Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

بهجت �... ..mp4

windows7-x64

1

بهجت �... ..mp4

windows10-2004-x64

8

Resubmissions

02/05/2024, 19:13

240502-xw2mzseb6s 8

02/05/2024, 19:06

240502-xr2gesea9w 8

02/05/2024, 19:03

240502-xqgqmaea7w 10

02/05/2024, 18:59

240502-xndwysga69 6

Analysis

  • max time kernel
    1799s
  • max time network
    1692s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/05/2024, 19:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    بهجت صابر - من ميدان الكسميات ..mp4

  • Size

    1.9MB

  • MD5

    60134762845141c1071ba1134fa5d712

  • SHA1

    5f93f2ac13f1d2f4de8418b768b7953709c643a6

  • SHA256

    8f76628c5258074c8a43a644bab240c1b6b5d73851831580b328e4f5bec90687

  • SHA512

    2a6951e6601d515c1d84f3d5d81d27866b3df1999f65b341ca1021521a8584182dabfbac342cc68ef159a6e41c42459d5f3d479ed5653f465d51cf7a8391f33d

  • SSDEEP

    49152:54lDV2ACQ8GSpLt9ndqqgtqgtaKOWOHxomZjmQ8Z3:6lDV2ACJpvndPEqghOW0NjmJZ

Score
8/10
adwarediscoveryevasionpersistencestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
    persistence
  • Sets file execution options in registry 2 TTPs 4 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 51 IoCs
  • Loads dropped DLL 47 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Checks system information in the registry 2 TTPs 30 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 5 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 57 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 29 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 27 IoCs
  • Suspicious use of UnmapMainImage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\بهجت صابر - من ميدان الكسميات ..mp4"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Program Files (x86)\Windows Media Player\setup_wm.exe
      "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\بهجت صابر - من ميدان الكسميات ..mp4"
      2⤵
        PID:2364
      • C:\Windows\SysWOW64\unregmp2.exe
        "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3576
        • C:\Windows\system32\unregmp2.exe
          "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
          3⤵
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          PID:2268
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3508
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffc639eab58,0x7ffc639eab68,0x7ffc639eab78
        2⤵
          PID:496
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:2
          2⤵
            PID:500
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:8
            2⤵
              PID:1888
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2112 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:8
              2⤵
                PID:1668
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:1
                2⤵
                  PID:3044
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:1
                  2⤵
                    PID:3908
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4324 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:1
                    2⤵
                      PID:1236
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4488 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:8
                      2⤵
                        PID:4536
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4608 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:8
                        2⤵
                          PID:3588
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:8
                          2⤵
                            PID:1256
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4920 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:8
                            2⤵
                              PID:5064
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
                              2⤵
                                PID:3816
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff74ba4ae48,0x7ff74ba4ae58,0x7ff74ba4ae68
                                  3⤵
                                    PID:1720
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4296 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:8
                                  2⤵
                                    PID:4560
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4488 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:1
                                    2⤵
                                      PID:468
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4944 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:1
                                      2⤵
                                        PID:1052
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2992 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:8
                                        2⤵
                                          PID:4528
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4960 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:8
                                          2⤵
                                            PID:2172
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5124 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:8
                                            2⤵
                                              PID:3884
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:8
                                              2⤵
                                                PID:4632
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4508 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:8
                                                2⤵
                                                  PID:4164
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5240 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:8
                                                  2⤵
                                                    PID:1312
                                                  • C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                                    "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Drops file in Program Files directory
                                                    • Modifies Internet Explorer settings
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4992
                                                    • C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
                                                      MicrosoftEdgeWebview2Setup.exe /silent /install
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      PID:4512
                                                      • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\MicrosoftEdgeUpdate.exe
                                                        "C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                                                        4⤵
                                                        • Sets file execution options in registry
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks system information in the registry
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:3820
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:4628
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Modifies registry class
                                                          PID:504
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Registers COM server for autorun
                                                            • Modifies registry class
                                                            PID:4104
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Registers COM server for autorun
                                                            • Modifies registry class
                                                            PID:4568
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Registers COM server for autorun
                                                            • Modifies registry class
                                                            PID:4276
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODNCNDQzM0MtMjU5OS00ODk5LTgwNzktRDhFOTEzMjJERjcwfSIgdXNlcmlkPSJ7QUFGNTE0NjktRTZDRC00ODVFLTg0NUYtNzY2ODc4NUQ0RUVGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCRUQwNDBFNC0wMjQ3LTRGODgtQTBDNS04RjE3MTBDQUUzNDJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4NS4yOSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5NDYxNjkwNzMiIGluc3RhbGxfdGltZV9tcz0iNTM1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Checks system information in the registry
                                                          PID:4268
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{83B4433C-2599-4899-8079-D8E91322DF70}" /silent
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:2152
                                                    • C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\RobloxPlayerBeta.exe
                                                      "C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\RobloxPlayerBeta.exe" -app -isInstallerLaunch
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of NtCreateThreadExHideFromDebugger
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of UnmapMainImage
                                                      PID:1832
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:2
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3364
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2828 --field-trial-handle=1936,i,17634563534666000519,1831721637966515353,131072 /prefetch:8
                                                    2⤵
                                                      PID:2276
                                                  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                    1⤵
                                                      PID:3136
                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Checks system information in the registry
                                                      • Modifies data under HKEY_USERS
                                                      PID:1576
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODNCNDQzM0MtMjU5OS00ODk5LTgwNzktRDhFOTEzMjJERjcwfSIgdXNlcmlkPSJ7QUFGNTE0NjktRTZDRC00ODVFLTg0NUYtNzY2ODc4NUQ0RUVGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxMkE3NEYwRS1GQjA0LTQ3OTItODg3Ny0xOTk0MTA1NzA3MzB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5NTA4NDkyMDIiLz48L2FwcD48L3JlcXVlc3Q-
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks system information in the registry
                                                        PID:4404
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CC8FEA17-0786-4E91-B94D-1DFC38CCDFDE}\MicrosoftEdge_X64_124.0.2478.67.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CC8FEA17-0786-4E91-B94D-1DFC38CCDFDE}\MicrosoftEdge_X64_124.0.2478.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2844
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CC8FEA17-0786-4E91-B94D-1DFC38CCDFDE}\EDGEMITMP_0AA53.tmp\setup.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CC8FEA17-0786-4E91-B94D-1DFC38CCDFDE}\EDGEMITMP_0AA53.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CC8FEA17-0786-4E91-B94D-1DFC38CCDFDE}\MicrosoftEdge_X64_124.0.2478.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          PID:1124
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CC8FEA17-0786-4E91-B94D-1DFC38CCDFDE}\EDGEMITMP_0AA53.tmp\setup.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CC8FEA17-0786-4E91-B94D-1DFC38CCDFDE}\EDGEMITMP_0AA53.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.91 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CC8FEA17-0786-4E91-B94D-1DFC38CCDFDE}\EDGEMITMP_0AA53.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.67 --initial-client-data=0x230,0x234,0x238,0x208,0x23c,0x7ff755d488c0,0x7ff755d488cc,0x7ff755d488d8
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:4568
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODNCNDQzM0MtMjU5OS00ODk5LTgwNzktRDhFOTEzMjJERjcwfSIgdXNlcmlkPSJ7QUFGNTE0NjktRTZDRC00ODVFLTg0NUYtNzY2ODc4NUQ0RUVGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0MTk0N0ZBRS02MUZDLTREQjYtODE3QS1EM0YxN0ZFMTQyNzZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI0LjAuMjQ3OC42NyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDk1OTQ2OTAwMyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5NTk1MTkwNzkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTE1NTc5MDM0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8xMzFiZDVkNy05YzY1LTQ3NmEtOTA3NS1lMjQ5NGY4ZGE5ZTQ_UDE9MTcxNTI4MTYyMSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1HVEklMmZXb29SMFIlMmZEVHFoOEhmQXpUMkpFQXBteGdyUFlKN2VZMTBCaCUyYkxoN1dOdzJwNUlWYURTOVM4b1BYNmxzS0M0dVFleWNDY0VyVlVJYWRHTVYlMmZnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyNzIzNzY4IiB0b3RhbD0iMTcyNzIzNzY4IiBkb3dubG9hZF90aW1lX21zPSI0OTE3OCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1MTU3Nzg5NTkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTI5ODg5MTMwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1OTY0MTA4OTg2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzQ1IiBkb3dubG9hZF90aW1lX21zPSI1NTYxMCIgZG93bmxvYWRlZD0iMTcyNzIzNzY4IiB0b3RhbD0iMTcyNzIzNzY4IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0MzQxOSIvPjwvYXBwPjwvcmVxdWVzdD4
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks system information in the registry
                                                        PID:5068
                                                    • C:\Windows\system32\taskmgr.exe
                                                      "C:\Windows\system32\taskmgr.exe" /4
                                                      1⤵
                                                      • Checks SCSI registry key(s)
                                                      • Checks processor information in registry
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      PID:2324
                                                    • C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\RobloxPlayerBeta.exe
                                                      "C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\RobloxPlayerBeta.exe"
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of NtCreateThreadExHideFromDebugger
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious use of UnmapMainImage
                                                      PID:3092
                                                    • C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
                                                      "C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"
                                                      1⤵
                                                      • Checks processor information in registry
                                                      • Enumerates system info in registry
                                                      • Suspicious behavior: AddClipboardFormatListener
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4504
                                                    • C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\RobloxPlayerBeta.exe
                                                      "C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\RobloxPlayerBeta.exe"
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of NtCreateThreadExHideFromDebugger
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious use of UnmapMainImage
                                                      PID:6044
                                                    • C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\RobloxPlayerBeta.exe
                                                      "C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\RobloxPlayerBeta.exe"
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of NtCreateThreadExHideFromDebugger
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious use of UnmapMainImage
                                                      PID:5344
                                                    • C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\RobloxPlayerBeta.exe
                                                      "C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\RobloxPlayerBeta.exe"
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of NtCreateThreadExHideFromDebugger
                                                      • Suspicious use of UnmapMainImage
                                                      PID:5752
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                      • Modifies Internet Explorer settings
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:6124
                                                    • C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\RobloxPlayerBeta.exe
                                                      "C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\RobloxPlayerBeta.exe"
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of UnmapMainImage
                                                      PID:2768
                                                    • C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\RobloxPlayerBeta.exe
                                                      "C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\RobloxPlayerBeta.exe"
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:5720
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                      • Modifies Internet Explorer settings
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4696
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                      • Modifies Internet Explorer settings
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:5512
                                                    • C:\Windows\SysWOW64\DllHost.exe
                                                      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                      1⤵
                                                        PID:4172
                                                      • C:\Windows\system32\mmc.exe
                                                        "C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc
                                                        1⤵
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:4248
                                                      • C:\Windows\system32\dwm.exe
                                                        "dwm.exe"
                                                        1⤵
                                                        • Checks SCSI registry key(s)
                                                        • Enumerates system info in registry
                                                        • Modifies data under HKEY_USERS
                                                        PID:5100
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks system information in the registry
                                                        PID:4376
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks system information in the registry
                                                        • Modifies data under HKEY_USERS
                                                        PID:2164
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6F08DE51-D100-4EE2-A639-547A781ADA74}\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6F08DE51-D100-4EE2-A639-547A781ADA74}\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe" /update /sessionid "{97BB99BD-96C8-45B8-B957-0FC1EE30641C}"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:6088
                                                          • C:\Program Files (x86)\Microsoft\Temp\EU64E6.tmp\MicrosoftEdgeUpdate.exe
                                                            "C:\Program Files (x86)\Microsoft\Temp\EU64E6.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{97BB99BD-96C8-45B8-B957-0FC1EE30641C}"
                                                            3⤵
                                                            • Sets file execution options in registry
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Checks system information in the registry
                                                            PID:4400
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Modifies registry class
                                                              PID:1164
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Modifies registry class
                                                              PID:1372
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                5⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Registers COM server for autorun
                                                                • Modifies registry class
                                                                PID:4344
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                5⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Registers COM server for autorun
                                                                • Modifies registry class
                                                                PID:4148
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                5⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Registers COM server for autorun
                                                                • Modifies registry class
                                                                PID:5536
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTdCQjk5QkQtOTZDOC00NUI4LUI5NTctMEZDMUVFMzA2NDFDfSIgdXNlcmlkPSJ7QUFGNTE0NjktRTZDRC00ODVFLTg0NUYtNzY2ODc4NUQ0RUVGfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7MkU1OUJERjYtMTc4MC00RUEwLUFDM0UtNDE2OEM1RkQ5MTA2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTg1LjI5IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNSIgaW5zdGFsbGRhdGV0aW1lPSIxNzE0MTYwMDc2Ij48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNTEzNDAzNTkyMSIvPjwvYXBwPjwvcmVxdWVzdD4
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Checks system information in the registry
                                                              PID:5600
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTdCQjk5QkQtOTZDOC00NUI4LUI5NTctMEZDMUVFMzA2NDFDfSIgdXNlcmlkPSJ7QUFGNTE0NjktRTZDRC00ODVFLTg0NUYtNzY2ODc4NUQ0RUVGfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins5RTAwNkI1NS1DNkI2LTQ0Q0EtOTE4RS1GN0JDMUYxMjA5QkV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7c0c5REo2TTNmWmtQN0NFTFdHbkR4Qyt3YVJhUUV1RUx2TElmWGsvTUF0Yz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xODUuMjkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iSXNPbkludGVydmFsQ29tbWFuZHNBbGxvd2VkPS10YXJnZXRfZGV2IiBpbnN0YWxsYWdlPSI1Ij48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MDc0ODg1MjYyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgwNzQ4ODUyNjIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE1MTE0MzQ4MjkzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNzJlZDgwODctZWU5OC00MjljLTkzMzAtY2EzYzE5M2Q0MWFmP1AxPTE3MTUyODE5MzMmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZE55SG5iSDJicjN5Vks3MVVCeGYlMmZxUDBtVHZwVjA3S2lXY0hkOW5QNkRtc3hZanBURXNXZiUyYnVnRWpUMWlhcVpRRmdQMVRDUSUyYkNrZ3JPMDRqdDlDSXclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNTExNDM0ODI5MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNzJlZDgwODctZWU5OC00MjljLTkzMzAtY2EzYzE5M2Q0MWFmP1AxPTE3MTUyODE5MzMmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZE55SG5iSDJicjN5Vks3MVVCeGYlMmZxUDBtVHZwVjA3S2lXY0hkOW5QNkRtc3hZanBURXNXZiUyYnVnRWpUMWlhcVpRRmdQMVRDUSUyYkNrZ3JPMDRqdDlDSXclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNjMwNzkyIiB0b3RhbD0iMTYzMDc5MiIgZG93bmxvYWRfdGltZV9tcz0iNjk5NjE4Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE1MTE0MzQ4MjkzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE1MTE5NjYwOTEzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PHBpbmcgcj0iNiIgcmQ9IjYzMjUiIHBpbmdfZnJlc2huZXNzPSJ7QkFDQjRBNTMtODc2NC00NDM1LTk4NzAtMzIwQjI1OTA2QjM5fSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSI1IiBsYXN0X2xhdW5jaF90aW1lPSIxMzM1ODYxMzc5NTE2NzI2NjAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSItMSIgcj0iNiIgYWQ9Ii0xIiByZD0iNjMyNSIgcGluZ19mcmVzaG5lc3M9Ins5OUMzNThFQy00RDMwLTQ1N0QtOTg3MS05MTMzQUY5RTg2QjR9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEyNC4wLjI0NzguNjciIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjMyOCI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSItMSIgcmQ9Ii0xIiBwaW5nX2ZyZXNobmVzcz0ie0QyRDU2QzRGLUE0QTEtNDgxNC1CQjQ4LUQ0Nzk4RjcyNDIwNn0iLz48L2FwcD48L3JlcXVlc3Q-
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Checks system information in the registry
                                                          PID:5544
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        PID:2716
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks system information in the registry
                                                        • Modifies data under HKEY_USERS
                                                        PID:752
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzNGMTc4MzktMkVBQi00RjdELTg4NzUtREM0MzM1Qzc5RDYwfSIgdXNlcmlkPSJ7QUFGNTE0NjktRTZDRC00ODVFLTg0NUYtNzY2ODc4NUQ0RUVGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NkUyQkUzODgtRkU2Ni00QTA4LTlFRUMtQTcxRTdEMzNFMkZEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0R4T2JqSEdhK25SYTJhdEMzd28rSUVwQzc4K1pZZUFVYmtYcERDMmNqN1U9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI2IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MTQxMzU5MzQiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM1ODYzMzY3NjAwMDAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTE0MDY4IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxODEyNDgxNzM5MiIvPjwvYXBwPjwvcmVxdWVzdD4
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Checks system information in the registry
                                                          PID:5312
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCBBBF82-5220-41B6-AC55-FC0203B2FEB1}\BGAUpdate.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCBBBF82-5220-41B6-AC55-FC0203B2FEB1}\BGAUpdate.exe" --edgeupdate-client --system-level
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          PID:2968
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzNGMTc4MzktMkVBQi00RjdELTg4NzUtREM0MzM1Qzc5RDYwfSIgdXNlcmlkPSJ7QUFGNTE0NjktRTZDRC00ODVFLTg0NUYtNzY2ODc4NUQ0RUVGfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsxQkZCMjFFOS1GOTY5LTQwNjAtQjU2My0wNTdEM0MwOTJCMEF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7MUZBQjhDRkUtOTg2MC00MTVDLUE2Q0EtQUE3RDEyMDIxOTQwfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMi4wLjAuMzQiIGxhbmc9IiIgYnJhbmQ9IkVVRkkiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxODEzNTc1NDkwMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE4MTM1NzU0OTAyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE5MTU1OTExMDI4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNWYxOTU2MTItMzg0YS00OGVhLTg0MDgtYjRlZGU5ZGM1NmJiP1AxPTE3MTUyODI5MzkmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9RVNzRFNGODglMmJhSCUyZkxOS09kcjlpS1VLY2RxVURDZmRLVVliV2NlRGhUSUkwNlJ1NTVRa3l5UHF4Q0Rvb0FlckM5R1FWJTJmSm9FbWlXSFQ4clphUld4UkElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE5MTU1OTExMDI4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81ZjE5NTYxMi0zODRhLTQ4ZWEtODQwOC1iNGVkZTlkYzU2YmI_UDE9MTcxNTI4MjkzOSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1FU3NEU0Y4OCUyYmFIJTJmTE5LT2RyOWlLVUtjZHFVRENmZEtVWWJXY2VEaFRJSTA2UnU1NVFreXlQcXhDRG9vQWVyQzlHUVYlMmZKb0VtaVdIVDhyWmFSV3hSQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE4MDQ0NDQ4IiB0b3RhbD0iMTgwNDQ0NDgiIGRvd25sb2FkX3RpbWVfbXM9Ijk3Njg3Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTkxNTU5MTEwMjgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxOTE2MTg0ODUzNCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE5MTYzMjU0NDc2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNjU2IiBkb3dubG9hZF90aW1lX21zPSIxMDIwMTYiIGRvd25sb2FkZWQ9IjE4MDQ0NDQ4IiB0b3RhbD0iMTgwNDQ0NDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjE0MCIvPjwvYXBwPjwvcmVxdWVzdD4
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Checks system information in the registry
                                                          PID:4840
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks system information in the registry
                                                        • Modifies data under HKEY_USERS
                                                        PID:5772
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BE701C77-EA56-4EFE-B108-13442A7B451E}\MicrosoftEdge_X64_124.0.2478.67.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BE701C77-EA56-4EFE-B108-13442A7B451E}\MicrosoftEdge_X64_124.0.2478.67.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:3540
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BE701C77-EA56-4EFE-B108-13442A7B451E}\EDGEMITMP_315DA.tmp\setup.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BE701C77-EA56-4EFE-B108-13442A7B451E}\EDGEMITMP_315DA.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BE701C77-EA56-4EFE-B108-13442A7B451E}\MicrosoftEdge_X64_124.0.2478.67.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                            3⤵
                                                            • Modifies Installed Components in the registry
                                                            • Executes dropped EXE
                                                            • Registers COM server for autorun
                                                            • Installs/modifies Browser Helper Object
                                                            • Drops file in Program Files directory
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • System policy modification
                                                            PID:4872
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BE701C77-EA56-4EFE-B108-13442A7B451E}\EDGEMITMP_315DA.tmp\setup.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BE701C77-EA56-4EFE-B108-13442A7B451E}\EDGEMITMP_315DA.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.91 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BE701C77-EA56-4EFE-B108-13442A7B451E}\EDGEMITMP_315DA.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.67 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff61adf88c0,0x7ff61adf88cc,0x7ff61adf88d8
                                                              4⤵
                                                              • Executes dropped EXE
                                                              PID:3336
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BE701C77-EA56-4EFE-B108-13442A7B451E}\EDGEMITMP_315DA.tmp\setup.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BE701C77-EA56-4EFE-B108-13442A7B451E}\EDGEMITMP_315DA.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Drops file in System32 directory
                                                              PID:1384
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BE701C77-EA56-4EFE-B108-13442A7B451E}\EDGEMITMP_315DA.tmp\setup.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BE701C77-EA56-4EFE-B108-13442A7B451E}\EDGEMITMP_315DA.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.91 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BE701C77-EA56-4EFE-B108-13442A7B451E}\EDGEMITMP_315DA.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.67 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff61adf88c0,0x7ff61adf88cc,0x7ff61adf88d8
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:4936
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.67\Installer\setup.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.67\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                                                              4⤵
                                                              • Executes dropped EXE
                                                              PID:4812
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.67\Installer\setup.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.67\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.91 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.67 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff6ff2088c0,0x7ff6ff2088cc,0x7ff6ff2088d8
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:1944
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2E649434-4F51-4E99-B861-2076239814F5}\MicrosoftEdge_X64_124.0.2478.80_124.0.2478.67.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2E649434-4F51-4E99-B861-2076239814F5}\MicrosoftEdge_X64_124.0.2478.80_124.0.2478.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:2072
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2E649434-4F51-4E99-B861-2076239814F5}\EDGEMITMP_D78A0.tmp\setup.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2E649434-4F51-4E99-B861-2076239814F5}\EDGEMITMP_D78A0.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2E649434-4F51-4E99-B861-2076239814F5}\MicrosoftEdge_X64_124.0.2478.80_124.0.2478.67.exe" --previous-version="124.0.2478.67" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            PID:5580
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2E649434-4F51-4E99-B861-2076239814F5}\EDGEMITMP_D78A0.tmp\setup.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2E649434-4F51-4E99-B861-2076239814F5}\EDGEMITMP_D78A0.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2E649434-4F51-4E99-B861-2076239814F5}\EDGEMITMP_D78A0.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7b22488c0,0x7ff7b22488cc,0x7ff7b22488d8
                                                              4⤵
                                                              • Executes dropped EXE
                                                              PID:184
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDI3QjNBNzEtOUNCRC00MjNDLUE2MDktQTRDOEE4MjNDN0JBfSIgdXNlcmlkPSJ7QUFGNTE0NjktRTZDRC00ODVFLTg0NUYtNzY2ODc4NUQ0RUVGfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntFQTNFNTAwQi02NUVDLTQ0QzAtQjg0Ni0zRkY1MjRBOUZCRDB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4NS4yOSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJJc09uSW50ZXJ2YWxDb21tYW5kc0FsbG93ZWQ9LXRhcmdldF9kZXY7UHJvZHVjdHNUb1JlZ2lzdGVyPSU3QjFGQUI4Q0ZFLTk4NjAtNDE1Qy1BNkNBLUFBN0QxMjAyMTk0MCU3RCIgaW5zdGFsbGFnZT0iNSIgY29ob3J0PSJycmZAMC41NSI-PHVwZGF0ZWNoZWNrLz48cGluZyByZD0iNjMzMSIgcGluZ19mcmVzaG5lc3M9InsyRTcxRTFEOC1EODgzLTQzQ0MtQkI5Mi04RTNFNTAwMEZDQTJ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iMTI0LjAuMjQ3OC42NyIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSI1IiBpc19waW5uZWRfc3lzdGVtPSJ0cnVlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNTg2MTM3OTUxNjcyNjYwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxOTE4NzYyOTg4MCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxOTE4NzYyOTg4MCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxOTIxMzg3OTk1MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxOTIyNjUzNjU5MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTk2MjkxOTMwMDIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI3ODEiIGRvd25sb2FkZWQ9IjE3MjcyMzc2OCIgdG90YWw9IjE3MjcyMzc2OCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjIiIGluc3RhbGxfdGltZV9tcz0iNDAyNjUiLz48cGluZyBhY3RpdmU9IjAiIHJkPSI2MzMxIiBwaW5nX2ZyZXNobmVzcz0ie0QzREFDQTBDLTcxQjQtNDg1Qi1BQ0JDLTQ4RkNBNTZDRkM0OX0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTI0LjAuMjQ3OC42NyIgbmV4dHZlcnNpb249IjEyNC4wLjI0NzguODAiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjMyOCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTkxODc2Mjk4ODAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTk2MjkzNDg0NzciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE5NzAzNTY3MzUzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNTkxMGVhODgtZTcxMC00ZmUyLTgxYjktYzNlN2NkOGYxMWNjP1AxPTE3MTUyODMwNDQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9TTB5Y210MHFtSlBJbEZ1dW0lMmZRVnEwbHBIWjRpT0dyYTNkSHUlMmJMMXJvMlRyMlBPOFNjN3lXQjRtN2pJZGw3b1JyM0VMZEVRSDhrM0Nvc3lRVkJuSVNBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjE2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE5NzAzNTY3MzUzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81OTEwZWE4OC1lNzEwLTRmZTItODFiOS1jM2U3Y2Q4ZjExY2M_UDE9MTcxNTI4MzA0NCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1NMHljbXQwcW1KUElsRnV1bSUyZlFWcTBscEhaNGlPR3JhM2RIdSUyYkwxcm8yVHIyUE84U2M3eVdCNG03aklkbDdvUnIzRUxkRVFIOGszQ29zeVFWQm5JU0ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxMjY2MjIzMiIgdG90YWw9IjEyNjYyMjMyIiBkb3dubG9hZF90aW1lX21zPSI3MTcyIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE5NzAzNzIzNjEyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE5NzA5MzQ4MzE5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyMDE1NjA2Nzc0NCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijc4MSIgZG93bmxvYWRfdGltZV9tcz0iNzM3NSIgZG93bmxvYWRlZD0iMTI2NjIyMzIiIHRvdGFsPSIxMjY2MjIzMiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDQ2NTYiLz48cGluZyByZD0iNjMzMSIgcGluZ19mcmVzaG5lc3M9Ins4NDkyMzcyRi1EOThDLTQzREUtODhCQS00Njc1REM1QzZGRjV9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Checks system information in the registry
                                                          PID:3820
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
                                                        1⤵
                                                          PID:3956
                                                        • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
                                                          "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
                                                          1⤵
                                                            PID:5936
                                                          • C:\Windows\system32\wwahost.exe
                                                            "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1372

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.67\Installer\setup.exe
                                                            Filesize

                                                            6.8MB

                                                            MD5

                                                            c31297188ec9fbaa60449f769339963e

                                                            SHA1

                                                            8502d9e0cef18137529f0a46ad6e69a1577e6cae

                                                            SHA256

                                                            2e2eff110475dd3dfd732ab514e4692032e67b2d228d0081634a87f45cde5ff9

                                                            SHA512

                                                            9525e3e08b953fe36270c7b4868959e9bded055c5577e5ca94d79606b671e6660d180f763b54a276bf356e82d7073901c373e0b40cfca924cc4b38384c20e22a

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.80\Installer\setup.exe
                                                            Filesize

                                                            6.8MB

                                                            MD5

                                                            1cd79627301bfdeb1d3fba51cad868a6

                                                            SHA1

                                                            2b71bae909047dd0374425e9df941ef93fb696dc

                                                            SHA256

                                                            74ab283991de81543bff5786ad8bebd41c243bc00beda305da00c55a60ac2093

                                                            SHA512

                                                            839860435573bddfcbb950e2986333dd43ab5df5b2a0032fb18cd25c736e94d998b5ea1fc1e1b0c1d02a28b9615653becc4b535434bfd8a7a02f5995acf1808f

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{1FAB8CFE-9860-415C-A6CA-AA7D12021940}\2.0.0.34\BGAUpdate.exe
                                                            Filesize

                                                            17.2MB

                                                            MD5

                                                            3f208f4e0dacb8661d7659d2a030f36e

                                                            SHA1

                                                            07fe69fd12637b63f6ae44e60fdf80e5e3e933ff

                                                            SHA256

                                                            d3c12e642d4b032e2592c2ba6e0ed703a7e43fb424b7c3ab5b2e51b53d1d433b

                                                            SHA512

                                                            6c8fce43d04dd7e7f5c8bf275ba01e24a76531e89cc02f4b2f23ab2086f7cf70f485c4240c5ea41bf61cb7ceee471df7e7bdc1b17dfdd54c22e4b02ff4e14740

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\124.0.2478.80\MicrosoftEdge_X64_124.0.2478.80_124.0.2478.67.exe
                                                            Filesize

                                                            12.1MB

                                                            MD5

                                                            3e7a0dc97fa6ae7de222a07a8426959e

                                                            SHA1

                                                            a105c6e0af14d061b83a8ed2be3dc50f233e5fcf

                                                            SHA256

                                                            6ee6650e7b24c266943c9cd47a58db4b3a330e31072b9a15033a1701de2d502b

                                                            SHA512

                                                            5a98136f14abe22775649c81f72da2e1fb48def34df532ae0f101a371ecf5256e512e30b747cf66a2515b22f0a5d71c2a7b78e7ffd553c3726462b4fd8dfecf8

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.29\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe
                                                            Filesize

                                                            1.6MB

                                                            MD5

                                                            b18c705b3c68cc49d9bf3649abc75c24

                                                            SHA1

                                                            6dc8963dea0f3185368790dee2a346301b4fa24c

                                                            SHA256

                                                            c2ca3135f3cafd79bf90d4cb3118943ca17f40e0d651d1fc32b1b3d22d1412aa

                                                            SHA512

                                                            7ac302c1e85c652bd897ce1af812950cd23a53c041af82fdcecb2314bbd1667bf2fc672dea40c21858e64befc9bf60190a4428f0b41c30317bb0e5ec7c00f71b

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BE701C77-EA56-4EFE-B108-13442A7B451E}\EDGEMITMP_315DA.tmp\SETUP.EX_
                                                            Filesize

                                                            2.7MB

                                                            MD5

                                                            5070a34dbada1aaa375cc572b5fc7d0c

                                                            SHA1

                                                            e74b7ef714755870976abe3d2b4a7db0b9cc21e5

                                                            SHA256

                                                            03e7a32e1f10fced6a07dfa4e6cfd92510d4bf6929d423798e4fb5ca91fe6c20

                                                            SHA512

                                                            fed3fcbb64a59070b0efd677ca2edc982d28e37cdf7283f2777af8aca7d3760a7eefb8d01b3c2bf4b4ec3708a74c3412f0dede91e31dca1b6f8a4e4edc673aa7

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\EdgeUpdate.dat
                                                            Filesize

                                                            12KB

                                                            MD5

                                                            369bbc37cff290adb8963dc5e518b9b8

                                                            SHA1

                                                            de0ef569f7ef55032e4b18d3a03542cc2bbac191

                                                            SHA256

                                                            3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

                                                            SHA512

                                                            4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\MicrosoftEdgeComRegisterShellARM64.exe
                                                            Filesize

                                                            179KB

                                                            MD5

                                                            7a160c6016922713345454265807f08d

                                                            SHA1

                                                            e36ee184edd449252eb2dfd3016d5b0d2edad3c6

                                                            SHA256

                                                            35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

                                                            SHA512

                                                            c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\MicrosoftEdgeUpdate.exe
                                                            Filesize

                                                            201KB

                                                            MD5

                                                            4dc57ab56e37cd05e81f0d8aaafc5179

                                                            SHA1

                                                            494a90728d7680f979b0ad87f09b5b58f16d1cd5

                                                            SHA256

                                                            87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

                                                            SHA512

                                                            320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                            Filesize

                                                            212KB

                                                            MD5

                                                            60dba9b06b56e58f5aea1a4149c743d2

                                                            SHA1

                                                            a7e456acf64dd99ca30259cf45b88cf2515a69b3

                                                            SHA256

                                                            4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

                                                            SHA512

                                                            e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\MicrosoftEdgeUpdateCore.exe
                                                            Filesize

                                                            257KB

                                                            MD5

                                                            c044dcfa4d518df8fc9d4a161d49cece

                                                            SHA1

                                                            91bd4e933b22c010454fd6d3e3b042ab6e8b2149

                                                            SHA256

                                                            9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

                                                            SHA512

                                                            f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\NOTICE.TXT
                                                            Filesize

                                                            4KB

                                                            MD5

                                                            6dd5bf0743f2366a0bdd37e302783bcd

                                                            SHA1

                                                            e5ff6e044c40c02b1fc78304804fe1f993fed2e6

                                                            SHA256

                                                            91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

                                                            SHA512

                                                            f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdate.dll
                                                            Filesize

                                                            2.0MB

                                                            MD5

                                                            965b3af7886e7bf6584488658c050ca2

                                                            SHA1

                                                            72daabdde7cd500c483d0eeecb1bd19708f8e4a5

                                                            SHA256

                                                            d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

                                                            SHA512

                                                            1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_af.dll
                                                            Filesize

                                                            28KB

                                                            MD5

                                                            567aec2d42d02675eb515bbd852be7db

                                                            SHA1

                                                            66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

                                                            SHA256

                                                            a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

                                                            SHA512

                                                            3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_am.dll
                                                            Filesize

                                                            24KB

                                                            MD5

                                                            f6c1324070b6c4e2a8f8921652bfbdfa

                                                            SHA1

                                                            988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

                                                            SHA256

                                                            986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

                                                            SHA512

                                                            63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_ar.dll
                                                            Filesize

                                                            26KB

                                                            MD5

                                                            570efe7aa117a1f98c7a682f8112cb6d

                                                            SHA1

                                                            536e7c49e24e9aa068a021a8f258e3e4e69fa64f

                                                            SHA256

                                                            e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

                                                            SHA512

                                                            5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_as.dll
                                                            Filesize

                                                            28KB

                                                            MD5

                                                            a8d3210e34bf6f63a35590245c16bc1b

                                                            SHA1

                                                            f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

                                                            SHA256

                                                            3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

                                                            SHA512

                                                            6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_az.dll
                                                            Filesize

                                                            29KB

                                                            MD5

                                                            7937c407ebe21170daf0975779f1aa49

                                                            SHA1

                                                            4c2a40e76209abd2492dfaaf65ef24de72291346

                                                            SHA256

                                                            5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

                                                            SHA512

                                                            8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_bg.dll
                                                            Filesize

                                                            29KB

                                                            MD5

                                                            8375b1b756b2a74a12def575351e6bbd

                                                            SHA1

                                                            802ec096425dc1cab723d4cf2fd1a868315d3727

                                                            SHA256

                                                            a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

                                                            SHA512

                                                            aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_bn-IN.dll
                                                            Filesize

                                                            29KB

                                                            MD5

                                                            a94cf5e8b1708a43393263a33e739edd

                                                            SHA1

                                                            1068868bdc271a52aaae6f749028ed3170b09cce

                                                            SHA256

                                                            5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

                                                            SHA512

                                                            920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_bn.dll
                                                            Filesize

                                                            29KB

                                                            MD5

                                                            7dc58c4e27eaf84ae9984cff2cc16235

                                                            SHA1

                                                            3f53499ddc487658932a8c2bcf562ba32afd3bda

                                                            SHA256

                                                            e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

                                                            SHA512

                                                            bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_bs.dll
                                                            Filesize

                                                            28KB

                                                            MD5

                                                            e338dccaa43962697db9f67e0265a3fc

                                                            SHA1

                                                            4c6c327efc12d21c4299df7b97bf2c45840e0d83

                                                            SHA256

                                                            99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

                                                            SHA512

                                                            e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
                                                            Filesize

                                                            29KB

                                                            MD5

                                                            2929e8d496d95739f207b9f59b13f925

                                                            SHA1

                                                            7c1c574194d9e31ca91e2a21a5c671e5e95c734c

                                                            SHA256

                                                            2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

                                                            SHA512

                                                            ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_ca.dll
                                                            Filesize

                                                            30KB

                                                            MD5

                                                            39551d8d284c108a17dc5f74a7084bb5

                                                            SHA1

                                                            6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

                                                            SHA256

                                                            8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

                                                            SHA512

                                                            6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_cs.dll
                                                            Filesize

                                                            28KB

                                                            MD5

                                                            16c84ad1222284f40968a851f541d6bb

                                                            SHA1

                                                            bc26d50e15ccaed6a5fbe801943117269b3b8e6b

                                                            SHA256

                                                            e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

                                                            SHA512

                                                            d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_cy.dll
                                                            Filesize

                                                            28KB

                                                            MD5

                                                            34d991980016595b803d212dc356d765

                                                            SHA1

                                                            e3a35df6488c3463c2a7adf89029e1dd8308f816

                                                            SHA256

                                                            252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

                                                            SHA512

                                                            8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_da.dll
                                                            Filesize

                                                            28KB

                                                            MD5

                                                            d34380d302b16eab40d5b63cfb4ed0fe

                                                            SHA1

                                                            1d3047119e353a55dc215666f2b7b69f0ede775b

                                                            SHA256

                                                            fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

                                                            SHA512

                                                            45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_de.dll
                                                            Filesize

                                                            30KB

                                                            MD5

                                                            aab01f0d7bdc51b190f27ce58701c1da

                                                            SHA1

                                                            1a21aabab0875651efd974100a81cda52c462997

                                                            SHA256

                                                            061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

                                                            SHA512

                                                            5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_el.dll
                                                            Filesize

                                                            30KB

                                                            MD5

                                                            ac275b6e825c3bd87d96b52eac36c0f6

                                                            SHA1

                                                            29e537d81f5d997285b62cd2efea088c3284d18f

                                                            SHA256

                                                            223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

                                                            SHA512

                                                            bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_en-GB.dll
                                                            Filesize

                                                            27KB

                                                            MD5

                                                            d749e093f263244d276b6ffcf4ef4b42

                                                            SHA1

                                                            69f024c769632cdbb019943552bac5281d4cbe05

                                                            SHA256

                                                            fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e

                                                            SHA512

                                                            48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_en.dll
                                                            Filesize

                                                            27KB

                                                            MD5

                                                            4a1e3cf488e998ef4d22ac25ccc520a5

                                                            SHA1

                                                            dc568a6e3c9465474ef0d761581c733b3371b1cd

                                                            SHA256

                                                            9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

                                                            SHA512

                                                            ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_es-419.dll
                                                            Filesize

                                                            29KB

                                                            MD5

                                                            28fefc59008ef0325682a0611f8dba70

                                                            SHA1

                                                            f528803c731c11d8d92c5660cb4125c26bb75265

                                                            SHA256

                                                            55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d

                                                            SHA512

                                                            2ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_es.dll
                                                            Filesize

                                                            28KB

                                                            MD5

                                                            9db7f66f9dc417ebba021bc45af5d34b

                                                            SHA1

                                                            6815318b05019f521d65f6046cf340ad88e40971

                                                            SHA256

                                                            e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819

                                                            SHA512

                                                            943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_et.dll
                                                            Filesize

                                                            28KB

                                                            MD5

                                                            b78cba3088ecdc571412955742ea560b

                                                            SHA1

                                                            bc04cf9014cec5b9f240235b5ff0f29dbdb22926

                                                            SHA256

                                                            f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085

                                                            SHA512

                                                            04c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_eu.dll
                                                            Filesize

                                                            28KB

                                                            MD5

                                                            a7e1f4f482522a647311735699bec186

                                                            SHA1

                                                            3b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd

                                                            SHA256

                                                            e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4

                                                            SHA512

                                                            22131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_fa.dll
                                                            Filesize

                                                            27KB

                                                            MD5

                                                            cbe3454843ce2f36201460e316af1404

                                                            SHA1

                                                            0883394c28cb60be8276cb690496318fcabea424

                                                            SHA256

                                                            c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59

                                                            SHA512

                                                            f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_fi.dll
                                                            Filesize

                                                            28KB

                                                            MD5

                                                            d45f2d476ed78fa3e30f16e11c1c61ea

                                                            SHA1

                                                            8c8c5d5f77cd8764c4ca0c389daee89e658dfd5e

                                                            SHA256

                                                            acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2

                                                            SHA512

                                                            2a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_fil.dll
                                                            Filesize

                                                            29KB

                                                            MD5

                                                            7c66526dc65de144f3444556c3dba7b8

                                                            SHA1

                                                            6721a1f45ac779e82eecc9a584bcf4bcee365940

                                                            SHA256

                                                            e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d

                                                            SHA512

                                                            dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_fr-CA.dll
                                                            Filesize

                                                            30KB

                                                            MD5

                                                            b534e068001e8729faf212ad3c0da16c

                                                            SHA1

                                                            999fa33c5ea856d305cc359c18ea8e994a83f7a9

                                                            SHA256

                                                            445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511

                                                            SHA512

                                                            e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_fr.dll
                                                            Filesize

                                                            30KB

                                                            MD5

                                                            64c47a66830992f0bdfd05036a290498

                                                            SHA1

                                                            88b1b8faa511ee9f4a0e944a0289db48a8680640

                                                            SHA256

                                                            a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961

                                                            SHA512

                                                            426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_ga.dll
                                                            Filesize

                                                            28KB

                                                            MD5

                                                            3b8a5301c4cf21b439953c97bd3c441c

                                                            SHA1

                                                            8a7b48bb3d75279de5f5eb88b5a83437c9a2014a

                                                            SHA256

                                                            abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0

                                                            SHA512

                                                            068166cfdf879caf4e54fe43c5265a692fcaf6a9dcbf151335fd054bbec06260bc5ed489de6d46ca3fc0044bc61fa1468fea85373c6c66349620618ee869383a

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_gd.dll
                                                            Filesize

                                                            30KB

                                                            MD5

                                                            c90f33303c5bd706776e90c12aefabee

                                                            SHA1

                                                            1965550fe34b68ea37a24c8708eef1a0d561fb11

                                                            SHA256

                                                            e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c

                                                            SHA512

                                                            b0c1a9d7df57d68e5daf527703f0b6154a2ef72af1a3933bda2804408f6684b5b09b822522193243fd0756f80f13d3ab0647c90d2bed1a57b4a9fea933b0aa9a

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_gl.dll
                                                            Filesize

                                                            28KB

                                                            MD5

                                                            84a1cea9a31be831155aa1e12518e446

                                                            SHA1

                                                            670f4edd4dc8df97af8925f56241375757afb3da

                                                            SHA256

                                                            e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57

                                                            SHA512

                                                            5f1318119102fcee1c828565737ce914493ff86e2a18a94f5ff2b6b394d584ace75c37258d589cce1d5afd8e37d617168a7d7372cfd68dd6a2afcd4577a0bc51

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_gu.dll
                                                            Filesize

                                                            28KB

                                                            MD5

                                                            f9646357cf6ce93d7ba9cfb3fa362928

                                                            SHA1

                                                            a072cc350ea8ea6d8a01af335691057132b04025

                                                            SHA256

                                                            838ccd8243caa1a5d9e72eb1179ac8ae59d2acb453ed86be01e0722a8e917150

                                                            SHA512

                                                            654c4a5200f20411c56c59dbb30a63bfe2da27781c081e2049b31f0371a31d679e3c9378c7eb9cf0fb9166a3f0fba33a58c3268193119b06f91bebe164a82528

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_hi.dll
                                                            Filesize

                                                            28KB

                                                            MD5

                                                            34cbaeb5ec7984362a3dabe5c14a08ec

                                                            SHA1

                                                            d88ec7ac1997b7355e81226444ec4740b69670d7

                                                            SHA256

                                                            024c5eae16e45abe2237c2a5d868563550ac596f1f7d777e25234c17d9461dd9

                                                            SHA512

                                                            008c8443a3e93c4643a9e8735a1c59c24ba2f7a789606a86da54c921c34cbc0cb11c88594544d8509a8e71b6a287c043b1ffe2d39b90af53b4cde3847d891ba8

                                                            Download Submit

                                                          • C:\Program Files (x86)\Microsoft\Temp\EUDA04.tmp\msedgeupdateres_hr.dll
                                                            Filesize

                                                            29KB

                                                            MD5

                                                            0b475965c311203bf3a592be2f5d5e00

                                                            SHA1

                                                            b5ff1957c0903a93737666dee0920b1043ddaf70

                                                            SHA256

                                                            65915ad11b9457d145795a1e8d151f898ec2dcb8b136967e6592884699867eb0

                                                            SHA512

                                                            bec513125f272c24477b9ddbaa5706d1e1bb958babac46829b28df99fa1dd82f3f1e3c7066dc2fe3e59118c536675a22fc2128de916ca4c478950b9992372007

                                                            Download Submit

                                                          • C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
                                                            Filesize

                                                            5.3MB

                                                            MD5

                                                            e284a7bdf53b953d5514c6abe985ed60

                                                            SHA1

                                                            91655419b0e29b53bebbd102127056f396af6bb0

                                                            SHA256

                                                            de29073ba5d2f701473a80f14c9dc35b2a11194918b8f682357b09d57c2aeb2e

                                                            SHA512

                                                            2066d8dd92d2c64df6eae441fc25914a6214ff52ad264a38c156f59fd1587d6a7627f19a1b537fd82d95b7c66acaf73169b855df55fce0163bd3b05333377195

                                                            Download Submit

                                                          • C:\Program Files (x86)\Roblox\Versions\version-7d64f40489634ca5\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
                                                            Filesize

                                                            1.5MB

                                                            MD5

                                                            610b1b60dc8729bad759c92f82ee2804

                                                            SHA1

                                                            9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

                                                            SHA256

                                                            921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

                                                            SHA512

                                                            0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

                                                            Download Submit

                                                          • C:\Program Files\MsEdgeCrashpad\settings.dat
                                                            Filesize

                                                            280B

                                                            MD5

                                                            04bbab4fd362499972a8588c99a2daca

                                                            SHA1

                                                            4643b7598452ce932ce6af9876f6a85376f8e685

                                                            SHA256

                                                            66a67391ff145372e6b0b6fc881d8b73f726667a035e88a5109a0981f6920643

                                                            SHA512

                                                            c31640c66482fa7ddc91dd4de41d7586a11fd0d0a4c0e1b369c2c64ebcaaf737daa369df2def17691d119f486c7284a81b285b45cff9e16191c9a2fd1544faf8

                                                            Download Submit

                                                          • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                                            Filesize

                                                            106KB

                                                            MD5

                                                            0f6244dbc48e4e0ef1257f0c62ee0023

                                                            SHA1

                                                            05dd7520ea13f1fa2df8425670741d242b69b0cb

                                                            SHA256

                                                            cec4daeecdecfa1e338cb3d35b2f7ef50633ad863a0410978dc40da562258d50

                                                            SHA512

                                                            84ad78a80c24944b6b6b3e2aabe330a8ab777145a3e38231122d0d1a84d26c98e03584b417d47cff445e9a18c02713d9add16b3045a88e71bef2d4a99b26d24f

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            7033a3204958a9ffd14d255e0d6a9370

                                                            SHA1

                                                            e7e65014a281f95b71aae41e6f441ed95c85e533

                                                            SHA256

                                                            d223e35450e3969a9a85d63c4e92456fc9f1f7fa5cd7242d70ebcba80983c950

                                                            SHA512

                                                            c533b3acf863084920959247b68accfc9281e8fbafc2cefe2b73a4969ec220b69604fff6191d9edf719e641cfa64056d10155a3d545320c731b5279c16869d3e

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                            Filesize

                                                            3KB

                                                            MD5

                                                            6816ff64294c4e14d5adde33f4a4babd

                                                            SHA1

                                                            632754a983d4986186044783de63ba2c705d6f60

                                                            SHA256

                                                            f8137ddf67f4e3b0939c232ed85a6248e95873c3bd9e99b35d7d94fb2aea2f71

                                                            SHA512

                                                            bea656ba543de9b82c624e2d1a93a3427f44ac5c56ada6e08133f69bf74d745fc74ef0b9f0161743184e8bc49eca1947380a71d4141e58eced3b67102fad51b3

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                            Filesize

                                                            3KB

                                                            MD5

                                                            b2d05fc89040b91c0a6653d8117e9b0d

                                                            SHA1

                                                            4f39b01f3b8295833bd0e23d26defbb99e96e2c9

                                                            SHA256

                                                            f4781b2ce70d22722b9b37866d3dcc20c9fa14b5fee460328b273b3c896b58b6

                                                            SHA512

                                                            558f56c7adbfad7a4eae396cf7dbe1b570334a92d1bc39e6b61eb9ecf562975cb86278fa75c54dbc1d54bc69d0f59216f133bab50bf341b5fa84ff2a54332f69

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                            Filesize

                                                            3KB

                                                            MD5

                                                            22e6ab7b751323ab2b09cf9b62fdc228

                                                            SHA1

                                                            2bf9f45093b39ab0d99b2b626dde7c8a6a019b92

                                                            SHA256

                                                            6d27dc5ecafe090a619fe1f3c31d0c8926d84078bd804c4ff7b8a02c314cdb77

                                                            SHA512

                                                            ae6d0d9a84ea265ad94905bdb27cf6ccef4f6c94151afa44c1b805bd99a1fd9b66f27b8fe76ccf12b48327e7fe362f418378622b5226bcd8b6b65a05a24bd492

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                            Filesize

                                                            3KB

                                                            MD5

                                                            648cf86f40d459de018f85ba1b9e11f6

                                                            SHA1

                                                            a6d429f89a81e506375dc75718f09f740262fd2e

                                                            SHA256

                                                            4219ee4f56c43dcbc70545813aedfb4c77e9cee65591805fbb6524c27da14f24

                                                            SHA512

                                                            bae8a6fef2185884d48646419ebbb0e9a067a332b739af42ba196ee8da1470b79d015b9f3d12a002ec2a6887c58e9f8fbf04483812cf7ddf9e623f643458cd95

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                            Filesize

                                                            3KB

                                                            MD5

                                                            a7ddc0357a6801b55a5360e302c1d4d3

                                                            SHA1

                                                            78b04473d3a6df8401c5b43a75efcae825d841ab

                                                            SHA256

                                                            7c720c60ad5405bd045bb9744fefb8b3fb8a953fcfffcb2926c79ed63bfc85ed

                                                            SHA512

                                                            04376e650d82975f21aa80364395bd4b79f354d97eb9bfc7c5a8e34a4c4f8fa901b513841abbff4c67cb2235483f8032fb7e9fe90e8a5218fa74b8f27fe252ab

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                            Filesize

                                                            2B

                                                            MD5

                                                            d751713988987e9331980363e24189ce

                                                            SHA1

                                                            97d170e1550eee4afc0af065b78cda302a97674c

                                                            SHA256

                                                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                            SHA512

                                                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            2921336ddeadfb830c2d20e78a34b2a4

                                                            SHA1

                                                            6f8f1d0f04a4726b346e97063a5d356cc212c727

                                                            SHA256

                                                            ae12c2ad6c90f8539f818666e8b77445ee801c815e98c16099667b3ca0022589

                                                            SHA512

                                                            5af8aa867dfaef72ba1bcf42885af46f0db128523311b255f90b0c94ecc9405c4b0402614aec39552101f226f19b5602785b4fdccf6c1b56ab7e3c761d48ad0a

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            18df18be666f71f70b22db24944e2442

                                                            SHA1

                                                            4c25271e1568fea209f0ea234c212ac3132a4b6d

                                                            SHA256

                                                            1cd2438c094cbbf8b16b2f63a3c99cf9398ea96fb2e2827f6fc77f7cc0606f71

                                                            SHA512

                                                            50aad96ab20f9bb4b8a28eee99da8e49d902941142540495d9f8a6481616aa25787098738da99e0b123c1f38b38636b539fe8fe7fe4e226ccdb4b9970bd26ce0

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            b145cbf4f4a8f2d543624f3e5e41e407

                                                            SHA1

                                                            98938b8983b1a15ef2c19822ec6c5f59ac3c02f1

                                                            SHA256

                                                            a85294a8af043318e4b88eebe34785ca3997e15378d333ac2bdf6b2738f0e18d

                                                            SHA512

                                                            b5095bf813862ca750e51b413c5c1ffdfc69d053585eb6eda6e976613fc59c1f4783322155b06c34cd4bcf4b03d855862e69a30a8bf7516379ac92d627b0676e

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            a7be720d1fdfd6be19043facbb8618ba

                                                            SHA1

                                                            bf377f6ec5259f4e6ec7187b1598234e3c0c6dff

                                                            SHA256

                                                            2004dfef47a3fc6702bb11cb724299596126f552137d4db2a7a41f19fb5479c1

                                                            SHA512

                                                            7f16f6fabad023ce1d4b19f913f00eabf1ee783c54fab627b1251b5896d246ac41c6de1ce65f6f5c12be6c89d7cd2e7410d902cf6e529588e1676d98880cb026

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                            Filesize

                                                            7KB

                                                            MD5

                                                            3f4ab3fb8de667b1736793b88ed16f00

                                                            SHA1

                                                            57d323fe7719a1d59216cde5df3b90d064bda434

                                                            SHA256

                                                            ccb425757be057c25901700023d364acb1a1782de784193a32452d038784c504

                                                            SHA512

                                                            d1fccd3bb005c3715f4ab2dff9421b6e27a1fbc8c34cb807f4f295af180a0dfdf2f065ee59563d7494dcdde7b633a244caefba585c499b67ffff7adad669bc61

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                            Filesize

                                                            7KB

                                                            MD5

                                                            3417f89bc9b1565529214f5067f7a82c

                                                            SHA1

                                                            665d0423d045d391434414e8c71d300c6fd1a4be

                                                            SHA256

                                                            afb212145f87508b5733c0f404204a10be1139ea2ef2d5c2334b31a427acf2f6

                                                            SHA512

                                                            8bfea7ee88114fe7fea06f5499601f29ad6df170bf9a0f7f50857e8c5d0bc48a405176a05694b1c96ba88ba5a1fcda4dfadcb6c60f23788a31c257949cb05bca

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                            Filesize

                                                            7KB

                                                            MD5

                                                            3967cadd3c24527314b2990e8fc3c584

                                                            SHA1

                                                            91d3e25c6c065f71ed6b8d9498fef9e85d596ec8

                                                            SHA256

                                                            06fb2f0c3f3e9bb06a9e5511cb1c2ca45b509b35dba385dbc987e4e282e978eb

                                                            SHA512

                                                            77d78f4612146d61e11f934f16be629deea543e2c879f7a1055d5613541041acb617ce72d1eeb3e8323eace9843b2e5b5276c0bc550a9206cc6e1b7945173458

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                            Filesize

                                                            16KB

                                                            MD5

                                                            00025822d43f5b3414cf9432a6ad2309

                                                            SHA1

                                                            339ce35619381b33124e8d79d0f8807673f9ec02

                                                            SHA256

                                                            0183b3e1d85c3d3ab530149150ab7a17ac09ab34c7e0a542abd81798f3805c7e

                                                            SHA512

                                                            63aab6eceab6fb72c913200f39845623f7a21affdd399f5f6d1cc0c47c240a29def5c2c2e80b4677c56d15ab607bfd10cb3e5fa7fdfe44f0b3c664b5410da205

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                            Filesize

                                                            255KB

                                                            MD5

                                                            63c983b276e71beb169653b67f57cea2

                                                            SHA1

                                                            673b91fd9036e8053921ca4f8227b1a0e4473896

                                                            SHA256

                                                            6841d5655c12e7c2a9b036a974f461310309db1c18d9883509d62214599a432d

                                                            SHA512

                                                            08040432db8b0b90a5a730db8aeeac819d2b0915f6aac14f7bd65ba9c4048b69435388a596dfd7e2e460144c0a8fdc4919a2034fe32c03772bfd04cb92f01364

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                            Filesize

                                                            101KB

                                                            MD5

                                                            66279ab812bdc360677598f0f9f11fc7

                                                            SHA1

                                                            fcc5bab8dc95e2ce641bfcfd5f97f5eb7e4024fb

                                                            SHA256

                                                            c10c0121d2ffbf653a1e68bf8df12f43285bc5b7af1b29cea39418745fd95896

                                                            SHA512

                                                            e438d10cb8665b1f475d0d5b9415c0fb7caefaf035f921c36d64625a72d8bf6276317db8229537367f4860d96d13118b133a1ead7c4056f8a26465e1f3b244e1

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5b5c55.TMP
                                                            Filesize

                                                            100KB

                                                            MD5

                                                            c39c4193f796f071bbe8be8ae8e4ba4e

                                                            SHA1

                                                            8e2d17b47f1ff2acfdcc46f9e91e43a29412c1ca

                                                            SHA256

                                                            70de0ffe9956546a4467c04e7f5931ea5143b0c881637da52d7b457d207b2136

                                                            SHA512

                                                            006c09cd111f761fc3b7d8e0df09708f0ed97cf48bb4857300ee6bd4f9cc565c90d6c9b468a91bde560bab596870b72dcb029f949cb9c2236547ced8372b69c5

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                            Filesize

                                                            256KB

                                                            MD5

                                                            adbd8353954edbe5e0620c5bdcad4363

                                                            SHA1

                                                            aeb5c03e8c1b8bc5d55683ea113e6ce1be7ac6e6

                                                            SHA256

                                                            64eff10c4e866930d32d4d82cc88ec0e6f851ac49164122cae1b27eb3c9d9d55

                                                            SHA512

                                                            87bf4a2dc4dd5c833d96f3f5cb0b607796414ffee36d5c167a75644bcbb02ab5159aa4aa093ed43abe290481abc01944885c68b1755d9b2c4c583fcccd041fd2

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
                                                            Filesize

                                                            9KB

                                                            MD5

                                                            7050d5ae8acfbe560fa11073fef8185d

                                                            SHA1

                                                            5bc38e77ff06785fe0aec5a345c4ccd15752560e

                                                            SHA256

                                                            cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

                                                            SHA512

                                                            a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.~tmp
                                                            Filesize

                                                            104KB

                                                            MD5

                                                            effecce1b6868c8bd7950ef7b772038b

                                                            SHA1

                                                            695d5a07f59b4b72c5eca7be77d5b15ae7ae59b0

                                                            SHA256

                                                            003e619884dbc527e20f0aa8487daf5d7eed91d53ef6366a58c5493aaf1ce046

                                                            SHA512

                                                            2f129689181ffe6fff751a22d4130bb643c5868fa0e1a852c434fe6f7514e3f1e5e4048179679dec742ec505139439d98e6dcc74793c18008db36c800d728be2

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\M1A8XLO2\microsoft.windows[1].xml
                                                            Filesize

                                                            97B

                                                            MD5

                                                            d41119748cb5d1d2b33c6ac63d425110

                                                            SHA1

                                                            6dbcfa37860a490beae2c8d95bc2a2290b323495

                                                            SHA256

                                                            6448a8580ce1994365ec765d296896e96261e4039537300dc67c8d7f523d8b0b

                                                            SHA512

                                                            9f4242889858cb996e7f72c3baaa9af2dbccc09a3531ca9ed24ebe82e2c54e210278092ebc1ef8cd6c73cc51a6c6744f0cc799808a75add2a22e7e648084d478

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133591518539271030.txt
                                                            Filesize

                                                            89KB

                                                            MD5

                                                            3b50ef907ebcfb9c5af9715216a9f5ca

                                                            SHA1

                                                            6fdaa0125e47e0862eea7bec0390e5ea827822f0

                                                            SHA256

                                                            3fe729169b06d793fe610ac75e9d706b46f82c0f710f068cc1f851b50124ee58

                                                            SHA512

                                                            6a849b2913e9a4c1233faf426c5f7870587e90b4396e25a0f4809fedb11d33fb18de12e27ab9b8551362643c9cc5239082ed51a2b2f075ee2dd3ac8170656f02

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
                                                            Filesize

                                                            23KB

                                                            MD5

                                                            78409335d2c37e27a9ac1795c1347ad1

                                                            SHA1

                                                            03e4ed413a0626f3843b5ccc3302b15352df5450

                                                            SHA256

                                                            bc7ee242ea05e234107eb34b169723d88c3a2ff1c18362487a93c14af10c5a08

                                                            SHA512

                                                            6e82c29ad8be99a024ef3ab016588b448d26aef06b8b1d473d850739829acfa0a30bbf215a8894381076f49f92bd6dd493dfd52e17f768b46e6c5408f1b4e668

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\523f61d67bf4c528e001c52e84c35ef0
                                                            Filesize

                                                            5.7MB

                                                            MD5

                                                            523f61d67bf4c528e001c52e84c35ef0

                                                            SHA1

                                                            f26774809dc1ea0bc7376606964ebcc06bfdc398

                                                            SHA256

                                                            834bd41f708d1393a528da769b015538b45b279b4af4969e1df54c0c426add3a

                                                            SHA512

                                                            d99d834d3632804160428367360f8a4c0ab6e1c9146ab12b07d6f44c30def1482809d5cac41ae84a64e5d8b99a4fcf2090c74e39b2692094168737501301b15f

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Temp\TCD445E.tmp\iso690.xsl
                                                            Filesize

                                                            263KB

                                                            MD5

                                                            ff0e07eff1333cdf9fc2523d323dd654

                                                            SHA1

                                                            77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

                                                            SHA256

                                                            3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

                                                            SHA512

                                                            b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Temp\wmsetup.log
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            71feadefeb4affe92bed0f11c5afcd1e

                                                            SHA1

                                                            c729575761fd0b179b591ecf3b16c17fb35dd4b7

                                                            SHA256

                                                            eab02368e8db4232fd6840191459e4b8d95430bdc8a4883f3563e0ebe8a500a4

                                                            SHA512

                                                            1e3f6ad285ecb62c5982aa4b1eb600a66a2049ca214da3ef4ca7a98e4c2eed03aee1bc7f522b844c68cbb9a53e1b5c8d4de0ca5da0e8c4788f59b14ad67832f6

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                            Filesize

                                                            202B

                                                            MD5

                                                            4566d1d70073cd75fe35acb78ff9d082

                                                            SHA1

                                                            f602ecc057a3c19aa07671b34b4fdd662aa033cc

                                                            SHA256

                                                            fe33f57205e2ebb981c4744d5a4ddc231f587a9a0589e6565c52e1051eadb0c0

                                                            SHA512

                                                            b9584ebfdd25cc588162dd6525a399c72ac03bf0c61709b96a19feba7217d840ae2c60d7b0d3b43307a2776f497a388e79ef8a646c12ae59a7f5cc4789bbf3c8

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                            Filesize

                                                            202B

                                                            MD5

                                                            dd0c1d22223d8d0e4e271a25a6576eb5

                                                            SHA1

                                                            24db1209d718bd8eb443da6eec2ee28d39aaecd8

                                                            SHA256

                                                            c5b636a315f8af0aac9068a2517dbb1fe136a77b9baefd12af102e65b28a13e2

                                                            SHA512

                                                            fe7568b22218c10b268c115f2209ffa8282777e354a9ce0980857879c0364f005fb6af69627e95286a8229191d34e97479498986c657c6d4a394e54731653195

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
                                                            Filesize

                                                            2B

                                                            MD5

                                                            f3b25701fe362ec84616a93a45ce9998

                                                            SHA1

                                                            d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                            SHA256

                                                            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                            SHA512

                                                            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
                                                            Filesize

                                                            3KB

                                                            MD5

                                                            94d04d86ba6f471dd2e5869902c0cdad

                                                            SHA1

                                                            78162b52fe504d8931731a8bc679363a78705fae

                                                            SHA256

                                                            4397a23f626ff07b8001534c049390407beef761da759cf6551ca182ef0114f9

                                                            SHA512

                                                            868dd94bf2d9f65e58cc84b01bc8c9a44a1d1379d3ff29e609d769f67a705cb96d5d8622dc2c717911e64fc8801704e0950e7eefcdbab6d7f4e8364fbe5e7cf2

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
                                                            Filesize

                                                            3KB

                                                            MD5

                                                            3ac22fbbbe52ab6181b5909303c31b9a

                                                            SHA1

                                                            5579fc796bc6a9ab55e80b171ca84415187f585b

                                                            SHA256

                                                            cb8e213de5f0a11ab16c7bd42e3d605c5000449b7ca064097f241701d8a42916

                                                            SHA512

                                                            8f17d24bffd14f7d3ef128b022d58fa78991b87c04dd4e33ff00e078f6542a16020822360e63365560c232e19f198a209d00b64282210dbb01b75b999210874a

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Word\AutoRecovery save of Opened.asd
                                                            Filesize

                                                            27KB

                                                            MD5

                                                            6341b3f1798cbd944fc621a0862ae2a0

                                                            SHA1

                                                            4e2ace2ed3a044ad4b395896964f110567ab1fe5

                                                            SHA256

                                                            28061cbf964999181d94d90a7f00a6ff66756cc4cc0f0bc66e5e909125734c0f

                                                            SHA512

                                                            01545c57abcffdd1effb469cd2c0c5a830104bfd912e27a4d2d8635d4186b905dcdc49fa07a9571a4a1c095b72fed5824a68837a07f081ef6163189dc8b8c81e

                                                            Download Submit

                                                          • C:\Users\Admin\Downloads\Unconfirmed 788320.crdownload
                                                            Filesize

                                                            5.3MB

                                                            MD5

                                                            a2f58a117c60b1622eede88d2163ef19

                                                            SHA1

                                                            91ed6cf5b0efb2c0bd3e06ab5775775ccd1bd631

                                                            SHA256

                                                            e74d896bc3469b5a28eb5a04ea364a9ab32737d573868fb08a327820ea624c04

                                                            SHA512

                                                            19964984f66876032ef15283c25e31737e1f56c27a3f9d7fe204dccdc0a45c64e3380a5924f4b82301e55a5371bd7c9c61776e8ae6cb15a0e0502d189384c14f

                                                            Download Submit

                                                          • memory/1832-764-0x00007FFC70360000-0x00007FFC70370000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-744-0x00007FFC72A80000-0x00007FFC72A90000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-752-0x00007FFC72470000-0x00007FFC72480000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-760-0x00007FFC72520000-0x00007FFC72530000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-759-0x00007FFC72520000-0x00007FFC72530000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-758-0x00007FFC72520000-0x00007FFC72530000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-757-0x00007FFC72520000-0x00007FFC72530000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-756-0x00007FFC72520000-0x00007FFC72530000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-755-0x00007FFC72500000-0x00007FFC72510000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-754-0x00007FFC72500000-0x00007FFC72510000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-753-0x00007FFC72470000-0x00007FFC72480000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-761-0x00007FFC70250000-0x00007FFC70260000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-766-0x00007FFC704D0000-0x00007FFC70500000-memory.dmp

                                                            Filesize

                                                            192KB

                                                            Download

                                                          • memory/1832-769-0x00007FFC704D0000-0x00007FFC70500000-memory.dmp

                                                            Filesize

                                                            192KB

                                                            Download

                                                          • memory/1832-768-0x00007FFC704D0000-0x00007FFC70500000-memory.dmp

                                                            Filesize

                                                            192KB

                                                            Download

                                                          • memory/1832-767-0x00007FFC704D0000-0x00007FFC70500000-memory.dmp

                                                            Filesize

                                                            192KB

                                                            Download

                                                          • memory/1832-765-0x00007FFC704D0000-0x00007FFC70500000-memory.dmp

                                                            Filesize

                                                            192KB

                                                            Download

                                                          • memory/1832-743-0x00007FFC72970000-0x00007FFC72980000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-763-0x00007FFC70360000-0x00007FFC70370000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-762-0x00007FFC70250000-0x00007FFC70260000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-774-0x00007FFC710B0000-0x00007FFC710BE000-memory.dmp

                                                            Filesize

                                                            56KB

                                                            Download

                                                          • memory/1832-773-0x00007FFC710B0000-0x00007FFC710BE000-memory.dmp

                                                            Filesize

                                                            56KB

                                                            Download

                                                          • memory/1832-772-0x00007FFC710B0000-0x00007FFC710BE000-memory.dmp

                                                            Filesize

                                                            56KB

                                                            Download

                                                          • memory/1832-771-0x00007FFC71000000-0x00007FFC71010000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-770-0x00007FFC71000000-0x00007FFC71010000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-742-0x00007FFC72970000-0x00007FFC72980000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/1832-751-0x00007FFC72B60000-0x00007FFC72B65000-memory.dmp

                                                            Filesize

                                                            20KB

                                                            Download

                                                          • memory/1832-746-0x00007FFC72AD0000-0x00007FFC72B00000-memory.dmp

                                                            Filesize

                                                            192KB

                                                            Download

                                                          • memory/1832-748-0x00007FFC72AD0000-0x00007FFC72B00000-memory.dmp

                                                            Filesize

                                                            192KB

                                                            Download

                                                          • memory/1832-749-0x00007FFC72AD0000-0x00007FFC72B00000-memory.dmp

                                                            Filesize

                                                            192KB

                                                            Download

                                                          • memory/1832-750-0x00007FFC72AD0000-0x00007FFC72B00000-memory.dmp

                                                            Filesize

                                                            192KB

                                                            Download

                                                          • memory/1832-747-0x00007FFC72AD0000-0x00007FFC72B00000-memory.dmp

                                                            Filesize

                                                            192KB

                                                            Download

                                                          • memory/1832-745-0x00007FFC72A80000-0x00007FFC72A90000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/2324-713-0x000001FE78050000-0x000001FE78051000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2324-714-0x000001FE78050000-0x000001FE78051000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2324-715-0x000001FE78050000-0x000001FE78051000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2324-716-0x000001FE78050000-0x000001FE78051000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2324-717-0x000001FE78050000-0x000001FE78051000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2324-718-0x000001FE78050000-0x000001FE78051000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2324-719-0x000001FE78050000-0x000001FE78051000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2324-709-0x000001FE78050000-0x000001FE78051000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2324-708-0x000001FE78050000-0x000001FE78051000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2324-707-0x000001FE78050000-0x000001FE78051000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3820-737-0x0000000000D20000-0x0000000000D55000-memory.dmp

                                                            Filesize

                                                            212KB

                                                            Download

                                                          • memory/3820-631-0x0000000073890000-0x0000000073AA0000-memory.dmp

                                                            Filesize

                                                            2.1MB

                                                            Download

                                                          • memory/3820-606-0x0000000073890000-0x0000000073AA0000-memory.dmp

                                                            Filesize

                                                            2.1MB

                                                            Download

                                                          • memory/3820-605-0x0000000000D20000-0x0000000000D55000-memory.dmp

                                                            Filesize

                                                            212KB

                                                            Download

                                                          • memory/5936-3852-0x0000026865970000-0x000002686597E000-memory.dmp

                                                            Filesize

                                                            56KB

                                                            Download

                                                          • memory/5936-3853-0x000002687FE90000-0x000002687FE9A000-memory.dmp

                                                            Filesize

                                                            40KB

                                                            Download

                                                          • memory/5936-3854-0x000002687FEC0000-0x000002687FEC8000-memory.dmp

                                                            Filesize

                                                            32KB

                                                            Download

                                                          • memory/5936-3855-0x0000026881200000-0x0000026881449000-memory.dmp

                                                            Filesize

                                                            2.3MB

                                                            Download