75d1a6f50e06e964341df6e4686a04ab0c4b1ed213ace91ef6657128270a6ccc8148dfd43c219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f4680e8f8f8a14f_0

Filesize
9KB

MD5
867fc575fd6a8a9d9c683e12b9fb7e88

SHA1
0d78eaa9b020a7b9c8533e05b38e6172d03add8d

SHA256
3d1edf5dcdfdafe20aeaebebe049399508e59effd62eb8d198b538b87b203d61

SHA512
534a1711a890872a9c8f978af272f82ec819fc65eb76e2c5a20e3d7397680ce2449a1577081e03808dfaef0871327ee3d7c06071e05fb81b479324101ac00810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\37249cca66fdcc12_0

Filesize
1KB

MD5
69fb07d8cab8a8482966539791356ed4

SHA1
a862eed8082c348db90e6537797f6f3b5f18d1c3

SHA256
d10d334a26cede172ac7ef77cdab67299313bb20849402791c5239b8673415ab

SHA512
452b47e595983424fcf9ba0a7ba5a7c8d95a9dd1b80618495f8a0ab3369b2fb152ae9c557be5ea982357d3b5a490104d0ca2bf65dd04bcc16da98b1f82aea919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\37afe38eb817b647_0

Filesize
38KB

MD5
5310ba62a92531f096bc6d097f88cec7

SHA1
7be09756e7da10ab29afdf569582a5528fcf31c7

SHA256
665dc4bcfebb0fe401c4ba703241c6c244f33a1d0fa464ab09229fbc3a403272

SHA512
1a6ec8da960991d28eed2ea16dc0feb5779f1fdb450ef5dfda8097dcb7d81e7d95f1f841db4435e7fa0e08c042a05e55140b221c2b3eac3958ed4704772f7f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\37c007fc57f96178_0

Filesize
291KB

MD5
7c8d907b2d9ebef26e2c4f270bd87e75

SHA1
2eed01f6d45cbbb50c1d0f078256c44e6b38ed9d

SHA256
c85ee3e85b04574d5379fd577b4317e7a04ea1039558d0c2e695f4a0e5f86cd3

SHA512
b3d65a84b2da8874b867cdf468cc60b9d6419ca3cfd24f5d6b9ad71cb20c9d28a347b4d443b3695b6739508dc9517ae84d7e75f98d0167593f0303d0f0b51c7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a4259a0181983ba_0

Filesize
7KB

MD5
15b54376a6429d636082d0bbe0ce5615

SHA1
aa1f3e879d6dea567d54ce401c7ea13ad6ae6dbb

SHA256
6b1342c7701b500d0c2f6b90dcfb3014cc3b38ce860069ae5ba51b51a7cb624d

SHA512
956d9989402583d693b0e7966891126a08a071ad73a74b4329c99113b22be61ab4b2d4817a36dfb120bbabd0e69309e908a6f8849e9a9868872f5f3783e1ed49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
42f0b921dd7c087268ab7a3fbd4c621f

SHA1
74a9ca047e4b0ed9aa1637f917913745069e37a7

SHA256
db6c013927db4c6ba5e0df44e04675818014738f3dd9c38212683364443430b3

SHA512
d3df142dd2efc463e36d1007a3ca7b9566b248a63fb6795fb2f17b5ea64369b1981c8770c3da43a7497dab1d72cc9483f872f07ac9d7a7285d7ac369e2b4d406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4c613c24b5f3c0d8_0

Filesize
66KB

MD5
dee6e7046748f789bcb147361b94c430

SHA1
dff0271d04c2592d41a6f579541254fb31ee9cff

SHA256
10b13695ef89a04c01b1c43c2354bb0492e227ca6cffd378ad4ff1b7a6eea55c

SHA512
b2bd9473a29cbea7c8ff36f6b7f0e30f34ea6c46fb725cf2da3b58e73ff946c66354314e044811509307b2812a8711c9fac411d36d071ebe546b7ed607ebd594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e9b18b0f66a7183_0

Filesize
1KB

MD5
0403057f397b306d8c6d45c7b95e4b13

SHA1
7d5f58665c165b2afd500c39e9061bb2bb3f3743

SHA256
e0037b4a00d4a89bfa4dab47ab0cce822c21807201bd3d0369720e40ff27afd1

SHA512
8ca2228a4f8011dfb89c64706a704c94403e259c26b3112a7d4fe15c0a032d5496074f661a5c624103886c09046b32ee2df06c5db792f936d6e8abc732feb3de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4ff4b179c1c05fed_0

Filesize
1KB

MD5
aae5b95a5a4e8fbe08df60b3b7689644

SHA1
d818eda53f346eaa31cf70d35652bffc76da19f4

SHA256
ee55ead171c3acd111e9664abe153803c81b1dd6e624a6cc5aed799b5661dc89

SHA512
4d28cb83e83e0695532782f13733082c6b9c5b0d85870292550f3371ee484ae6e2aa5427b11331e3b727308308d0849bd5293aae6d72d8d07a408d63dff1fa62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
2KB

MD5
21c3e2b8afe30b6efb7915a82a2c82d2

SHA1
a11a3056183c0f23864f1ae4eec14a3d81c7b7d1

SHA256
24a2299dd5d2adc17a7ce3234d5be83f7e74f56915dc96a3c11be9a757303b1c

SHA512
139b0c4812f6d47a3d97455bafc12fcba3615c371e5de4be3760d250100d26a59271d4eeeab8281807e05daa829a884899dd0a6178ec7a3ec69ae7fcf386f52e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5dd1e579c9681f95_0

Filesize
2KB

MD5
05c8508e97d55abb0e9d9fcfb0642b52

SHA1
fa70a6a360ef85bfef067d71962e6e685f0cf068

SHA256
ed2f796467fae0d20dde1f3c641c9002c647b34b31249d7ece12b15e7bf30845

SHA512
95cec7713cf39e3dd9466512d96dd5da045d31bd53615a94e014cd053017078fdac2b8f72137c34a55f783cc287d88f9db8ba8f7a4fc271b1fd15b77fafeb1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6077c69916df82d7_0

Filesize
2KB

MD5
cfb5507938bc784da8152b1ad747c493

SHA1
0cf54d4f84e2f82736f788cbe99ff6510eea6616

SHA256
142e68e12e152d77a1e6d224bba58b8ef42970cf6c08cb112bd19926c7b0d48b

SHA512
9cde27258a7a3f54bec87ab688fef3feb2ae562395ee6c0ffd5539b75a5993419342cd1b793b617281c5917d40bb166985cf7678ef03f2e9dec148f1d4562650

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0

Filesize
4KB

MD5
4e47a122f66e97c7565b13c00c63a516

SHA1
64b37907e70661420269929548f7c108cd734419

SHA256
edbbff6b8b73ad3740b3cf47438fe2b26fc5909f651f5892faa6196517ca19c3

SHA512
9fbb4fbb1cc9a826c6a32e5c86aca79e57cd8946d04e6489a759107a1bc1323298abb5e9d70ef18549b0d073867b8e780e29815923ea2991e9b965481ceee261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\63da2a4943da4155_0

Filesize
2KB

MD5
d359223d7a8ac55b95062e0a14c7dc4b

SHA1
bc419ab00e957a92b32c9ad3490f70033f7a49e1

SHA256
965099eff3ddc3f57fa2cc8545cb83196e4f8d4e9c92b0e8eede244a6ba1a208

SHA512
aec21626aa9157541b923e9438957bb65f50d9d31df3bf18be12df50aa03be82903b87fe28f386c58d913cbc272b1c89c53f9977b24df7c95ee5b91739e15d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a5e8bb53a565b9f_0

Filesize
2KB

MD5
5dead20aa3f31526b8ddf8b583698e85

SHA1
097d2d24a78148a441a9011df69361c784dce1a1

SHA256
efd814df32fa246ec4d752ad0bf2c3b4dc6fde061fac48554ff5d9218a271e24

SHA512
36042363e644fcb0e359d2d704edda0fd16062009b58456aec0debff75d0127621246c9d0b299d971ebf2dcce3240a685dfc7bd9a4fb43bfbb154fea7dc4fdcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6d0b78a7984afdac_0

Filesize
2KB

MD5
3859192dad3326f16c4f911b79889cc0

SHA1
933a7b728e980fb2818ed55bcfeb4e20c3a7cb81

SHA256
53c5eef5ea367d1eaa0582282c02df2bb93d9f42267b30d3d30980d9a1103f5c

SHA512
dd4f59b7773c5477d161f0d65a96c96fb8375b883228a52aedb624a06d48cf6cdace5f7802cb58fe09a2d9f8880850298877fc72c2174eec75be59322b164b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71d68e68ea4089fe_0

Filesize
6KB

MD5
9b5fe9a928e4e69bba5349aef037c0db

SHA1
9847819b29f830f112db4f0f462fece4b88dd3c4

SHA256
afdd2ee83d2ce1c5483cb0778b954e094be71f837074a61afed9f22f69abec18

SHA512
ab48b4917292becf33ad94453684a460d2532117d1f856ac6c3455e6c3fedced5cac1bcc0d81b467a40abab88a7dc77e32bb8bd3579a2eb5b0e1faddf63aa832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
2KB

MD5
dd4f820ac9d92f5dc6b1bbbe91426700

SHA1
ef0367996d08f151380a2e45569de024c114969b

SHA256
7ae5e594f1c1fe8ac5a3ad72d1c5e9e8469a4ffad35a7b1b415f6ae1a439dffa

SHA512
cb319d79e5afd04b1b171a9b965023696f1b374d51740c4b80ae8f78da27d4edceaf4291cb30819d5b757ddb809463ee7e55464346eaaa1b7095712bc4c842c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\766094f4b47e839c_0

Filesize
9KB

MD5
f87117dbc952aa58a0083708d0e9ea3e

SHA1
0d9c096c0619fe77a7e9b56b9080919d08f744b8

SHA256
9075f48c4cd2eff32ca8713d3e09b813c4ad0493a4795dbaf93dd54a1c952f13

SHA512
8f97a9fc240730fdc27415bb4db52cdacd97e2fbf7f35d0a4008ac7e343c23aab0661edde5cff41fd69b35d3175b952282ccf1d5212b396424940d6a3c531661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7876f07205700154_0

Filesize
294B

MD5
03aa32c58549bae5014a84c5a2bc2838

SHA1
c704f5b037e9ff5c753d33ed5cbe19b895cf88c8

SHA256
edfa64adb0adf85ce333bf30ae9440052eaa93f598383e751b979b46c005e959

SHA512
8a68e9d33185f5766699ad9f0a1a5814cac95503d8815cfe1f98b1c8bb51cace6ade14b4aec0f4b7b547e65d9acf32208143862601cc88cebf48f014a21e09c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\86b9cbd77d05d034_0

Filesize
6KB

MD5
d66fe4cd0f8ebdd6e864e45932a73bbb

SHA1
a965bd2dd1846d50e553b6cf1d2b33c38a2ed3ac

SHA256
51a80ee27887e74f16858f5ed3df1326b34e1f3a593b5249491a14deebf350bb

SHA512
cd1f150e780bc1047a0d4726a7e77c7555915caf166e0e65b76ed13289144269220b22295cbb014f50d28d4a97fab96ce351bd087fa418f0a6fc0e364e82154f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8b411dd3f263cd28_0

Filesize
113KB

MD5
5eca0c84d48713f42f18363518319806

SHA1
4bce9b0918e9746891b8a8dd6418934b1420f48c

SHA256
e837405fe24cc8fa7270e36a7352c34b47ba71487d48818f5013485bb77aa9bd

SHA512
c3db42dbf25355ef96e41f0b91bb5ccdf6b735e183ee54090b08869c501d6dfde408baebe759de18c97fe1b3d9a5eac9014c5d7a8e0a85d90a128dae7d7ebda4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0

Filesize
1KB

MD5
dda1970f4d3bd9f9e32ee5289a21446d

SHA1
cbe695b1f9c31b42bcfd2f83c3d4e99c18055be5

SHA256
c66246f657c7fdf5f4af3b706479fca9d2e30ced004d43dcf7870d2276e09c66

SHA512
9057e0dad0812b1495ba67ce92e2ebe148b5817a80806ece6fdc527f111cc1555d9a46cbbb935bcca91b926c1af4735a0c9a42374f4e1d117758e4fdf967631d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90d7d7591a1b39bb_0

Filesize
262B

MD5
a82ca76633c0b7f2052d5d9a7fe849bf

SHA1
9aab95aba2e9e729b5dc8a6ab1dc791babce210d

SHA256
b159d656aa2898058a26b3c9502e60cee735dc99c11b97487212c5bf1cc76d27

SHA512
e71120a6a5d6767eefd48116662f06cc90a08c9001a87760865c0511dfb31dba01d8e02bfa8b1425787266fd42720d288fca7528c0ef854c436a1789c8e8dd42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96bc766215a93e35_0

Filesize
1KB

MD5
b3375564474643d2e36c1fbc61240a02

SHA1
d0f354e345c23eeeed303bd4d8dce53b04bca447

SHA256
ae1fc6f5e17b6ebb76a8519bbe35cea9816709c6196439b7c67f78d0440949c5

SHA512
5a57f12bd5d07443762bc69c155a5691d6f72cfaeae378c31573fb278a0ee6da8d4a445502286e11c694d2f755811c36ea1ba2ec1ca66d38a641114e16c5572a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9dbb949d27873cbc_0

Filesize
2KB

MD5
8545b38330bb40ed387c8bb86502fed7

SHA1
f50c6310f401ae5b1c7c35457806410955e80ded

SHA256
c56baa83942e83da3ff0b8bc95a26e470a617aa9f98fded0091b13f0ca1fa44d

SHA512
45eb9eb16dd08ff2a926b4f98cf12f3138d1e318a1d115ce605893b1fbad57c74dca5fb479df9b75a6b15bca8f22bd0e0276a1405950867c2f4de86c94d75c30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b2ccb59971c81324_0

Filesize
6KB

MD5
97e620142e34c807cde9660737b29ae2

SHA1
50417c29c18738b891341dd8bd9d8c43855f747c

SHA256
337f0b5d9c540e7a69b4157675c59fb10b6cce5608fa24574b9e23f08333481d

SHA512
f574d75873b865f0694b6b1ecf2cd3adf7d443b1edb4601437ac5136b65eb9e70be3b6413ad6120bcede04bc4b6a7daea4aa98189c6815be1a248232cc5d3d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bb73c6570251aa2d_0

Filesize
35KB

MD5
4e1739fc4c413ad6e5d770935e3730a2

SHA1
0fb97817c158018bb6aa3c1a7b7910ed47722763

SHA256
aa4425a452491a205a29b6fcd30e958635a56680f3341e1cbf900145313fdca0

SHA512
8dd83ec84310102c47dfa4d00489a3da1b866e66dc4f3f9d86322a634fd2303251061a980401b5adfddb96c2666e6e216581a0c51f6d40cbf0188309aa8b9108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bdd8a4f7267aaf50_0

Filesize
2KB

MD5
6f97a26207c2d61d4b9e433eda66b3e7

SHA1
49b3d8e069826a07a11c8750972a11c9f00207e5

SHA256
a9f6051c8839b657648450539e3e43eb5baacee977059392a83d141772493849

SHA512
ebbccb17503438a16c883428a77c97eebe24681ea042d8d8b4f2f67ae2e57db7f08cbbc02c70618899f80203c47fb4c1a96d64ddeee6ea3d6700b322babf1bbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be6d12311ce2b399_0

Filesize
2KB

MD5
259b4076828f4b02225afd2108712f2a

SHA1
6897d87ce26ffe9df33e2bee7e29f7846495b070

SHA256
e71c70ec7f7a668251fe882d46d6fafb078d18a3be714842e36cabf4ab31a8a0

SHA512
f053bea92e4d38f1837064d1f4e57f7458c72a77788f490ed6ad04cb9a1006d1364eccc93af814215ad057c3ffa9f5d5c11898727402576a8ac0f9f465b0648e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c0d1825e36e4f904_0

Filesize
14KB

MD5
d7c44908e73c748a7a030a6f2536700e

SHA1
f4061e96e90f7b4c0058a2b05dedb46b57f5539c

SHA256
c0741fa5fcbde91a00019ddd786a5500dbe632ae7483950ea629d92743e8bee0

SHA512
9144eafd01c825617637c7fb502c1a788fb382fb78d886b9738604872005ec1c7785069af949f3a4781f989d0fddda9ccbb4a46fa7a526b5df52d916484cc9b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c2d98c69e48443d6_0

Filesize
175KB

MD5
d94f023a565b09f682c4b9cf938a0088

SHA1
de388ffb94a0af4082d38e7660a79ecc9bef9be6

SHA256
43b65a201f3c73fa23ece207a97519e67c6946327d411344924b68734c6a4435

SHA512
a6bacfa4b670c8db02c75c50f33008297db196ebafd058fb39f449ccc1c938e945526cd7c65812b5b3c4ed29cc11b62ce3bec8b63ab3479979530aed1c509de7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c3e98278eb8745c8_0

Filesize
10KB

MD5
d1085863e560e765322c2a50eda0f718

SHA1
56d482e43cfadc5debe0b72d6eacfb926d1a36e0

SHA256
9295795e320f92f291203a4971a1b5e35c5b551a8c9d722394360535135114ba

SHA512
18dbf10f427e6e3bd8dd88a05f308c77350e6a051e7393e6d8a4c55a9c7a43231c456346acf175d81b210ad293a40e62ad969c25322fbd5b8a5cd3445c278e80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cc73beeb35d2d9d4_0

Filesize
1KB

MD5
3851bb558eda8e933787bacccaf50a17

SHA1
c147fd47c73c2dd93d5454fd84a9d8258b81d13a

SHA256
f8216f56bbc237c67146a1fce5bd703d83d50d109c3a15879f3d41e3b0c0b8d8

SHA512
89e7771fac9fe9790b30dd1a98cb518c01f13b4bb096782824437c3f1005c9d0de70181b71f4a676f3c45763775867fc1afbfd1b1b6b75d34b529db9c0f6e0c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ce003bafb7f85a78_0

Filesize
262B

MD5
47792f3c3874b21f4fe4e088c4b54e43

SHA1
2646e553fdbf9c2b0bdd17d8e1c2cbeec8420b78

SHA256
e39b819f867903689162558f323b10519025e21112fffaea053caa820d07a0fc

SHA512
9f488999b672f10fc8e723cfb6e6a600d0e9c1bd9ab754eb9af1adecc06837c8fe3f86e4019dd7a1cf1c9243f70703318b39a2ba8250d209058d057efeceda5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d2f9a2fc02c20de3_0

Filesize
5KB

MD5
00e735085b5eb2ced43887b66f417ee5

SHA1
75c1e6aa96c70b1bfcd20ce4e4618c346faad6e4

SHA256
39c1b8bc6041d695b4df583f25580ef69f9e7ec30a0672ebdc5f0a92d22f50bd

SHA512
bcac3b383e15b8394fa0c7a9b7c93d01f91448375b9f5f7bd129915286991a1450e7b1695ba68b628fa958918ec1d18f7222494934f71a3517099193a08a11ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d47c17830adff72f_0

Filesize
1KB

MD5
54d74bfdf8380bafe7ef0dd9339a607d

SHA1
70f87f9c626275dc688de4d33d125e368264facf

SHA256
fcc50611bb4a4324cf4292c24eaad35811d3dbc2f453c77dca64e87be0b6bb24

SHA512
bcbe9ef37b947867be6cb857dda4484082277c9af5d2f186638aa1bc24cf53e91b8098f28675ef58dfb46e225875d08cb260596e2a8387fd35dfab77ca6cc23f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d79e0a2891fc014a_0

Filesize
262B

MD5
c55ac248c11b297cf4eef23e48bc3028

SHA1
8a74823c3eb406456d558d7b7972d7c930ca4df3

SHA256
fa1f8e13a5c3a5efcc92598b764d8e12f01126b1433198afbc048a52b7a9931c

SHA512
f1a5385a7f482abaee8f596eac793496cbdf05fc538091f4aed6e363cba3a7f4449681d349314af3c06d1179600b2e1805f3fc6ace6b980c0194f8ede1065a88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\da411d8773415ea3_0

Filesize
313B

MD5
292c318f0d7894db519a3a82bb53368a

SHA1
a0af475c493898711781bb0933c20af0ef96a505

SHA256
7fffafa80c80c987bdefabb9cd197a93d4dcded20271f4ddc62170d974fb70e2

SHA512
ed36a31485926fbab245aff03bf6e8b8c0b0029f5b1fc75ae4fad2bc87f571aad0f952d99578aaf6150034efaf9b5cbcabc9af9273ddd71655d265b1e02731dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\de798863d54bf130_0

Filesize
33KB

MD5
33e37a388a7cf5218bbba7b5638d223d

SHA1
60725e9edd971c5904aa39edbfa2c9df36c5022e

SHA256
34aa5992d61c44178bce4a5a88338731a2dea9eb51c1857f5a0fb8e93cfa60f0

SHA512
4c069ee3073ea63dcca3f4edc661778042c441dfe45e814493aab20c10d2d97dde661c8efcb04d003f79d08ead82c9c5d1534465e474f09771f1be433e427086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e146fd968644d345_0

Filesize
6KB

MD5
5e77fd281fb5d457ad448acf6e05c11d

SHA1
3f987afcdc3b51821b5c22fab175ea5633813507

SHA256
a0f265af933dcb1598e716946b416979ab215b30b22163a1dc516fd5eb24b661

SHA512
c18d46b08dca9a74276a7ef8c7b3940a9d585ebc8e166977275eba78422a1e0929147630179e1933afbe97ffed56956754c0282ac502faa4c02f2c8cdcfd0b3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e18532de58fe3a53_0

Filesize
61KB

MD5
9b8ae7534a1b9b4ac3176b804327b09d

SHA1
868b5a7446da271466c05bb4145020daa8c664f6

SHA256
f00ee5c797d85d93c83db651f7aba94ad6a7b6886215d96eae6e7945364fa101

SHA512
937e1b19831320b85a2eca274e755290ef32e375876a118597b8fd7716c8e8170e8577be341e0db30394552b4397628df544a6b5d2b19809511129b341b1e24a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e29949039513e5b9_0

Filesize
1KB

MD5
7cba8dfc9b2bb7f9ae1d6eaf142b752c

SHA1
2f1f677e501e9a19747e0723263dc01f9e1425e9

SHA256
0e67307aa026082adfa789e9571383eb47fbc8e8d207d86024f5b1bb485fa40c

SHA512
05a63f1db7f64322b63799d97fe7101d5da8d638e1bd9d9208084a7b4472bf4f2ae8bbec3f098bd4da797176499f0fe759edfdc46aa1854e6c956cbe3fa14db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e5b4dc6514b2407d_0

Filesize
2KB

MD5
f92830de72b20ad81ab6612dba7bb130

SHA1
2689a7dc2f042e93d0dd7a956386e520d28cdc8a

SHA256
81f5fb436f2ff78223aeec3bfc6f5cae3cd52e3f51234d4dbbd5a1a2287946d5

SHA512
d2f84329e7bdff0f2cea71ce27f3cb0e0073ed1c2c3915daac26ba6444a4711a6e1215713ee5de6218b8024d6a4571c3f39e1deeb338b8733afe15ea00ee93ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e8c8218aef51a783_0

Filesize
3KB

MD5
51db9160112d2761d45bb845b8e020ec

SHA1
65d439ca167e9d41ea8fb1496f60b35d20d47f72

SHA256
08d9a3dc7e7eb9609ede69dc58289c774592e72af5442d74b71aa770d6075baa

SHA512
79389846fd5d1edf0266cfa48da96e0d331204165979ec6153a8b15ce2d6b282a10603afe7281b7bc76a07526b6da78c60df06e27a0e70d6c9f0a5ebb6faf351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9c7e700cc3e33cf_0

Filesize
48KB

MD5
964a1dc83405f0aa6a8b83a4e5afbb91

SHA1
e8c58cc7fe3fd35a20615bd21c5ca61d3f0d9405

SHA256
002366e921dff8e28d743cd4ffc7f895407e5efa738cc123868ba2e2ff8b333f

SHA512
4533ed51dae4de4f3afe885ddd9c2e81f6e0d35a070ea66e4a31523a9e8decb5c6c5003f26e509c194ed90a2031350c740c2e07927e5ad6e0d72ec88163a9262

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\edcfa46b4139c45a_0

Filesize
202KB

MD5
e61fa093fa59d53b1b3a8c7f44e4f845

SHA1
80f5b061bd57358309766174cf6fdfb5b41912de

SHA256
a43372f2cf75289c701a52a4aac50e6d30b7eed16fbee23c9d5709528cfa09f1

SHA512
b16029b22df16d67ff6d71cf586c8d7243b20a3e07dadb1419fa2e4082a3245479170d0c501026cff2bda72a987cc92b1c15bf86462ec2bfb88048bd83c43443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ee08c28427b16c56_0

Filesize
1KB

MD5
aabfea41f6d325f82193f024afde4492

SHA1
a6d26759cace3d7dcda8406aa872a057890a1d50

SHA256
8ae4f44ab54e0f88077a3816db141607da4809ad4c2fb049cbb6b83330dc5990

SHA512
f3f3738ad4cb46a2834bc22124e264c9e9bf81c6a34acd80b0c921b68494d4f9c5fa1b5e988e8d7520c8dc5d9bb4a1839d28b038a40577ff923b079bc2a89b50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
b4c86287eb3134b0e0a7da4dd9e95bfe

SHA1
49b5cca0e2f4e10996df8ad528ebbdf71051ecb9

SHA256
a2cf8679bdbe31bb2580c9a16ae91af4b3b767445de2235efa0980a6aebf2d53

SHA512
0926c58aaad8d473b7192df83cca80545ef1e66bd1f854df54d323df37b35ec1887f0407c0b97b653d4d3dbca9cbf80b92a630aa5eed512bfbc293ffd7f69960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fb8c75636e7db51e_0

Filesize
11KB

MD5
d7ab92e6c54f09b6b67f53d394b4ab19

SHA1
05ff0783a3f978bcdce9d810dd8b4b7724ccc808

SHA256
e96e6e7b78c3261661a4b2351b5637a2e36042742fa90e9d50a702404482cab1

SHA512
3ce00d64a0ee4c7493f1f08bf0f35ee2031cbedc901767872337dce9a2267f5445791fcfdb1a4861737e0a602ab8faa895fc1476ad273f84faf5afaa92495a24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fbd11ea5cda006cc_0

Filesize
27KB

MD5
d861c6fc4e319bd249161331d1c32a8e

SHA1
efbc262c520741a3bfdb9261d86f76618bdbef87

SHA256
2ea119e55ac10928b06d8ba166302135fe3a74e0d871b4c4b4405bcc8592a9c6

SHA512
fab9049f1872e851e10651a2e81a281933e4a62013459ee491a59e23963e93f086a4d2db2a4bef715b390b7353d1e42e96a9caf2ce55e0c3dcda38dd391f0a42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
2604f288e4ac7a9ab06f5045d5707d5b

SHA1
8adb80932509b315c5ee96bf021f5e4f9ec331f6

SHA256
439256a1ea370704b78453f1ee4e32d29189b5d496571a736730167625c68bc6

SHA512
72fd66aeab852fc1ef3b5401316f5eaf9865a8c3ee6ac33f64dc36a830d5f519c66b6d414845d6d047c4f5ff20d43afcc544e3edc79dae61cf6dde01532112f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
66cb74d8f9099ab2d884b608ee232e7d

SHA1
626781ca3644f2096e6498f274160851b90acd23

SHA256
614111f53807595e16e3a70ea76d4ce3e689e06b1ab5fdd2373b013c7258649a

SHA512
0781cbea6263e487bcffa56f8f5dd2965c05c712dd735c289449a907f57020452d2791eb147bd92262b82356f2d776c9fc83ff62cd560d873c627bcd3fdee7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cb4ccadaeb6feef7eefb450a7df37cea

SHA1
05d36184e391818e9f69c4a7f677b473e72aa6a2

SHA256
dcdd575fc09a7d07a54a4cfc2e43733749a27d31d88d5ff888bb071516bef617

SHA512
1af0dd9437a4cdff879cc13a432e7722d879052e6f617c4076b3270ebd6697e458519838ccd1c21feeb897a8b04f7ea483688b0bae06f3314970bacff77bb261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
5648d9d0974548286521db27c1c8b66f

SHA1
7acc1129d72f5375a2a613a3c40322df856f0540

SHA256
61f0ec1722652d03fe1309e4eb1f1b8894b35035631ff6489cad83005e9d3d80

SHA512
dcd3c411e54615161b44e512e348e266ebf1f9e41abbacc72c8d2bdb6cd6b3cb14978488aedc5f1bdb9b5fe85532c3ba5b0036b7dbd42d87a6ce33d152759660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
788B

MD5
a98d04f5e842f72ea80f36879ba2b2ba

SHA1
e496680e756e4a38a9adfa9b47cda4a8f70889d0

SHA256
b4387087eeeae364dcae707c973243751a71593877ec5b8e86303aa54caf1792

SHA512
3d9300dd77e872977a735427d7e8647fa5a006e28703359e1676196104488b7e9b2e8957029705c1ae549fd9ce10ca4e5a760d3db6cc88de897d3231794fbf2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
36dd5f21721d73aaa110b475fb84f361

SHA1
f6d2264e4277a72e4b3f77d6f2dda9ce02470cbb

SHA256
dd21ddca6269fa4eeebbb673391a0fb08a0585a24d30ced462a68ba944461b8c

SHA512
bd95d171d4232cb75639b059a60fdd2a205364468510a3753e5462b2c9ae807230874c35541ae168bbc69695c8c1e5a802d27029837c319902229005f5edc1c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9e5aff87f47e8b5a381475d90ef3f763

SHA1
6f3e1cd5ae5e1b2b150d278eb07a8f13634ebe50

SHA256
cb323b43275b1b2f9c7b9b17a15972a7d8905786454085882a8c761af0fc572f

SHA512
ea9d0c6aa00566ee0a1e61b2f5fe8ece25d3913f3bbd17a66db6c53a4148cc0fc95e6350f969b5ff20d153171b0fb2d89b2e3904921fdc64a264545dcb7e1796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
285a8e1241c635319ded1b98679bec8c

SHA1
b27676c57f5fd503c95217f40491f8fbeba41928

SHA256
8e645a899c16051cdc51235aa0302d35e0e9f81835ccc76de6c80cba0c0c0f04

SHA512
24a10747a82b494e2d9186655b8dd2c92e1554652b5c1a24dfb36365734be8f601b3d22853ca13a682a2e0977df6e3e143da01bc9f69b67caba84fbbfb7d12a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e22849c61a5dd2901be58064f2f4425e

SHA1
7b139cad3ec07f7cde803308df1488095c612469

SHA256
376efda41994a7b12d6cdd462654b41cfd777090b5a5003b6b6662064ffe4dab

SHA512
5f668608bc7957c8c8e2e26cc51cda61914e7833fdd2d572650192bfe51dac34812391405f9fb447e33f026ffd87dd51e9cd0d0a8a728def37ec2073bcffa702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df43fa9994dc0d9ebd2efe4101abe646

SHA1
71182bfc44644c4f63059101ee9e2cb6b5c418c3

SHA256
787ebd14688ca4b3b9b24665a5033c53fdc7400993f9d74ffafb8afde5eef836

SHA512
0d6d9c0afe21c1063d11b43ecc6421ebb5e919e622c2bd38e0564691712216147a2fa51f867091ddb97628209beeeb0f5bb95832028c2437647d01106a0f3706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91b9a877736d921bfefea11444ba5fac

SHA1
0f225d40564847d1ee2516c790b2b2d40cc3700f

SHA256
8b0e0d34e78e9edd05d80ee0eab0188a05a7424312a809b998a6f3daa144e798

SHA512
922c0541284c521599f09d17d1c006d39461ba1df6a40b58b4ae84a54aa3c5b0ca834578007b52c83a2c0cb3c6912f886faab472d555a885aefc8a390fbc488f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5d93bb6f7bc05a28ae7220a260550b9a

SHA1
2d6a153180a222aec68a52ec849c42c4a2f261ec

SHA256
14c0860d8840933d99fe5fc4d1f1098a1fd5a1f9f418d4d7da1f4797a419401c

SHA512
4cc8bda79d8dcc91cf4ce2f6fbcc0df8fa8cc2673d7aae337fe47e48f098ced1d375e74698cdc679f34dc2b1324a12858bd36c47ee42da88b2414a30aa11532c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc5d4b0fb66fd39e35ede38b2524648d

SHA1
1f16397c9d5cb476954ae50ea038189d462167e6

SHA256
4304e9d8288832229dada432024b3fec4fa9abf732a364bd699cff7a7f61df52

SHA512
669191139463e88391260ff70d019496ce50da8c26e91d5010467087e03c27e63ccd34a8b87115fecfe0b257b1ee388f67c91e4f30dcaf55e05aa434a95d11a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
592764d81963562ded80ba8a2f7e694c

SHA1
89e4c855378830d5d176afd09c05173d673d0e12

SHA256
126afe97fcc0287e753bd5531307930715a679b3f2b34bb32d60eb531bd7edf3

SHA512
ffbe0b1d51fb44b430524b4b0ae54b6fb892db76b2416f5773db8302b54689ef97eaaede302ecc87e34b192d45d9de6d6af50721a5bd7b24e6c6a5f10ffc2e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6eb654622d564f91567b359014242354

SHA1
deb3c09e7937af70bc5e234985c1e07502a143ff

SHA256
dba28043d21322c1e8dcb00e36b60649e7b42a24713c614a91e13f0d7c24d61f

SHA512
11f9de47e38b3119aeba3715ec49ead0f6ba31bf422e59e09e11fcf7aed0c42be4314de2971f9e5d8b6b893d654d070b67448425bf81a3439b2e8c8325763519

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac30eda5f84d1e7207b07798ba1bc3b1

SHA1
23720eb795b1242bfc04b87253305f25f0b1ebba

SHA256
853a8775fea3a345e6a27c34dec94e004f8f32c3b83c578ce540cab370246d98

SHA512
ef5eb055c3f6d46b33b4737bcdf87c01e4081605794a284b4cc8601969b44e335d10e4b7559f625abfa792c115a47f1ca0da06ec782237c7382f43c864d4480d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8bfd50fdfa8b718bbd181ec49a572f43

SHA1
a017c6ce39f60913fef7fa9e2e131070bf9ad02c

SHA256
c59750d00f76ad18859fd541a18830e5462c2dfa6684e79904ca1eb2ade16d30

SHA512
c29cbeed9de15a6a6e41d923e27c76b4757c0b92b45af035cf88216d7ee2b6cc471ae86ec15bb0fb8da3c00f8b501b42d1d9f204a9768c837094e153ca3414d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
942d0c4d79de44461be037d98111024b

SHA1
a9de623bcb3b2e6ca0eade8ba0c22da5cdb745b9

SHA256
3435c329d952f0076008561822586e0dffd7ac0ddacf1e2ffb03d17823a8aedf

SHA512
94ac21865b1e65ed766f6f4b5bec869e93612a2f151382b662b0a73a39b9b6f3dc4141c8b9e10e98f22ff97d26e69b23136715f73d5a304e623b37179648f9e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4ba3778956b0f265b75dcc72030718c7

SHA1
9386d4c4cada7d96b3e3cdf28d71b2f35a8ecfe7

SHA256
c578bbca3b26f963d884105a1655cba6a8b7aa87bf83fd67385c4782be760371

SHA512
5824e69e474cc8823079fbd54a3835e39d9bcd1f6571939bf66e4bd03ed4f1b331881c9c6eb5d3bfb9927c8ad754af44c36bcb29b54969d6854136240d1bcdf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3f8317eb316b2c87fc164867301426b

SHA1
c9a741677ea5a10eca5608664bc29b83275487cd

SHA256
d48e18372c61c28e46921fa2c63768c21b8fd3be6906b8d2a4aa10e89c05be60

SHA512
808eca742ec03300b804c8fe208a0c0ab969a671604f541fc8d09bc45b680c1e504218906c1cb49c6f9bda52cf3d7193c6fef41709906dd6400b5e512c7ff065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5b9ea1af3f710d67cb2c250a84798652

SHA1
0287f635b26a930ef0f967ece733993a2c473706

SHA256
a95fb75977d4ab1f4c84ed859bf7db1b2cb2b2a25f6373ee607f4fd64476ee79

SHA512
a5e8dacdf70ecc0687e5013d83ee04df80944ffd9b385735e14f51907dc0afabe8d716316200eaf44b3a67ea5de5fd48dd05f26a4fb01ad79861615ae5fdb401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
92e8c2a5acc8c3726cf9d9f0c564faeb

SHA1
d52163f341ce80384646f1be890a0add47b23d51

SHA256
a8eb22cd173dee462662a43d489dd4c98005d029346581a02ed2c13ff8969547

SHA512
018ab9a7ae3c94c7cf3ad3718690a6fb684d1380ebfd53a87c96b89bbfc40c19e1c355738c55fb8bb23f28366bff31589cf0f1cfdf5f08d1e7aa283926fc2852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0c302d7588b8e25b5b71c79b4ef9728e

SHA1
3312efa09d8603ffa859b2da7b9bc85bb8ab03ef

SHA256
0f8d87da850364da6e06c964d28acd535998fa19be2979393ae4919e93bdb57a

SHA512
1d57cec9bae37c5bc0b92b3f04aca11246c869981626ba81801479b7afc32866aeb223a579554f00678cb8013523745d7130eee42e140496f428e8d93fafcbb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
77a86ace38dd9abe0e4cf1f8245d7846

SHA1
dd10c1e122395261b6540695300ad2464319de91

SHA256
45f864b8299c8523f16357c1cc7be6e20a8525b919cee67cdd29c164cc11309d

SHA512
b6d2ec0d0c006cb5628d671c41780b7b02a2a4096a763d4d9ea176bc3790434a066e0c8fb337166cebd24cea5f1b16ed2753d01b00beb382b7afc2004f2aeebb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3a1d839213eb7c26a9707785eb6c73d3

SHA1
d319284d86820117856d9023b572ed57ae979860

SHA256
d9e6add7b8969d3f81829656b8934c3c40291bd9e66c6c6cf0647a08cd05cb55

SHA512
8040b210663db07c4c1b12f7a8ca545894c160f343e8f14274ecef79b8a858eb028dd4f60f56a5d13aebc3c0b21cb78a0068f1c4b9fd9577a4ab26ee30a5d52e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e67ec23403d5f8225b0223a769c9f55e

SHA1
6cc5dd06e6393ae14a310dccbce634c0b78c669e

SHA256
c6cb4fdd82a9a50885c870d040fa86f151f22467f8ad4526e2ad89bdefa22972

SHA512
b04ff9d2410dd9de3d35a20466db9aa25863693d2d3e482eecc3467e13212a688631b50a0c1f137d1a3ed921ea785a4142c21615fe40973139a9487f80a2130f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
84e252631263c5a795d8637639555655

SHA1
1a2c438f883eccfd45745a5256c0876a8e25c572

SHA256
798d6f31bab7eb8607dd85188ddc72f451cc1cf84e07b2465b85654d293e024e

SHA512
368f7358d7797073a57a0e02cb021e59a8d858ade0ce36b1f89a5d1b18ad66ab21e44845eee6ade6dec9205a4721efc2b4ee8e0b932e4d0117632cc72f20a911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b6a2db9a07bc94c95fc40d301f00eb44

SHA1
9ad45877ae02220edf8c6e2b2ff4415023247acd

SHA256
dc74083ccee888b9f978448fef6d976a0e180e1c1d7fbe98662e9a41220ae727

SHA512
ce0eea7dc3492d2d379971d9ee1a4f84ee9f68fbf739024723d5ba41d61815089167f362f38cea23d6aea767031aef1be51b5168518822a5039d97a970fea2b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593d3e.TMP

Filesize
538B

MD5
99210e62423710408f3a85c797b1bec6

SHA1
a34925993f20ed3d32088d834e313d3ff0b00a72

SHA256
6f8e13968d85a93ee214cc07be0543f29389ab31adc73f79b0bbba795fcafdb7

SHA512
804e0b5707ef499026b7d4005d075e7ed705c462f5a31d619439a48d80b7e26d9018237e25c039fceb95a3afe8e6fe2f82e69909562423e90a30c4dc18913260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ca90e8249702b4a93a6f866d6bd5eeac

SHA1
b7802f297bebef671a8e19508416e92ecb03ff72

SHA256
32682d09a8030be9b74712b204306b75498d9f379ecf9983b4cb4cb884509f8b

SHA512
636ab14269072f1193c1624a64b3c5b6d53734705a6b60004e1417dd5b21ac7c29a0ed9a9299e7d00021ad1f3f6d73159c6d9684460ae299c84ce8deb42280e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
18983128475314211dba96170f294d25

SHA1
143ae9a49407694c5f8db12bcb7b60a819e74112

SHA256
32807f69cb8b3461fd77adf2d1203a7b6d5623fe26184976e90dfc91cc63448e

SHA512
b233402574af9802a5d93a3c692b01bfc7cff8c0d46720ed010343204c329721681200bfb0a371c517e19a66f14b0d6c69e1a3243e505896652fc03a499e5f89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
edbc2bb3a1552afac2dc5a8936876ea0

SHA1
1976d6993a753a668d4e0041116eaac3f78fb8e9

SHA256
b30792988a9daaf5d3b6a93c8de1f46f173ec77df57fc2de2f5b091f8ca138e3

SHA512
6e80aa67a63364cc594ef1b8ff94e8a8eb795ce7dc81df7f067b509a9d398f7ef3084d34b5fb9d003ca220ec6854a6d9cb05ad6125562dca1a72411a32d7298e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b32c3cf67c1d14b92fff8fd5a733dae7

SHA1
51bed32235155bc700040eb0336f4b842efcde7c

SHA256
37547e926d4cf83aaff4923c0633e224995e776bcdc446cde61b9ac08775c688

SHA512
cb7b2f8da8f69e069035bbcbd2124c7390f876a83400675af67cb2d2cee61005eba134305a7144730b3d749c791bcc3bafa759c29c3a1644897827f7667a1356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
637bdf2cd350a43be6c77ba33780c04f

SHA1
02c37818bf8cab576d8a0fa8368ac2142c4b319b

SHA256
58e2e694b0080c0355020a0ab83508ce1a5165646cc768baf9ed611a1d0b7d5c

SHA512
485a87534bdbfb96b92945b8e84f1d93b14b37d9fb1f53344b3302816fac8b5c4009377cf1865757199c4d8c9910c642ae591efeb0d1732aff05e970bf49788b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f6bdaa35-c08e-4536-977d-f5dd272a5c56.tmp

Filesize
10KB

MD5
d3569454047c313cb7474ded257afb45

SHA1
eea69ffd27b43feec8bab02df5f950cb78b1d7ec

SHA256
2c1c1ecc741116a9fc27acaa18fd2b13f3d6d34bd5330df01cad6e3d7a287a0a

SHA512
40e60038ae81b0310c3e5eaac319c10f2d5874e576cf13761bcc67be3a23d34ec48353d0e57d0f1bf37dff282fabd47b64a238fab3932dfbf34122867c4dfbc6

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\26906cf1-03f9-4e9f-86a6-f405e0a93dd6.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1CA9.tmp

Filesize
1KB

MD5
68f17c32295974dc1711e380db7a1b3c

SHA1
f836a366edbfc7b61d63cab045bffb442da91f6a

SHA256
aa98b7cf0ffb0e3db4e47f4a1d9f692a5343852655e110515f1fe0df5d813acc

SHA512
53f980ce4d321d51cb8447078f804c76192c9377e09f7f9c63de541772760122c64a10088618d4252d8ea44f21e2efbf8b9af952679b3ac47b1e06e56ca39131

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5021.tmp

Filesize
1KB

MD5
acecfc0c19f91726964181cdf5367179

SHA1
e8430427e678e16861b0656e9eb50c0c91a7fac0

SHA256
a3fd6efa2683042f4a51f42f801d79836fab317dd98fc58cdf28eedb250033e1

SHA512
e6a565bbe9563568359c86f820085399eb85fa2d242aeb2d93b9e4756c1a21c279974bf329ad2679f572dc88cf19d8076b7cde1961659e3e28d85e7620f293a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmd.bat

Filesize
2KB

MD5
2bf7c6d5d1a1e2d85f9a432076bade56

SHA1
5a91f215ab18ca65ef4af3acad6deec459ddb318

SHA256
5975c4a3839fe22224dde276faacae2de8f7f8db7fef951aaa63136ecfaf7f0d

SHA512
97d15603f16c4a35b78de89d6f69aa4344d091b99a75a76560e4edc791de8af01b4d03057a7c813015981d75a58ce338a3abf3644791a6a7105212256293d774

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmd.bat

Filesize
68B

MD5
952d5b933c62d96dc0f9a7b8306e316e

SHA1
cc6c0b7b18b006dab59d60aa8c67b88e80e462c1

SHA256
32cb15fd5fd6c45fb0e5b6b482abbbdef43112f66a8b83392a8ed6ddae903a00

SHA512
620b22b633e86e4d659c00afc675fb66e989b42676d1b3b7c88f93f520c5b6cfefb6869f29a1438d55abebc019898a789c09eb4fb5867a36e51715ec1135aa5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\hx5gglao\hx5gglao.0.vb

Filesize
5KB

MD5
1e0e84d370284fd399216daa1516177e

SHA1
88cebf77eb23ea8d5f070a5a5a5f0808b43c4b02

SHA256
d5a4e5998ae3c562c7754d184759a4aef90a24c134197c46df74a8b74ca9228c

SHA512
ea88857bf5e97e623e20b3a08d54d569a0ad8ff9ffe769de24cbda73eb6effb58d8aceabad8e1776ade1fdb96cb795f8582617a183fc421a375cdcd83e6bdfe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hx5gglao\hx5gglao.cmdline

Filesize
181B

MD5
641642edca13291d1edde36ebdd441d6

SHA1
c242f12937879eaa2a00fe3e90c3a2ac2502fadf

SHA256
409a80344c4607a7d254527e37d0fcaac9f62347a328cc7f7a6ad177b28f3b37

SHA512
e18b654beb92a61a21f50b3ec89a5509a9f253cf09a2b1afcc8248173a1f720cdceb1e347723a9d35bb35a191a7c494b077afdfaf01a306d432928540b511a11

Download Submit
C:\Users\Admin\AppData\Local\Temp\oog2lhpu\oog2lhpu.0.vb

Filesize
832B

MD5
5c08eedba67859c97352afd09b70ee01

SHA1
61bab44ea2fbeab986baaf451fa64d432dd45b8f

SHA256
afe951323756677909632b695c2a4c2730decd92b13df9e9c7fda1a9df87d592

SHA512
a183739399fb3bc84ab8707d8d4c516d2d06dcbcda482e13feb9ee36678c45d206d0218872e244b1f2ce7974750125f51edf18b7fd00d171fa1f50db822f04d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\oog2lhpu\oog2lhpu.cmdline

Filesize
195B

MD5
7d75e885ad178e9b37f5c326c37021a3

SHA1
5dabae54d7e69dc39d941b51f333726eba041e7a

SHA256
b083ba478e92237851dfec3f7e1accd363b76bf15502e48d5829f94013a8f56a

SHA512
f9dd5de877af0eac2406d84bac28cbd4d74f7e9b950a3917b0e47af5f623d45a0fa8f2181a4ce485b2728557216f0a3e78dcf5461fcc2e407b59b160c7075111

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcA5414AB84DF24283A77FA118EC4BAD3F.TMP

Filesize
1KB

MD5
3ffb5fe62934b73efa5dcc7b77695164

SHA1
8bdd5618f61c5e551a8cf2cb21f14de94afaeb1e

SHA256
ac815aed1de4141d407018342a2b2c505ff950081d95df1472374acb0c61dd6d

SHA512
f817dadb902fe82f84d5e5dffc03124fea7c720f3de4c4ae3c6d6d1afc21ffbeb7246be33e587781ab6883796ff10fec96a7eb14b285f5a169ad8270d355a506

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcB1C8422BA5C4F7EB61549F2811C83AF.TMP

Filesize
1KB

MD5
d9262ae4aa194c10a9978e5540166f5b

SHA1
e01a255a3a1817b5318d99c856addcb07a1795cf

SHA256
b8d62a328f747d74147de121219dcfe5bb188d6c0147b91ccd3a3e73709fe64d

SHA512
213a37280a62731b5163540ec2418e8752af766a8dccdf19bd06defa71576810e085da7dbe5e3f3b0cda68aa83e996567686f8d1d455152063a2964a0d4509b1

Download Submit
C:\Users\Admin\Downloads\OIP.jpg:Zone.Identifier

Filesize
147B

MD5
440ef2200ce642d6963c8990e3e9deed

SHA1
3aa1c8a599c7886649064d39739941f1e67f452b

SHA256
11fc3c9d9bd2322f75aeac28c0ce479131d4f6651323ee08d9b17f1ae631aa61

SHA512
cbeed6eb6ef7d758110b69957579589ab820265ea856099409436086df9f47651d42c1b0d0f2c1a1d2aa8db992a8cf977237b3fbecf271542ee15f4ba2f86b8b

Download Submit
C:\Users\Admin\Downloads\Virus.Maker.zip

Filesize
297KB

MD5
25413d640b2dcdcda873cc7f931dda0d

SHA1
32c6512115401981eaeba364faa4db4044e6ee56

SHA256
292f382cf67416c58c01599e48b03eef8566fc82b2e3343010bc51e278fdf859

SHA512
45059a4df0edc980e62fee8b42ed0cd4d464975fa13d0a74030cbb23f836d8bd23bd62e1934619f259b3d2382104e7025cb1b0a3f99e4c3bc6200923d909525a

Download Submit
C:\Users\Admin\Downloads\Virus.Maker\free shiny rocks.exe

Filesize
7KB

MD5
9a3960b968eff2d82cc04e76fceb6af0

SHA1
b612be68d2f1774a95beceee3440bdccab56611b

SHA256
06c3c8d100e6a8931d0f7f9aaadd901ae65cc4fa6eb14d1f0540910c70345df7

SHA512
c90403a484b71227d75cbea56710b805b37f21b64efde1ff9fe9c6310f4815d10549fe4c83a98dca9a76208376af9d526eb4afd83e9e83bc8b8a9f8d083972ee

Download Submit
C:\Users\Admin\Downloads\Virus.Maker\msg.vbs

Filesize
37B

MD5
fc8be6c07116426757b1485780ce9c40

SHA1
7aaf34456ada654effe40885e2be180c5734f59f

SHA256
7b3a5462a7ef9b5e40906965ae003f9809fa39a9be1413b0c7a1dd2fe212fe12

SHA512
6dc151d5adc9c80bb43fe77a821f96afb7385284cd6986809015480b3fde7d13a341b28e282abc20bdba82e7cd24960b6dbc81893b90351724240bdcadae6063

Download Submit
C:\Users\Admin\Downloads\Virus.Maker\msg.vbs

Filesize
74B

MD5
3d82d06c8eb2bb020de29981121ee8d3

SHA1
c2c5d27200ea206cf849a84da8c0d1dd074a821e

SHA256
9f2dae031214a36fb41fffa8a6847ccc3954e8fdcb75ce9e3bc6a1e2cc6f0e30

SHA512
a4298f818a9040da652d9a58a0d53d26d8cd9321e6996894b4db04ef35d1a94abe7382dd051fa84760a2b0b0046527a2bc71394daf137421d5f066a58571477d

Download Submit
C:\Users\Admin\Downloads\Virus.Maker\ok.exe

Filesize
13KB

MD5
665ad1b66cdec1babb04c892399032bc

SHA1
a29e49e6f89041dec13b744297880078817674b5

SHA256
aea66706f60c588f873afdca30f340faf85274a6291b07e77e57613e4a2e626b

SHA512
8ca0dc4e5f61e8775eacbccb4e81c501f395e54307da6331c337118df6ec7622f2a4f451f178170ea2aa26fc51bf8e920fcf2c7fed9f728d702961d28cb8c053

Download Submit
C:\Users\Admin\Downloads\ca18d8c1-17cd-4382-b5c3-da3adf274739.tmp

Filesize
21KB

MD5
dce6caa3237b3b961a3d7a8c5a6d3e05

SHA1
fd4c89216f063db54bd8967463f9fbf8430306cd

SHA256
afe1da7f2e470d713d1c20e27a5a72a7c8a67e053221948ca162dbdf1405d08b

SHA512
734fd97c7d745010709c97b5142da61023791787230a8f3f740a6318a98e47f35f3bd68b28f4297739990d0fc812a52376bff8b14cfa94c499791ae8656560e9

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
C:\Users\Admin\Downloads\release.zip:Zone.Identifier

Filesize
617B

MD5
6763ae106dec871e6adac785fce7ce4c

SHA1
4fa8ef4065073cf9354963e2d895a7383da238f3

SHA256
8e9dcef1fa1724b3fbc4054b1391cd2200a226fe3241a43dc9dc522de72bb057

SHA512
6c12bb5c0cacff4f41aa716ad532b347f2662ede790d5441d337e0431f5291439b426d7b0e19306c5a038029168865f8e82e32cf800224bd7a91a27f92438eca

Download Submit
C:\mail.vbs

Filesize
1KB

MD5
346d8fa387d02ade835657bee07eb79e

SHA1
5289c0698cc0d22274d3d20be1b564b5396019e5

SHA256
7e5d7ff36882796f1ad2fa50e5db30aef5c68224322675f8ad66c42d3908899e

SHA512
5581d1292e3d994934909bbb42112286d4cf5de857fd29e813986d5c520252e1ddbca64f674280070706a4004e830c5ca964ae485037875866dba3a9b6e421b6

Download Submit
C:\mail.vbs

Filesize
2KB

MD5
616fb281e6107379e04ca2b98bf9945e

SHA1
18781190d36565945ca2cdc8845d34a4d97ef156

SHA256
2a1d8c18357da79da0cf2427271c6542d520db5f0fa1c59686a70cc0f6c3259a

SHA512
0bada1519aeaaebd1f3f28b94745c85acd6e1d22071322f64d983c9cd83b38e33b8792b01e52b6fd17af0dc210a2f6a6146517168cef38aac41cd21c75eaf155

Download Submit
C:\mail.vbs

Filesize
2KB

MD5
d5d5c82ee4335415a90cd1f8c68fbdfa

SHA1
b692fc637de7cf572c865827cf828d0ca398282a

SHA256
d4eaba00467a27bc4d968b284f7946427da80813f16bad3e78aeb004cb3bbdc6

SHA512
88c2d35d9222b388e91058eb81f206815cb9583fde4ade45896daf3921230a0e9dbabfdc537230cfdd1e640d9c22e8d0710f80613b9c23dd8fc5bce0904c5898

Download Submit
C:\mail.vbs

Filesize
3KB

MD5
76348b0773334dc30ffdc0844a6d0c4e

SHA1
f86db0b9c1167aee9f744ece52d02a8dcacf291c

SHA256
d3325350d7e8652118427b21deb4856d80e4f82fed44646b6c155e60d2893d07

SHA512
6f93a5b13b1fb924ef158daae66c59993c7eac59c1f19cea38731e0010bf5c342b42987dd5bd5f999e6afa7c3c09f3d8274cf592cdaa0beabe97b9e24741f668

Download Submit
memory/760-1888-0x0000000000690000-0x0000000000698000-memory.dmp

Filesize
32KB

Download
memory/1456-1185-0x0000000000990000-0x0000000000DA8000-memory.dmp

Filesize
4.1MB

Download
memory/2476-1528-0x00000223CDC80000-0x00000223CDC98000-memory.dmp

Filesize
96KB

Download
memory/2476-1529-0x00000223E8390000-0x00000223E8552000-memory.dmp

Filesize
1.8MB

Download
memory/2476-1530-0x00000223E8B90000-0x00000223E90B8000-memory.dmp

Filesize
5.2MB

Download
memory/3520-1526-0x0000000005190000-0x000000000519A000-memory.dmp

Filesize
40KB

Download
memory/3520-1525-0x00000000051A0000-0x0000000005232000-memory.dmp

Filesize
584KB

Download
memory/3520-1524-0x0000000005880000-0x0000000005E26000-memory.dmp

Filesize
5.6MB

Download
memory/3520-1523-0x00000000006E0000-0x00000000006E8000-memory.dmp

Filesize
32KB

Download
memory/4952-11-0x000001847DE30000-0x000001847DE31000-memory.dmp

Filesize
4KB

Download
memory/4952-2-0x0000018400000000-0x0000018400270000-memory.dmp

Filesize
2.4MB

Download
memory/4952-12-0x0000018400000000-0x0000018400270000-memory.dmp

Filesize
2.4MB

Download
memory/5108-1929-0x0000000000980000-0x000000000098A000-memory.dmp

Filesize
40KB

Download