Overview

overview

10

Static

static

3

setup.zip

windows11-21h2-x64

10

Resubmissions

04/08/2024, 13:45

240804-q2shyawfpm 3

04/08/2024, 13:32

240804-qs7aqswemk 10

Analysis

  • max time kernel
    553s
  • max time network
    556s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/08/2024, 13:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup.zip

  • Size

    15.0MB

  • MD5

    0885d0c87354528911f49d315897fdd1

  • SHA1

    5fe60967ed1afa998376f712e4fa8af3bca1fa88

  • SHA256

    242d45f5768636258f25d282c74c933d2707fb13a7a54e893329ecc9e13ef50f

  • SHA512

    ed957e4a9361f3af3b99d2347b049d6a20921fd0e802dc9e5b01f3ef8da92134056a5ef9170f817e7c6bf4ec08cf107ffbb59eae4f76a669ddedca71c7d0bae8

  • SSDEEP

    393216:9KKjdAJ/kHfMO2/w1kBY8l5aFEYF/pAYfxXaI+vQkXLLcDlE610C9:9KKjKsHfMO2/wBFFF/pAYfR0vQk8DlNr

Score
10/10
rhadamanthysadwarediscoveryevasionexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks system information in the registry 2 TTPs 20 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 41 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 15 IoCs
  • GoLang User-Agent 2 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 7 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2888
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4468
    • C:\Windows\Explorer.exe
      C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\setup.zip
      1⤵
        PID:5952
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:6004
        • C:\Users\Admin\Desktop\setupV4.5\SetupV4.5.exe
          "C:\Users\Admin\Desktop\setupV4.5\SetupV4.5.exe"
          1⤵
          • Loads dropped DLL
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3916
          • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
            C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
            2⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1116
            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
              3⤵
              • Event Triggered Execution: Image File Execution Options Injection
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks system information in the registry
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:5308
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:5784
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:1896
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies registry class
                  PID:3960
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies registry class
                  PID:5848
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies registry class
                  PID:5544
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzgyNDMxMDUtQjExMS00NDI3LTg3QjctRTBEQjBFNTQzRkNGfSIgdXNlcmlkPSJ7M0FFNjU5QjktRDNGRC00MjEwLUFFNUMtNTAwNjkzQ0MwMkQ5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0MwRUM2MUE2LUQzMUQtNDQ5NC1CQTRBLTZCMUVFQTJGNzYzMX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTQzLjU3IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4xNSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE3NTY4NTI4NCIgaW5zdGFsbF90aW1lX21zPSI2NDEiLz48L2FwcD48L3JlcXVlc3Q-
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks system information in the registry
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:1328
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{78243105-B111-4427-87B7-E0DB0E543FCF}"
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2820
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SetupV4.5.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3916.2932.10426306588694441344
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks system information in the registry
            • Drops file in Windows directory
            • Enumerates system info in registry
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:3032
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=127.0.2651.86 --initial-client-data=0x17c,0x180,0x184,0x158,0x190,0x7ffa9673d198,0x7ffa9673d1a4,0x7ffa9673d1b0
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:976
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView" --webview-exe-name=SetupV4.5.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1796,i,8030530278665471298,16292497331407357552,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1788 /prefetch:2
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1560
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView" --webview-exe-name=SetupV4.5.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1824,i,8030530278665471298,16292497331407357552,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:11
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1592
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView" --webview-exe-name=SetupV4.5.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2236,i,8030530278665471298,16292497331407357552,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:13
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:412
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView" --webview-exe-name=SetupV4.5.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3320,i,8030530278665471298,16292497331407357552,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2212
          • C:\Windows\System32\Wbem\wmic.exe
            wmic path win32_VideoController get name
            2⤵
            • Detects videocard installed
            • Suspicious use of AdjustPrivilegeToken
            PID:1188
          • C:\Windows\system32\tasklist.exe
            tasklist
            2⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1760
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\";" powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Desktop\setupV4.5\SetupV4.5.exe\""
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1668
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users\Admin\Desktop\setupV4.5\SetupV4.5.exe
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2292
          • C:\Windows\System32\Wbem\wmic.exe
            wmic csproduct get uuid
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5124
          • C:\ProgramData\driver1.exe
            C:\ProgramData\driver1.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:1868
            • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
              C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
              3⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5916
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 520
                4⤵
                • Program crash
                PID:5620
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 528
                4⤵
                • Program crash
                PID:5296
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn WinDriver /tr C:\ProgramData\Microsoft\WinDriver.exe /sc onstart /ru SYSTEM
            2⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1196
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks system information in the registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:3908
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzgyNDMxMDUtQjExMS00NDI3LTg3QjctRTBEQjBFNTQzRkNGfSIgdXNlcmlkPSJ7M0FFNjU5QjktRDNGRC00MjEwLUFFNUMtNTAwNjkzQ0MwMkQ5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MDNGNkYyMjMtODZGQi00QzMyLUE1NjQtOEE1QzhENzIxNjg4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MjI2MTIyOTkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM2NzA4NDk3NTAzMjYzMDciPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTE0MzI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTc5OTAzOTgyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks system information in the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:1916
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EF373CAB-7C8C-44DC-BCAD-EB96A4C5868A}\MicrosoftEdge_X64_127.0.2651.86.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EF373CAB-7C8C-44DC-BCAD-EB96A4C5868A}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3568
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EF373CAB-7C8C-44DC-BCAD-EB96A4C5868A}\EDGEMITMP_22E81.tmp\setup.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EF373CAB-7C8C-44DC-BCAD-EB96A4C5868A}\EDGEMITMP_22E81.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EF373CAB-7C8C-44DC-BCAD-EB96A4C5868A}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
              3⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:3244
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EF373CAB-7C8C-44DC-BCAD-EB96A4C5868A}\EDGEMITMP_22E81.tmp\setup.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EF373CAB-7C8C-44DC-BCAD-EB96A4C5868A}\EDGEMITMP_22E81.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EF373CAB-7C8C-44DC-BCAD-EB96A4C5868A}\EDGEMITMP_22E81.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff75cb7b7d0,0x7ff75cb7b7dc,0x7ff75cb7b7e8
                4⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                PID:880
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzgyNDMxMDUtQjExMS00NDI3LTg3QjctRTBEQjBFNTQzRkNGfSIgdXNlcmlkPSJ7M0FFNjU5QjktRDNGRC00MjEwLUFFNUMtNTAwNjkzQ0MwMkQ5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezNCOEVDQkNCLTE5Q0ItNEQ3QS05Qjk5LTcyNjE2QTEzQkVERn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyNy4wLjI2NTEuODYiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxOTQ5MDQ0OTIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTk0OTA0NDkyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQwMTMyMDk4NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvYjIzNWZjM2EtODZiZi00MjBmLWIxYmMtNmM2N2EzYTk1ODg5P1AxPTE3MjMzODMyNDAmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9Sm02T01DenBNYlVFR1Y1ekQwNFhIOVk4d01LajclMmZSZ3JTRnJSYnVCbnRiZVJqY01KdDhpNklXekwlMmZpN3VjZG9QNDVobmoxQXV0a3VqOHhCVlpYNE53JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyNTY3MTA0IiB0b3RhbD0iMTcyNTY3MTA0IiBkb3dubG9hZF90aW1lX21zPSIxNDMxNCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU0MDE0NzcxNTAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDE1MjI3MjEzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NjA5IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTUwMjQ0MzQ2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iOTIyIiBkb3dubG9hZF90aW1lX21zPSIyMDYyNiIgZG93bmxvYWRlZD0iMTcyNTY3MTA0IiB0b3RhbD0iMTcyNTY3MTA0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIxMzUwMiIvPjwvYXBwPjwvcmVxdWVzdD4
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks system information in the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:4752
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5916 -ip 5916
          1⤵
            PID:472
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5916 -ip 5916
            1⤵
              PID:2112
            • C:\Windows\system32\OpenWith.exe
              C:\Windows\system32\OpenWith.exe -Embedding
              1⤵
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              PID:4380
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Default\Visited Links.txt
              1⤵
              • Opens file in notepad (likely ransom note)
              PID:5332
            • C:\Windows\system32\OpenWith.exe
              C:\Windows\system32\OpenWith.exe -Embedding
              1⤵
              • Suspicious use of SetWindowsHookEx
              PID:3048
              • C:\Program Files\Microsoft Office\root\Office16\Winword.exe
                "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Default\Visited Links"
                2⤵
                • Checks processor information in registry
                • Enumerates system info in registry
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious use of SetWindowsHookEx
                PID:2720
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1900
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks system information in the registry
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              PID:5240
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BDF38C34-DAF5-4A04-B80A-F13DFD82ABBD}\MicrosoftEdge_X64_127.0.2651.86.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BDF38C34-DAF5-4A04-B80A-F13DFD82ABBD}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                2⤵
                • Executes dropped EXE
                PID:5952
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BDF38C34-DAF5-4A04-B80A-F13DFD82ABBD}\EDGEMITMP_7CE99.tmp\setup.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BDF38C34-DAF5-4A04-B80A-F13DFD82ABBD}\EDGEMITMP_7CE99.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BDF38C34-DAF5-4A04-B80A-F13DFD82ABBD}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                  3⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Installs/modifies Browser Helper Object
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • System policy modification
                  PID:3560
                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BDF38C34-DAF5-4A04-B80A-F13DFD82ABBD}\EDGEMITMP_7CE99.tmp\setup.exe
                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BDF38C34-DAF5-4A04-B80A-F13DFD82ABBD}\EDGEMITMP_7CE99.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BDF38C34-DAF5-4A04-B80A-F13DFD82ABBD}\EDGEMITMP_7CE99.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff790dfb7d0,0x7ff790dfb7dc,0x7ff790dfb7e8
                    4⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:1040
                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BDF38C34-DAF5-4A04-B80A-F13DFD82ABBD}\EDGEMITMP_7CE99.tmp\setup.exe
                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BDF38C34-DAF5-4A04-B80A-F13DFD82ABBD}\EDGEMITMP_7CE99.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                    4⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • Modifies data under HKEY_USERS
                    PID:1232
                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BDF38C34-DAF5-4A04-B80A-F13DFD82ABBD}\EDGEMITMP_7CE99.tmp\setup.exe
                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BDF38C34-DAF5-4A04-B80A-F13DFD82ABBD}\EDGEMITMP_7CE99.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BDF38C34-DAF5-4A04-B80A-F13DFD82ABBD}\EDGEMITMP_7CE99.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff790dfb7d0,0x7ff790dfb7dc,0x7ff790dfb7e8
                      5⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      PID:2148
                  • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                    4⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5252
                    • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff7d177b7d0,0x7ff7d177b7dc,0x7ff7d177b7e8
                      5⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      PID:3504
                  • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                    4⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:4584
                    • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7d177b7d0,0x7ff7d177b7dc,0x7ff7d177b7e8
                      5⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      PID:656
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEIxODY1OTQtRkU3RC00Mjg0LUE1NUUtRUMyMjMwOEE3QTBBfSIgdXNlcmlkPSJ7M0FFNjU5QjktRDNGRC00MjEwLUFFNUMtNTAwNjkzQ0MwMkQ5fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntFQkFDMDkxNC00Njc2LTQzNDUtQjc4Qi04NjJBNTE0NDZFMDd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtoVmZEak1kRkc2RmdLczBOejZlbXJZQ1NnNlRRdkRQb21vbFJheVFYQks0PSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjE1IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9IklzT25JbnRlcnZhbENvbW1hbmRzQWxsb3dlZD0lNUIlMjItdGFyZ2V0X2RldiUyMiU1RCIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC4zMiI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSItMSIgcmQ9Ii0xIi8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkwLjAuODE4LjY2IiBuZXh0dmVyc2lvbj0iMTI3LjAuMjY1MS44NiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpc19waW5uZWRfc3lzdGVtPSJ0cnVlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNjcwODc0MTU2NzQ4MDAwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NDA3MzEwODUyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg0MDc0NjY5MjgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODQzNDQ5ODQ3MCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NDQ4MDkyMjI5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4Nzk3OTU2NDI4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNDU0IiBkb3dubG9hZGVkPSIxNzI1NjcxMDQiIHRvdGFsPSIxNzI1NjcxMDQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIyIiBpbnN0YWxsX3RpbWVfbXM9IjM0OTg2Ii8-PHBpbmcgYWN0aXZlPSIxIiBhPSItMSIgcj0iLTEiIGFkPSItMSIgcmQ9Ii0xIi8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEyNy4wLjI2NTEuODYiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgY29ob3J0PSJycmZAMC43MiIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNjcyNTIwNzU4NTU1OTMwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ii0xIiBhZD0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9IntGMTI5MjA0NC03RjY1LTQ0RDEtQjhFNi02OTE2QkEyNTA5NjR9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks system information in the registry
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:5016
            • C:\Windows\system32\OpenWith.exe
              C:\Windows\system32\OpenWith.exe -Embedding
              1⤵
              • Suspicious use of SetWindowsHookEx
              PID:2572
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Default\Login Data"
                2⤵
                  PID:5356
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Default\Login Data"
                    3⤵
                    • Checks processor information in registry
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SetWindowsHookEx
                    PID:1252
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 23600 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24364c31-b116-449c-b465-ec74e962a053} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" gpu
                      4⤵
                        PID:5648
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2376 -parentBuildID 20240401114208 -prefsHandle 2356 -prefMapHandle 2344 -prefsLen 24520 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fed9af0-559f-4629-ac98-1694cfed7e6b} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" socket
                        4⤵
                        • Checks processor information in registry
                        PID:2692
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3056 -childID 1 -isForBrowser -prefsHandle 3328 -prefMapHandle 3336 -prefsLen 24661 -prefMapSize 244628 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d3a849f-b3fa-41e6-90e8-8f8cc21c623d} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" tab
                        4⤵
                          PID:4516
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2988 -childID 2 -isForBrowser -prefsHandle 2584 -prefMapHandle 3092 -prefsLen 29010 -prefMapSize 244628 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8682d50b-6a92-4013-a920-6148f7ae3f2b} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" tab
                          4⤵
                            PID:4628
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4276 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4288 -prefMapHandle 4284 -prefsLen 29010 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abe62797-70af-43b2-b338-1bdeb930dfbe} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" utility
                            4⤵
                            • Checks processor information in registry
                            PID:4204
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5608 -childID 3 -isForBrowser -prefsHandle 5572 -prefMapHandle 5604 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4e5c35f-a3fe-4173-9f5d-c817378e4371} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" tab
                            4⤵
                              PID:4912
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 4 -isForBrowser -prefsHandle 5788 -prefMapHandle 5784 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de0a4366-0fae-4dae-b1bf-7433f2b66bd3} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" tab
                              4⤵
                                PID:2736
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5688 -childID 5 -isForBrowser -prefsHandle 5932 -prefMapHandle 5940 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c738f70-bd0a-4b8e-a7a5-33839648b2da} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" tab
                                4⤵
                                  PID:128
                          • C:\Windows\system32\OpenWith.exe
                            C:\Windows\system32\OpenWith.exe -Embedding
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:2224
                          • C:\Windows\helppane.exe
                            C:\Windows\helppane.exe -Embedding
                            1⤵
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SetWindowsHookEx
                            PID:812
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528884
                              2⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks whether UAC is enabled
                              • Checks system information in the registry
                              • Drops file in Windows directory
                              • Enumerates system info in registry
                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • System policy modification
                              PID:5588
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffa9673d198,0x7ffa9673d1a4,0x7ffa9673d1b0
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:872
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2236,i,5930758259639368462,16269766772362854047,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:1928
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1908,i,5930758259639368462,16269766772362854047,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2456
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2408,i,5930758259639368462,16269766772362854047,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:13
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:4944
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3368,i,5930758259639368462,16269766772362854047,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:3516
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3376,i,5930758259639368462,16269766772362854047,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:4936
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4332,i,5930758259639368462,16269766772362854047,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:32
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4468,i,5930758259639368462,16269766772362854047,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2136
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4920,i,5930758259639368462,16269766772362854047,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
                                3⤵
                                • Executes dropped EXE
                                PID:2196
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5412,i,5930758259639368462,16269766772362854047,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
                                3⤵
                                • Executes dropped EXE
                                PID:1592
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5520,i,5930758259639368462,16269766772362854047,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
                                3⤵
                                • Executes dropped EXE
                                PID:1028
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3640,i,5930758259639368462,16269766772362854047,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:14
                                3⤵
                                • Executes dropped EXE
                                PID:4672
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5572,i,5930758259639368462,16269766772362854047,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
                                3⤵
                                • Executes dropped EXE
                                PID:3412
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                3⤵
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Checks system information in the registry
                                • Drops file in Windows directory
                                • Enumerates system info in registry
                                • Modifies data under HKEY_USERS
                                • Suspicious behavior: EnumeratesProcesses
                                • System policy modification
                                PID:5748
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffa9673d198,0x7ffa9673d1a4,0x7ffa9673d1b0
                                  4⤵
                                  • Executes dropped EXE
                                  PID:2144
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2212,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
                                  4⤵
                                  • Executes dropped EXE
                                  PID:5308
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1860,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:11
                                  4⤵
                                  • Executes dropped EXE
                                  PID:4396
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=1696,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:13
                                  4⤵
                                  • Executes dropped EXE
                                  PID:3448
                                • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4276,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:14
                                  4⤵
                                  • Executes dropped EXE
                                  PID:5420
                                • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4276,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:14
                                  4⤵
                                  • Executes dropped EXE
                                  PID:3440
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4592,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
                                  4⤵
                                  • Executes dropped EXE
                                  PID:6104
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4604,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:14
                                  4⤵
                                  • Executes dropped EXE
                                  PID:5544
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4780,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
                                  4⤵
                                  • Executes dropped EXE
                                  PID:5468
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4692,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
                                  4⤵
                                  • Executes dropped EXE
                                  PID:5720
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4740,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
                                  4⤵
                                  • Executes dropped EXE
                                  PID:2640
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4680,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
                                  4⤵
                                  • Executes dropped EXE
                                  PID:4080
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4580,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
                                  4⤵
                                  • Executes dropped EXE
                                  PID:4176
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5084,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
                                  4⤵
                                    PID:3364
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5232,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
                                    4⤵
                                      PID:5568
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5392,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
                                      4⤵
                                        PID:6060
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4356,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
                                        4⤵
                                          PID:5200
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4788,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:14
                                          4⤵
                                            PID:1004
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=2548,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:14
                                            4⤵
                                              PID:4276
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4936,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
                                              4⤵
                                                PID:4672
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3536,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
                                                4⤵
                                                  PID:1940
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4588,i,15765256395610029551,10817426074537644264,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:10
                                                  4⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3752
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:3572
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:4252
                                          • C:\Windows\system32\NOTEPAD.EXE
                                            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Default\README.txt
                                            1⤵
                                            • Opens file in notepad (likely ransom note)
                                            PID:3752
                                          • C:\Windows\system32\OpenWith.exe
                                            C:\Windows\system32\OpenWith.exe -Embedding
                                            1⤵
                                            • Suspicious behavior: GetForegroundWindowSpam
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3556
                                            • C:\Program Files\Microsoft Office\root\Office16\Winword.exe
                                              "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_c9038f8c-1e1b-4144-a72a-756d47bbff27"
                                              2⤵
                                              • Checks processor information in registry
                                              • Enumerates system info in registry
                                              • Suspicious behavior: AddClipboardFormatListener
                                              • Suspicious use of SetWindowsHookEx
                                              PID:6092
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k SDRSVC
                                            1⤵
                                              PID:5632

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Command and Scripting Interpreter

                                            1
                                            T1059

                                            PowerShell

                                            1
                                            T1059.001

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            1
                                            T1547

                                            Active Setup

                                            1
                                            T1547.014

                                            Browser Extensions

                                            1
                                            T1176

                                            Event Triggered Execution

                                            2
                                            T1546

                                            Component Object Model Hijacking

                                            1
                                            T1546.015

                                            Image File Execution Options Injection

                                            1
                                            T1546.012

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            Privilege Escalation

                                            Boot or Logon Autostart Execution

                                            1
                                            T1547

                                            Active Setup

                                            1
                                            T1547.014

                                            Event Triggered Execution

                                            2
                                            T1546

                                            Component Object Model Hijacking

                                            1
                                            T1546.015

                                            Image File Execution Options Injection

                                            1
                                            T1546.012

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            Defense Evasion

                                            Modify Registry

                                            4
                                            T1112

                                            Credential Access

                                            Unsecured Credentials

                                            1
                                            T1552

                                            Credentials In Files

                                            1
                                            T1552.001

                                            Discovery

                                            Browser Information Discovery

                                            1
                                            T1217

                                            Network Share Discovery

                                            1
                                            T1135

                                            Peripheral Device Discovery

                                            1
                                            T1120

                                            Process Discovery

                                            1
                                            T1057

                                            Query Registry

                                            6
                                            T1012

                                            System Information Discovery

                                            7
                                            T1082

                                            System Location Discovery

                                            1
                                            T1614

                                            System Language Discovery

                                            1
                                            T1614.001

                                            System Network Configuration Discovery

                                            1
                                            T1016

                                            Internet Connection Discovery

                                            1
                                            T1016.001

                                            Lateral Movement

                                            Collection

                                            Data from Local System

                                            1
                                            T1005

                                            Command and Control

                                            Exfiltration

                                            Impact

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Installer\setup.exe
                                              Filesize

                                              6.6MB

                                              MD5

                                              71bf4a76d1762959b49eda173f57656e

                                              SHA1

                                              2ead7f36b7ef2790d83d10d96b20959bf73d061d

                                              SHA256

                                              0121c1dde7daaacfd974fc8545a029e970ad7769af84646feff41b7c8c2de33e

                                              SHA512

                                              05ea34097e98e4df5358a2968e4af9c7157c1946b15787d5c3cb1c841d47db6cacda4135a0fc662c2dae0b8ad03bdcfa1015db745c39bb16068df0108bda717e

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BDF38C34-DAF5-4A04-B80A-F13DFD82ABBD}\EDGEMITMP_7CE99.tmp\SETUP.EX_
                                              Filesize

                                              2.6MB

                                              MD5

                                              773e45f33cae3d7e514589b04930d7ba

                                              SHA1

                                              ca73da33a39de5309b596eaeb055f3175864c0ae

                                              SHA256

                                              16ee960dbf5a6b3c3d465ba2d77c049af4c15e5aea5c6f8b2e44ee7e5a623ed8

                                              SHA512

                                              d707474b38e991b8b015a0cc1bddc5dec29622c9f48b43e4b37d4e4d2a74dca70fd71eb792ee8d38c53af43da4e500afa018b27df3dfc9b652b5c1c0a76fff4f

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              Filesize

                                              3.6MB

                                              MD5

                                              3640aac842e24c750d5a3fc4b5681b64

                                              SHA1

                                              b5daa0e1faeb7836b4d988186ee3e2188699552a

                                              SHA256

                                              0d5bb995aa25eb3efcc1bd548e54b959ef96469cbea1e4e77b042d972ca347fe

                                              SHA512

                                              e019302bf0dd0137a162f2dfa2fc230cf5f5e65dea3d030a1199626ae34d537e260db2defb9c465dc84389013267fd33749de4b0f1ac9e1520a8e2702fc04c34

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\EdgeUpdate.dat
                                              Filesize

                                              12KB

                                              MD5

                                              369bbc37cff290adb8963dc5e518b9b8

                                              SHA1

                                              de0ef569f7ef55032e4b18d3a03542cc2bbac191

                                              SHA256

                                              3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

                                              SHA512

                                              4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\MicrosoftEdgeComRegisterShellARM64.exe
                                              Filesize

                                              182KB

                                              MD5

                                              b69894fc1c3f26c77b1826ef8b5a9fc5

                                              SHA1

                                              cff7b4299253beda53fb015408dd840db59901a1

                                              SHA256

                                              b91bad4c618eb6049b19364f62827470095e30519d07f4e0f2ccc387ddd5f1bf

                                              SHA512

                                              8361e97d84082f8e888262d0657bac47c152bd72f972628f446f58cbeacf37c05f484dce3fb0d38c4f0da2a2dcbb0813639d201d127ec7f072b942d43b216755

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\MicrosoftEdgeUpdate.exe
                                              Filesize

                                              201KB

                                              MD5

                                              136e8226d68856da40a4f60e70581b72

                                              SHA1

                                              6c1a09e12e3e07740feef7b209f673b06542ab62

                                              SHA256

                                              b4b8a2f87ee9c5f731189fe9f622cb9cd18fa3d55b0e8e0ae3c3a44a0833709f

                                              SHA512

                                              9a0215830e3f3a97e8b2cdcf1b98053ce266f0c6cb537942aec1f40e22627b60cb5bb499faece768481c41f7d851fcd5e10baa9534df25c419664407c6e5a399

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
                                              Filesize

                                              215KB

                                              MD5

                                              205590d4fb4b1914d2853ab7a9839ccf

                                              SHA1

                                              d9bbf8941df5993f72ffcf46beefcfcd88694ebd

                                              SHA256

                                              5f82471d58b6e700248d9602ce4a0a5cda4d2e2863ef1eb9fee4effcc07f3767

                                              SHA512

                                              bce1447d5d3210c22d52dec3b846db091b65ed03fd9d7cd11c6c4dbd2aa5a943d881360bc033c29abd61011581ff9354b35cbe421719d92568ed99997bfbbae8

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\MicrosoftEdgeUpdateCore.exe
                                              Filesize

                                              261KB

                                              MD5

                                              b07ab49ee8453853021c7dac2b2131db

                                              SHA1

                                              e1d87d6a6e7503d0d2b288ea5f034fe2f346196a

                                              SHA256

                                              f8535d5d73ebebed15adc6ae2ced6bb4889aa23e6ffe55faeabd961bf77b05e4

                                              SHA512

                                              5eaae533fbe71430ae2a717f7668fd0a26ec37624e198a32f09bfdbee7e3b6e93d64e4fbb78cbdb05c4fe390a864490ea997d11849ecd371f5153bc8bfafccc3

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\NOTICE.TXT
                                              Filesize

                                              4KB

                                              MD5

                                              6dd5bf0743f2366a0bdd37e302783bcd

                                              SHA1

                                              e5ff6e044c40c02b1fc78304804fe1f993fed2e6

                                              SHA256

                                              91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

                                              SHA512

                                              f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdate.dll
                                              Filesize

                                              2.1MB

                                              MD5

                                              5d89123f9b96098d8fad74108bdd5f7e

                                              SHA1

                                              6309551b9656527563d2b2f3c335fd6805da0501

                                              SHA256

                                              03c3c918886e58f096aa8e919b1e9f8dcd5a9f2a4765971049bf8da305476f44

                                              SHA512

                                              9d8190e5374cd1b4adbbfb87c27fa40d4de529d7c0a20654e0ce189a4cb9a53d3708c4ce657a7a5469b015df7efbbff495fc844579d9cd363b329b7e007e85c8

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_af.dll
                                              Filesize

                                              29KB

                                              MD5

                                              4f860d5995ab77e6efa8f589a758c6d2

                                              SHA1

                                              07536839ccfd3c654ec5dc2161020f729973196d

                                              SHA256

                                              9841d787142dd54fea6b033bd897f05f3e617b48b051de0ee3cf5865b3393150

                                              SHA512

                                              0b9a661b76360f1fb2eb3ee25c6bf2cbab7ec74e2363e0af321dc4d0afb3cad301dddd16ea367d588451a40a2c2ed41f21d7afae48307e1e4a4ec5b24165b378

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_am.dll
                                              Filesize

                                              24KB

                                              MD5

                                              f624de37750fd191eb29d4de36818f8b

                                              SHA1

                                              b647dae9b9a3c673980afa651d73ce0a4985aae6

                                              SHA256

                                              e284453cd512e446fcbf9440013f8cb2348ffd6b1acec5366f2511cdf88b1794

                                              SHA512

                                              d1d65e29ed59e34d4ff66df11a2368f1a724730e32eb245022d4f3d1fadf16d445ba8532460afb0e6e91f8be60a7240d13577403193042d1e912a67e4bf23b1a

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_ar.dll
                                              Filesize

                                              26KB

                                              MD5

                                              5de3f4dabb5f033f24e29033142e7349

                                              SHA1

                                              5c446985de443501b545d75f6886a143c748b033

                                              SHA256

                                              2533d443b68c5288468b0b20cc3a70dc05f0498369d5321368a97dd5bf3268c8

                                              SHA512

                                              c96296e6f67edeff2be5dc03014a8eb65fc287fb899357d4608c36c07b4610827aa18cbec6ccd47b66230a12341af488aca8bd02632fa768f84ca7b1d9c9d065

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_as.dll
                                              Filesize

                                              29KB

                                              MD5

                                              1fb14c6c4fee7bfabe41badb7c5acff8

                                              SHA1

                                              953d94cd73951943db14c08cce37b2d3ac821b02

                                              SHA256

                                              cd32339fd7e4a5959e93eb5bfd6e009e4137e15c5e6c2e861d7891487216da49

                                              SHA512

                                              a93b081935fbe48fafa8071a9cd593ae7b19205c70eaf48c724397019a04161460c66d6d8c6ffd872f4d52a4a7aa25ba1cba04181b9ebaca04b76d111ea588d2

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_az.dll
                                              Filesize

                                              29KB

                                              MD5

                                              d3345579310f3bd080b406de47b2305f

                                              SHA1

                                              16aefb27ea6d81c684f041aa50ebb49fdd403d83

                                              SHA256

                                              b4ea3c63fa0104093a2b2034f950428e66d2cf3d55f0fc5bd688483392d60d69

                                              SHA512

                                              65e4aa8587bc579b5109d91e02745f6de96a23b6ac2962cdeb6d9d536b51abab12b2bbaeca72572c3ae1971dac5bd24430eb2ae5ccf44a7068427594e4afdd7a

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_bg.dll
                                              Filesize

                                              29KB

                                              MD5

                                              ecf3405e9e712d685ef1e8a5377296ea

                                              SHA1

                                              9872cdf450adf4257d77282a39b75822ce1c8375

                                              SHA256

                                              e400415638a7b7dcc28b14a257a28e93e423c396e89a02cba51623fdfbdc6b0b

                                              SHA512

                                              37e5f1b3bdd97a4370718dc2a46d78ab5b66865d3cdb66a20a7dc20a9d423ccde954c08f97e574fbab24e8dfa905351cbfb94bd3e6692a9b6526097ea3dc911d

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_bn-IN.dll
                                              Filesize

                                              29KB

                                              MD5

                                              051c429fa2beec9c2842c403a86c0e7b

                                              SHA1

                                              0a06a45200a1f5c81c48fbd2d03549fc9fac3a58

                                              SHA256

                                              1a8465922bbb05a97a24f6c2200fcc7afd8bd0ace245c2eda9d9d335d4fb9353

                                              SHA512

                                              bb59b41804328f27ba8861af32824266ca69ddcfdaaa11551b1edd4e129dbba630da8070abedb28e180045f8d0ddc1209cd901919f6b9aa421c457188af795c6

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_bn.dll
                                              Filesize

                                              29KB

                                              MD5

                                              82711e45d2b0764997abc1e0678a73bb

                                              SHA1

                                              47908e8885c86477a6f52eea5fddb005ec5b3fa3

                                              SHA256

                                              2bb7455999b8f53a2a0834588ca4da4703f4da362a127d01cc6bd60ca0303799

                                              SHA512

                                              4b517796edc954ab7f5a26a5d6605925dc7e84b611bcf59352b3b95f719cedc72c77a465fb1e7bc2d2f422d596c97968dac5b57292c82967d5cfaff980128fc2

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_bs.dll
                                              Filesize

                                              28KB

                                              MD5

                                              a0a1f791984f1de2f03a36171232d18d

                                              SHA1

                                              71f69d8fe47640ba9705725d7d627a05519c8016

                                              SHA256

                                              d2c7da8f4745b81874a9666c7d10a779a9956b4de0ebdaa1647bf78d4e17d85a

                                              SHA512

                                              a4267911846cd55eb91227b0117ccbfdf8ef6c4ed0b8935b08e5d41a91aeabd9259988c71da8606cfb2876c4d69df6ca5a246687440283f1625105624305eb33

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
                                              Filesize

                                              30KB

                                              MD5

                                              897712b508931dab76d39b209611740c

                                              SHA1

                                              9d80e07c2dc744e2efce3b67aa9876949fb9edfe

                                              SHA256

                                              ee64fdefdb3381ce61fc445190cc44b015e7b65a3a16d28f3477f68de6079f1b

                                              SHA512

                                              3329e37318dd9b11f282301e453af106168d3d10beff1ed62ffdcda60c6b4edb6b9c69ac6b9bb8abce3c9a9686a0152404524012dbff025e571de2cfcb3b5d56

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_ca.dll
                                              Filesize

                                              30KB

                                              MD5

                                              e90155442b28008992a7d899ca730222

                                              SHA1

                                              1d448e9709de0d301ded6d75caaeba4348a4793d

                                              SHA256

                                              6ae98b5e2eda22a0236434b7e952d732e3cd5d9cae2e51cd70222f1fd5278563

                                              SHA512

                                              a91d8357ca976db2eb5a081077304a50edc1b55b2775c00cfde05e03831f98bd04e43f0dba5b3efd5a6370afcb10b23bbf307412467502e9ef57e0beae636013

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_cs.dll
                                              Filesize

                                              28KB

                                              MD5

                                              1de961b662a374c3af918c18225f4364

                                              SHA1

                                              e8f1c438e57b322f43b4b851698bf38c129eb6ae

                                              SHA256

                                              bb1365c5770dacbb918af27b47b02f269504f4d2396cf3f82bf5ecb2551c5021

                                              SHA512

                                              c6bf62b684039f62744f1aab07f4751948e0c175f7fb7fe126f20903ce23fcdd2e284f1b794922621dae7eaa15c6dae0177ad102289a18f967721486f21073a1

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_cy.dll
                                              Filesize

                                              28KB

                                              MD5

                                              29f027d2d5fd486bdc20386ace925603

                                              SHA1

                                              66b8605f23871b4a8302bef0aaccb36ee1e72755

                                              SHA256

                                              03c8566f749e8fa349d97101849bc3b2cc0b7561b565a2b0928bf8fe901da813

                                              SHA512

                                              3348bdf10b2d964b34b791a774e28c97d3caf28d7f90e36b948cc2cb6c21e84cda933b7ddbd51c8fc604a450361cb834322c15ddbe0f4851154d05e5a2a2ea42

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_da.dll
                                              Filesize

                                              28KB

                                              MD5

                                              b0ae9aa0d5c17ee7abfc57d21cdcbae6

                                              SHA1

                                              01019eb6ba9c123be528136e12192b0bb33df407

                                              SHA256

                                              d10938919e3d28d71e8e3ba2d8e02e0f9dc2faf148cdedc21c166fd994c603e2

                                              SHA512

                                              4cba25c8159df865231b08fe650eedfb92d54c3037d28b2b9af010c8a59fa23669041a6c393622fe69b0194c2532f71f02b740f7e26e0bbf7ef34a421d6747b8

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_de.dll
                                              Filesize

                                              30KB

                                              MD5

                                              ad5b530eabff0540078c5d17f27b9610

                                              SHA1

                                              7e53dbbf64e70e561d37669e69f50eb0da8e37d1

                                              SHA256

                                              49f512316a51e51027b4e70de4ffe8c8ecb188e126439a90a5d12d52a0393966

                                              SHA512

                                              e1cc853d96589220676d39d91d4108633ce56304640f770e7d22b97a9b3be9452d5fb94e4e7fcd1400b62f0c398da8255c53a31853194a9e7b7784982b5ff40f

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_el.dll
                                              Filesize

                                              30KB

                                              MD5

                                              a7e64339a5314e3576c0d170171fa52a

                                              SHA1

                                              6c12aab6c97c30aff3245b78f7a3afeea604215e

                                              SHA256

                                              4e9ccecb8e4383395f2134347fbad00521345ec9c857d8fa102d5257c7bea9bf

                                              SHA512

                                              a4ca3fb60a7f4bda50847544dd1289d750f0d4b3565929290a8392b92822ef1856cec15a1f63f2c6fe1ef2e7cc0936a35bdb38ee5d904eb08cd32f05addc6ee4

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_en-GB.dll
                                              Filesize

                                              27KB

                                              MD5

                                              74d4cf3b8efb6cc3d0acc3eac38bd5b7

                                              SHA1

                                              9337803aadad9042c895b6f418b4c733b81221e0

                                              SHA256

                                              b83c8981d8835e4c78250bf265faa6d64693204b77764c8e349abc4365ae9871

                                              SHA512

                                              e6112ef60d56101aa16327042162d6ef43519bc56668ca8eaa7fd3e1aaadc75c7df75c1e41583a292ff1a9bdc7d9ad9f5c0d97fa84964532dca2d5f3df604c23

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_en.dll
                                              Filesize

                                              27KB

                                              MD5

                                              19dc1f6d1f309eb7abf1e0c8257f41f8

                                              SHA1

                                              e2d3e86fe22c6af6b8ee5b359315dfa6ac4d52ec

                                              SHA256

                                              046f6c532fcabd969c6e63bb7ee0d7a83d806fa659006508e1c3a9485190d6ef

                                              SHA512

                                              478d6a84452cfadc48547930e336ad459eec188dd3d9e4c778cded4ec3d34e00b2b8c0538366aa644ee67f878b29c5c73444c1406c66e8394761bb0979c6483c

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_es-419.dll
                                              Filesize

                                              29KB

                                              MD5

                                              8f7f515d78d2df371993fd70f863ab8d

                                              SHA1

                                              dfae1b47e80f91abf2d9c2aac009c0a1767bc59d

                                              SHA256

                                              ba57fbb9d3a32b84d6a76054b9ad180b6510e53206b9804bb9ea18ff73c2ae3e

                                              SHA512

                                              308a62af00a4410551eac967bb9f2cea7adf7c13b471dd28b276bda40b1e4c0b4ebb60aec29b6165069d40180bc45b4f5da5baddc374ce7bc5a5bb223afb4e96

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_es.dll
                                              Filesize

                                              29KB

                                              MD5

                                              6af05d448c842027f876e93f8ac58b65

                                              SHA1

                                              f34c988e3875a1d1b267b082476fcfb8d7505a73

                                              SHA256

                                              36876b14a214cf98dda5100a7e7134d7ebb78e895535d6bd7562099574607867

                                              SHA512

                                              412031db59de0367a102a026f73072244b33d726adc5bb9fd079db3dd37b5d6a24d7420a9811576d0a356933b5ba15cc9e2a92046d2d6e6d6fef37e9d840aec6

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_et.dll
                                              Filesize

                                              28KB

                                              MD5

                                              ae9bdf6416c3630c4b0b5b119308a135

                                              SHA1

                                              d7218c677b098d2a93cc91ead39c83d3a2c653b6

                                              SHA256

                                              62da90c9417a70632aa190fecc17c31ecf433c1f84f82b08d7d7290669cabf32

                                              SHA512

                                              4333ac6cd3737f25e6e1d429b195da781ced4340b89808cbd5d5d2aae2e79bcc700419d613123d632252e31ac44d95b7718f23da5b82ab5054407e80106a64a7

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_eu.dll
                                              Filesize

                                              28KB

                                              MD5

                                              fe73dbc305da6223d1e94e1cf548c000

                                              SHA1

                                              b16f2c40d68cd9718eaaa9b6db9c8e5c4b6acb9e

                                              SHA256

                                              1ef64088a613a4e10b4cf4206f95f5414ee27872798747234a6574b7e5c70a7d

                                              SHA512

                                              d9900720d89defffa52198dbe63515995095c94aa0cbbe4f32a1c09d26809cec480e92926d2240702604b8c13fcdc0032cc46910ade8e4c1d2fc9a4bd1b63858

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_fa.dll
                                              Filesize

                                              28KB

                                              MD5

                                              367ea715e942c81dd3cb734274969a0b

                                              SHA1

                                              f92f1ec2a5be9b775e67c4252a07c37ed0ca508b

                                              SHA256

                                              082da1c09782c026c9cd73456dc12539a226f0bf5d113e59bc93b29c1e98b37c

                                              SHA512

                                              c94e787ba3bdb56d1827a0477461cbba6b7cc68986722275e0d04ea7dc70db83b5d03887eec810bf9b67f70b18bd3c7b7d28f0e554938b81d3501bc11f97830a

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_fi.dll
                                              Filesize

                                              28KB

                                              MD5

                                              5a30bc4216af48a493eeb0f3a9f02607

                                              SHA1

                                              2fdf65a4002d91818d56a23fb8bfd08ab715002f

                                              SHA256

                                              5131c23915ad6b5b469bcbff31d0ae31ef34ded28ca0ffff9f1eb998bba98aa1

                                              SHA512

                                              34b3a4865f31ebdb8665780011b384ada768a0f71bff77f91706b140eb8cc07fff8787f710cdb1ee14a449cae8f22ee5fddadcc501cf1c921eea078e97dc2f89

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_fil.dll
                                              Filesize

                                              29KB

                                              MD5

                                              84c4736cf301b93998028ed7678caec1

                                              SHA1

                                              3b6f1f6b9eb3dd7d9a13c11dfd3ac56c93f1b10f

                                              SHA256

                                              3c8dcb7e982dac3159298009a86909b1e1000ccf6f4d333341f16d4d6fbd84ad

                                              SHA512

                                              5a1b77ef9450c32802e94e473a5b4e43e892c923ef368ee9bbbbb5b0090429320263cc79a4da0b281930c1a60861519211abd0bd67a9d9ee370bdda2230d2e81

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_fr-CA.dll
                                              Filesize

                                              30KB

                                              MD5

                                              8993c0784111fc7cd6a90a82303e5f44

                                              SHA1

                                              8d1ff2fed98ebc608604c555ceb46ca628afb285

                                              SHA256

                                              3d0ba88267018f592141ea86592757cf1ecaac1a3a18f99203e0fc5c5eacbd62

                                              SHA512

                                              124d16d848dc8ea0a93b292b10ce1fbad23b56b13771d904cf14c19d54478614d214441b05f6cd9e1999b8310fdd26d1c6ecae784be00aecee7e80c96ba4ac88

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_fr.dll
                                              Filesize

                                              30KB

                                              MD5

                                              a640aa4ff33662e06a474765df0b2a8d

                                              SHA1

                                              c6265225532e389e48c6057bd717b69de2125b61

                                              SHA256

                                              078b1943bf7f7955b90abc40f691b27e04376f8c43dd3abc4791614286cd4f23

                                              SHA512

                                              59791eef021f94efd9c18737d6c46fbc45add582eec92d5b997cfd66993abc7da872720a037766c3c70862f0654ccf30d122d4a5a6b305151bf8bf1c053a466d

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_ga.dll
                                              Filesize

                                              29KB

                                              MD5

                                              5bcc643a969559317d09a9c87f53d04e

                                              SHA1

                                              3602d51cde97de16d8c018225a39d505c803e0fc

                                              SHA256

                                              b48f57e90ea9db6d6a296c01e87f8db71e47ab05ab6c2a664cfa9f52cf1d2c18

                                              SHA512

                                              4c65772f77e61e64d572df5b1f62733aceb02a5c967c296b303ff17c5d49831e5b7fc3d662724ae3ae1e88cd0fdcb704e838af5d4ae20f2d82b9577f57159159

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_gd.dll
                                              Filesize

                                              30KB

                                              MD5

                                              aea23f526ef0c5bb3d2f8fdf192a49ea

                                              SHA1

                                              4d7695e33ed43c3efb95f304e29675ea885b2939

                                              SHA256

                                              3cfe866c151a7e8a208af725c0c6f2a47fc3ada35f9ad3509b16b8d5229318b9

                                              SHA512

                                              412e4742ebd46ce38010b4f6a46d8d524025f929ab4658040e271d768e79115d90903403b2f1e51ab910bbdf9677b49439eb3c8afc5959477af198efb0c7c3c9

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_gl.dll
                                              Filesize

                                              29KB

                                              MD5

                                              295cd30c00f43d9131621baf4859578f

                                              SHA1

                                              cab79a6263b7b0a799461f3e6df41f815029cded

                                              SHA256

                                              b851c5a60cb6d1e8dd9aa161106cba99ccea047d0b39d007beaa7b9ef4a83397

                                              SHA512

                                              5f5c1e62e6c0e11a63fad68928765e3f504f33cdbb1d9a05cd53cbc3ed145bf3528960a10e3d57e8c83b07c030c72257f403b9a57d12975d3ef8bc255418ad6c

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_gu.dll
                                              Filesize

                                              28KB

                                              MD5

                                              c43c1ab37cd93e54068443bc330fb3d2

                                              SHA1

                                              ab51a2cbc51b3c17cf184c6d99ac480c02eb63af

                                              SHA256

                                              0c26a367355e766402c31fbab102dd1c35300d4a1301417c75be5fc4b3d54680

                                              SHA512

                                              ff0193189fb846eb3c4188bb599dad8e6f415ec9612da567d95c9c513defb148b6013208371798d174569b46f443a744e4e8b83aaf139d68c31f7de0f94e63f9

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_hi.dll
                                              Filesize

                                              29KB

                                              MD5

                                              a5544f517f7c1bfd1ec6a2e355d5a84c

                                              SHA1

                                              34a2a4a576300ad55b6757171bcba0fab005daa5

                                              SHA256

                                              8274c64bb778b55d912929625cd849adfe733b2dd674d94895d53af8dfaabeca

                                              SHA512

                                              9069bcfb736e13499250844dddef40e2cf64937e33ee1f81fc4968f024f7d7b89c6a778866bf1bff98d770686569e4752a473c0adfad4d4099cceda84da3cac3

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_hr.dll
                                              Filesize

                                              29KB

                                              MD5

                                              c09876a180731c172fa2532f8be90a3d

                                              SHA1

                                              4359c7840ddb23142a40aff85129b9920360e954

                                              SHA256

                                              50fd548ea12e2b72fc563bc082b870a89a523e8b3a4a0e9b65fe673384da2b58

                                              SHA512

                                              91cee1b10fc12a01a2a285e67dba583d6f1bee0716cc89103fee0c7d0f52fadc0f9ac5b13e833834e7279963726950d3897847e7acac61857257fc031692033e

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_hu.dll
                                              Filesize

                                              29KB

                                              MD5

                                              ee19156c12d2d7cce9b12e515f9ac6c5

                                              SHA1

                                              19ad46e40b3c1cb6195231bfcf45bb68ee1b43bf

                                              SHA256

                                              c290883b4b99758792284755efa52c12eb09039f0f8027d8ba3b1d4bb2f3846f

                                              SHA512

                                              631364472a450519ad8959971d6c319610570ca37b4486ea12d6af5b46aaecbf336aadddd1f3fefba841534ff82adf905b1e1a008638ed784bf08870a3b86ee1

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_id.dll
                                              Filesize

                                              28KB

                                              MD5

                                              eacd4638369bf96ccc7c23af37e15b5d

                                              SHA1

                                              15c4878b78c06095981abcc589c4a6f265ef96a3

                                              SHA256

                                              a53c0fd74995090dbf48bbba4a00560e3cc344ce8120b8b2bfa1f9b953b536ef

                                              SHA512

                                              19cc8d25bd8fd84481f77d301f79636208df5807647ddc6cb6beff3882d94672db49daa4ddfff0c334b584742f9d2fea3af73977032d7dfccd0cfd1314af4ae6

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_is.dll
                                              Filesize

                                              28KB

                                              MD5

                                              19d44de8f930e07f41f9343478ed5c1d

                                              SHA1

                                              83ee0c5a86997dd491bd8312d221dde2b2e7d44a

                                              SHA256

                                              69d3a21b7723e4df8b7b97e39493081e41231e2d3a3f5a4de462db41339987ec

                                              SHA512

                                              4edb82aedfeca743a03815a889eca766fec8083afd0defa098593297a52edaf1780dbd5ad1d3325c614d815d34d8c57ec2283a0db215f94f42819f1890089c4a

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_it.dll
                                              Filesize

                                              30KB

                                              MD5

                                              26cbb965c6976f59ac385ef9408bf81a

                                              SHA1

                                              16bb0530338e600fdfd13a7b03523a715e633bcb

                                              SHA256

                                              bed996b25f77c7d4328d96147ed388f1b457abfc0510eb8956be4339d103821a

                                              SHA512

                                              1efb1bdf0276de17f8516cde4d435e0be8fd066f52fb5d4c9e2fe2e17a135296ab6b34f523284941beae438e97d7e65de26f0541b7c437bceff229b60da4bb0d

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_iw.dll
                                              Filesize

                                              25KB

                                              MD5

                                              98f79d77ab05304bba8d60e50914418f

                                              SHA1

                                              957590adc0f8a7274e765e2a804c1de7c76e3040

                                              SHA256

                                              3764941b873ed59d5bc1097f6b9382ba59c06d443a96ff71ba6b693f161da522

                                              SHA512

                                              9ca6af5c14193dce7b50251f1b9205870435e60b5495ab1a9f0d42ca14b98b78fef51bf3cd4165394ca5ba28d0e98bea7642ec67039c0f146383136145c7de59

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_ja.dll
                                              Filesize

                                              24KB

                                              MD5

                                              b89ba9ecc6d4c77abff61b1c75fff16c

                                              SHA1

                                              f381408f26be2c77c7b59681ad6280a701ccb472

                                              SHA256

                                              bbd2c970f747a6ee8e4735939225f607ae630ddc6e2e39954e0300ca9a7a88b2

                                              SHA512

                                              53a3db82f4cf5a300a5eab7692f4084451b987ad72ae24d9118d80f18692ac3604981c0e871c7a7625c5153803aea0e093d91822d33af0c10a07bcb6e766a5b6

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_ka.dll
                                              Filesize

                                              29KB

                                              MD5

                                              d464fd223ba898e6fef4e485a3118394

                                              SHA1

                                              59c78983ce859485fea5458ba4e7803c38012b9d

                                              SHA256

                                              066c5c4b4c87ffd201d0dbfc43cb7566cfb03a6ed2fbf8698220fb919637294d

                                              SHA512

                                              6ac1d5fc59e6b7a10532902b059ac25a2bf58b0a63ab586e89b293e2de732c1d5d580c75ff28e4a2660a6ee3f0389f49e388567bcc07dd6e1cfd5d019db3ea52

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_kk.dll
                                              Filesize

                                              28KB

                                              MD5

                                              1b1202fc3e46d7b46ce3cb46cdc5ab21

                                              SHA1

                                              e76d1065035d86eef011feb3cad3ac38eecd0b7d

                                              SHA256

                                              b660a0e1d5161765881e0a7fd9d714abce341403b21f63667ffdedf7d5a254d0

                                              SHA512

                                              7f11d5d6995f27bb4f8705ac7310273f070a71adc73cdb70d74766c89437b3e7a10453fc55588ac223fe3b449564758a49380168d779fdb6a4fac3b5cde767ea

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_km.dll
                                              Filesize

                                              27KB

                                              MD5

                                              126036b98853a9d31937f874484dcb83

                                              SHA1

                                              27ffb8f3f6e966c3b79824357e79eac4ec8ce0a7

                                              SHA256

                                              90908e9108adcb0b4df84e4fbd9724e5e7a2d2eb54720fe49f37bdce977be635

                                              SHA512

                                              b384657e0ca90270b96cb724aa55c52f5c8b569fdb1a7ee7085c18d6822c39fc81a490128bd42d0aec1c0ddac1853e30718710968f5921a5331211bd33e89316

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_kn.dll
                                              Filesize

                                              29KB

                                              MD5

                                              e20f7a758cc9bab3d458d89d828521cc

                                              SHA1

                                              cae0a6d29e5b3f0aed0db2d66fe19d5463c09cfb

                                              SHA256

                                              92858a377f1ddc353b51bb44ec04f571ff2b4913d3c8104aa01359b72f91f2eb

                                              SHA512

                                              8bf9b8c6765820db6dd95303cb996b97649796e14e67b465fded3c24ef180891d58f9fdcb06243ef1d4c5cdd4148f58f64d74d2ceb2cb214051718d33efc9707

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_ko.dll
                                              Filesize

                                              23KB

                                              MD5

                                              f7dbd944a9126dbe568faf2489ecf053

                                              SHA1

                                              16ad534b4fa48d95224c74b8ca4d3d4533c76425

                                              SHA256

                                              b1dd9c0fdd11a5f83ed5b7d1fbcd417bfaa94e42035647ca45f20e332b531703

                                              SHA512

                                              0b6843fd208ea9448179e63b485c01b5ff824d555cad57cdb6575234bf43d6cf253e9494fa74150b9fa9ace9d1d1ce749e1a77c7b342c10498dd7bd3953d9a27

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_kok.dll
                                              Filesize

                                              28KB

                                              MD5

                                              c1557eba649fc78356ed198d6754416d

                                              SHA1

                                              1ab42e71a88b127c40f8dd6d1b0660f271442a11

                                              SHA256

                                              8c5a7b3e9f5a3a64214ca8e9d43ea152f69fc2633f47c0783b90385e00551ef9

                                              SHA512

                                              e2f92c8c6ea823e1d716732b4bb5295d34da02d270079f645d9290261728bcf822b7f845f4a37dc2ef844580d6a3650a53c3e80be875eac5dffef651e8607993

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_lb.dll
                                              Filesize

                                              30KB

                                              MD5

                                              b61c9c9ea8340b6b3a873162a2710cfe

                                              SHA1

                                              5017b90dbd61add602681b76542b0bd3974639af

                                              SHA256

                                              f3eb2d26173d9ea8e26e234c3c5f91f9eb145fdf8b2b3e5011e0f33394fd8737

                                              SHA512

                                              0d32f6a880509472a51ceaa9539e3169505bc6b508664d28c9dfdd1a3a72abec665574dfb89e385c18522166221f1d73741fe62e4ea0860bc132e198614cccf2

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_lo.dll
                                              Filesize

                                              27KB

                                              MD5

                                              6e6f49c35d2b74090529fc1d8d12eb2e

                                              SHA1

                                              5a0fc9397872d7d26803276292962cdb0a5e4739

                                              SHA256

                                              6a25fc0ab6e2c73eb938b8e0f38578b9a02feb3a0634a16ac41ebc2a9642d260

                                              SHA512

                                              d3838a88908b2ab9bf6018dfa4c6f784371774cc0bcc82e180761673a9e527e126fee17a150a51c6d0a1159575e2060c12f85ae751e7a95f0285e816799540bd

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_lt.dll
                                              Filesize

                                              28KB

                                              MD5

                                              071ee832762aab532c59b858c7d3a46a

                                              SHA1

                                              0a976bd2c76d8db1f831a8912184d43e02ecf293

                                              SHA256

                                              a47e46963fbc7020dfc9dd08eb5d7d8c4c2a9f0b0a8f51f1256453058a6a19f2

                                              SHA512

                                              50ec7ff32da6f0d022ce067bcc160ccec00c4676ca56b789bc6ba1efc7f34ad485297f4cca6f6ed40be1c59018a7287c7fb490e6adcdd74f3f72b4526332a522

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_lv.dll
                                              Filesize

                                              29KB

                                              MD5

                                              bf10592aafe1b8446c005ee9e5c305a8

                                              SHA1

                                              19b81a238e07c958f1757488440e42ba99b59b53

                                              SHA256

                                              5cb166b350b425009080d39efa3b6ff5c0bf78f4276cc1ffce3043d4ef1a687f

                                              SHA512

                                              b69d55757047170a7583f3f0525307e09e670adfe05906d30bf208dd78b70b3e18a19adf59aeccc861857c2e37cb08412e4729d597ffb45960d285e12357b4ff

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_mi.dll
                                              Filesize

                                              28KB

                                              MD5

                                              d8b6019ab0fa35c6e64b08f1453204be

                                              SHA1

                                              aea69732af642a0d13bc8feda2b25751196cc1c2

                                              SHA256

                                              0672e8b5be2da1042bf6c85611a0a89012496fbcf7d06a7f446b30997cd20eb2

                                              SHA512

                                              878dd4db34b1f501c37eacedac8eb0c87143189f7357fbd5bd97faac01ba98cebab56e2e3934af012de37d0f32fb91578b16504b12e34b5f448605a82cb8f054

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_mk.dll
                                              Filesize

                                              29KB

                                              MD5

                                              f05d3aa1b51abeab311516368dddd8bc

                                              SHA1

                                              75ca6ae175a3ccc9f00d82afb4c6b673f396c6ac

                                              SHA256

                                              7aa26839a50ebc3ccb20ab5aebab432b695f0024d52529ef262f5eb8ef96d17d

                                              SHA512

                                              4ff88ba89823ad0c0ca2782c87bbdbc7fe738a161d5d4f674d7b9c97d491eb5aefc0430f34d3dfa7c2737f3484040894d81ac38135fc4ad3bc6cc0eb24e479f7

                                              Download Submit

                                            • C:\Program Files (x86)\Microsoft\Temp\EU30EE.tmp\msedgeupdateres_ml.dll
                                              Filesize

                                              31KB

                                              MD5

                                              dc1bb5db270c494456f49913e26f94b7

                                              SHA1

                                              73dd3db577b7bd6bdaf047cd2012c75cc2213bd2

                                              SHA256

                                              155abac08c35cb330d20aef6375dbe18421c042a2533da0c63535ec59009cadf

                                              SHA512

                                              2cff374df4f8f41961c6e26ce369fc07ad8881c2edbe85173b6982d393402e32a79c73b8c17cc786d27a1f0ee79475e4ef9b3238f8770a099bdb9c422caa1287

                                              Download Submit

                                            • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                              Filesize

                                              15KB

                                              MD5

                                              e013cd49783125e72d3d9b9d5df139ae

                                              SHA1

                                              f0d507e7043ffe366bfe719c74e7b0daa206b788

                                              SHA256

                                              92347bad8c79d8fba5b486c2d6a9b6aad999b935b858d0f9cc8d915498e85346

                                              SHA512

                                              afb6ab7b804e7c5ca3f69237bf03851e69f6814529b12c918079b1dc8757035c99aaeb1bc0ca81bf753f998d72658dc05f47c570879becbeebecc389a61cdf96

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                              Filesize

                                              280B

                                              MD5

                                              a99a5ba7584a9a75c34ab19fda238e22

                                              SHA1

                                              ad9e563f252cce410c32874d19dcf9e94c0e2bdb

                                              SHA256

                                              43c61cf1e4b65094a4e246b8aec0529a43c5d23b8b76a4472c154dc0f17f9b44

                                              SHA512

                                              917f2ac3d0720e13d36542103444b2b8413346d232aca3a417991ec4869105eec047801fe0f5033f6969a65181f3bb5cfe6e471b262cbf7b91fabd83ef5f6f04

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                              Filesize

                                              280B

                                              MD5

                                              9ce06c538faa8c66bbf0fbe8258b02e3

                                              SHA1

                                              4a28e84bcd7700d9c5e44311830bdf2b7f79768f

                                              SHA256

                                              7a7932c0ca684b3e4754918281f58d11c4bc389494b58c2bfc65abf62de59926

                                              SHA512

                                              01a44f0b6286333d04ee1789d8af968cb9f46cc9ee574e82b7b2c3061cc89c3ed9aee8ec89118e85b2d42eccee4553d50e0d4f69c4a7dcf3bfc9360be440824a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                              Filesize

                                              280B

                                              MD5

                                              c7dc522a2d631ad4b8305a4c7c5da630

                                              SHA1

                                              d4f9a145a336e10c5e525cbe96055fba39093a36

                                              SHA256

                                              273ed136968c7bd19cfac626427c50c2ed7e3f9cfd4f0853aff25b2f6d0d7e84

                                              SHA512

                                              e00506396f47e44f22a4078766b128bd9ca6e9cc818f99b0aecfd80a3fe33463f3800697949dee8535c2436372cf19989bf3715d3399e8d46c2bdb4f71d2c159

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                              Filesize

                                              720B

                                              MD5

                                              3c64d421e33017537fdebfe9e9e24b36

                                              SHA1

                                              a4ff6e40cd1c45e86728cc4334e195942c004d13

                                              SHA256

                                              fdbf62db050540ff65afec9a12f9cec0db5537870e8297b98fe8094126da52fe

                                              SHA512

                                              3012a936030a6696aace51844bff6206942e58af391e9920877456169e2f1740682e9a1bdd8035a9893ea3ca98bc2588f490d6d2c62abb974909076270a3c7d5

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\47a6c972-22c0-41b1-910a-0d4e1b8640d6.tmp
                                              Filesize

                                              2B

                                              MD5

                                              99914b932bd37a50b983c5e7c90ae93b

                                              SHA1

                                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                              SHA256

                                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                              SHA512

                                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp
                                              Filesize

                                              4KB

                                              MD5

                                              b4658f0ac4d1a96ff23e9edd0de90b1e

                                              SHA1

                                              752b065125d6fd91e8eba3fcbcb32ae2d1d1c1f9

                                              SHA256

                                              8f6bc4d06d8f3f8424d8856fbcd03034a61cb4170f409973dabfefec21d5ae7f

                                              SHA512

                                              4a35569e6334f50d8c879f4985fdcb43f9e4e0927bb6f133360ae541de1e41cc9024d551b33d2114f97a53a07837e62dca24e2a45b9d7b47b1642a384d6e5bd1

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
                                              Filesize

                                              9KB

                                              MD5

                                              3d20584f7f6c8eac79e17cca4207fb79

                                              SHA1

                                              3c16dcc27ae52431c8cdd92fbaab0341524d3092

                                              SHA256

                                              0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

                                              SHA512

                                              315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6a077420-d226-4b35-891a-ee49ab66d90c.tmp
                                              Filesize

                                              40B

                                              MD5

                                              20d4b8fa017a12a108c87f540836e250

                                              SHA1

                                              1ac617fac131262b6d3ce1f52f5907e31d5f6f00

                                              SHA256

                                              6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

                                              SHA512

                                              507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                              Filesize

                                              2KB

                                              MD5

                                              3109c7c84d4953e2e3e4bd1cf9eb8f5e

                                              SHA1

                                              9f6a5013bb6a49cb3ecc3251bea901bb43b3eb6e

                                              SHA256

                                              9a6533c3e5ccf35207c05f597a3396f3effa75b030597699c18af4fe35982853

                                              SHA512

                                              5052c675e64cea6140b9bac8b5a3f57f65eef213bb17a000dde8e81d5fd855b1a59f0149d1bf68ca8eda878672d337c0898c28c88560db9345f4872eb577600d

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                              Filesize

                                              1KB

                                              MD5

                                              6eaef3feb8cfb52bb444f580493e40eb

                                              SHA1

                                              521397ac5677a5f85b2a81ff6b147c3fbd962825

                                              SHA256

                                              6493a5d8f7a75bb356b0aaa42fff3d22670bada45b4b2cd3f270a2752e48713f

                                              SHA512

                                              aff8941c9324f6a3d80f5707f1a396ffd51a25dcc1964c120ce8692d5c75144ed55eea10667fd7b898c9cdf653f04296922e9e323a9263b8ad229ecf99f5f681

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                              Filesize

                                              11KB

                                              MD5

                                              51d82c623d13543412959fb3212ec361

                                              SHA1

                                              e33cf88282a49c39fac781970753e8097cf03330

                                              SHA256

                                              80485ae59f084e918da7efce9d00671c77f17097e7058cbefd2d82f3a28cb70a

                                              SHA512

                                              bb00b0edf5b510587c8ebea94597cc2e60cf32a9d54fe066efb03cbe2afea7707bb50b2a4cbc7373c96167b58dec738e40b9704a6518db6abf976d2215003d5b

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                              Filesize

                                              12KB

                                              MD5

                                              2b25f08eae3f662131e7b8ae75183e7d

                                              SHA1

                                              233a5a9ae8d815f09e915e134d65c5435dfa2409

                                              SHA256

                                              b1cc8ffdbebff9db64793e250aff68e501bfb504d4183311d56fb2f54a23087e

                                              SHA512

                                              65bbb0454799f43024de8811c1d212b43697ec8a16078250f44350835a1680b13d454ce1ace38c9807eb9e557699391d0c364039308531ca7801c639c8042135

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                              Filesize

                                              28KB

                                              MD5

                                              7ba98d0b80c60c801e9c6d6abfc71e49

                                              SHA1

                                              667d5d132bc7093bcd53b07e69efbca8e7a9c739

                                              SHA256

                                              dee7247d951cdb6b5be281bf4a98de5e1c9c0001bac34db182118ce86d3fa553

                                              SHA512

                                              9534a31b2d59763e70252e005153685e2719bb9d7e2bdba2ede0c4d04c340167cf01fadf42843ed84aa6e4278d95b99701e747795729f558f2d4c6a1ddd20411

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dcf743c3-7717-4421-8db5-c0215d7013bf.tmp
                                              Filesize

                                              1B

                                              MD5

                                              5058f1af8388633f609cadb75a75dc9d

                                              SHA1

                                              3a52ce780950d4d969792a2559cd519d7ee8c727

                                              SHA256

                                              cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                              SHA512

                                              0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                              Filesize

                                              5KB

                                              MD5

                                              9df1703907474a70beb4ca2a4173df6d

                                              SHA1

                                              543492ae88e1a6ceddb0196c22e839ffb073850b

                                              SHA256

                                              6f9d28fd10449d1fcacad8ae3f6fde4602ea17f66af7ba1899eb7a9ec693b37d

                                              SHA512

                                              5050e30cf38b9ace6592830838bdb934b423b542d0ed02df970e3e8d482a8f46c105cb53e3d6770cc3b6e11361f6f043bb91ce383098069a91be6b5c599c4542

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                              Filesize

                                              13KB

                                              MD5

                                              83e5aff5ff64d9aed5c1e9fd5e292cc1

                                              SHA1

                                              4530cca063bb7d975cb824acaab8211a2bcf951f

                                              SHA256

                                              f9b8e0c4fd4298b5b700e6fa94fb6c981f45c0ffc52aa2b45c918ce5b31c5e6e

                                              SHA512

                                              95df194cc79364ed0a1936a0a321dd56fc9b9d6269d4430de432fa8c0173f10bb5d45586d48873593758efe425c1234a7be8af6df4c2361b813c1539e4f6490e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                              Filesize

                                              31KB

                                              MD5

                                              bc00a6e35d72cc9168dc066e7e7c4ac7

                                              SHA1

                                              3bf27ef3696d32dc607ca04d4761c0910afcd2a6

                                              SHA256

                                              e17b8ad5b3dde6372d1738ed37afb637415e6726c19e2f365bcbfb7a9f418562

                                              SHA512

                                              28cd47b8718513e811aad73275a634b2ac2d167583161b4139bc8b4a7cb0aea642bfede261262fdfd0bc932a4f7a10b40fadcbcc71329df8cf1d90e3af001439

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                              Filesize

                                              6KB

                                              MD5

                                              badff62762d48168e453135de8fd3804

                                              SHA1

                                              20131b96a0618778eea641297f2550c027a226ff

                                              SHA256

                                              f0be0a3d03b33e0a30b72ca4f488822315336637d41077ab25b71d4ab05221dd

                                              SHA512

                                              7f0ea9237d9e3ce630c07c4596dd65d487622d35e808951bf69aeeda48e0713b03b816f6a2af7b657d96b7d8e0e4785a8af9cdc682b035abea63945a2694a79b

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                              Filesize

                                              7KB

                                              MD5

                                              21219b3ef72ef928c5e30c01ed2b6862

                                              SHA1

                                              6a95de6f8e01908a1e7b482941c2e64c21e89aa3

                                              SHA256

                                              aa6652d36091a903a211ce43d588b7bfb042ae3a6c6db4992d7acaa9ec1b5acf

                                              SHA512

                                              557eed17ae277494d2ae50ec7216d845cbfda5e2b4a3db796d0766b248030777566b16bc885161c182269b6a26ea094bc2a127e92bfbd7dbae5e93dfce420d8a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                              Filesize

                                              8KB

                                              MD5

                                              5621cae8a214c110b26f08e1a99b55a0

                                              SHA1

                                              e957790c06fd76be215508dd723f0307cc1b2d99

                                              SHA256

                                              4cc6148468d63e03925361a91cb8b7a2e47ae4b06e2478ec344661dd74107f18

                                              SHA512

                                              8f6a7ef801f170dd0e7391b4ee5add7d827ec8ef25001fcd96fa20274e0c12d89e03aaa0a6e1119d6d5529c2583eb5254a5d306fc9eda82eb3bcabb47142c0c5

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                              Filesize

                                              13KB

                                              MD5

                                              a07aded9074c4e4b21f9e8c446891296

                                              SHA1

                                              58d5007e53f10dd832cc4eca5fa8e39a3cbdb02e

                                              SHA256

                                              6d85e7e7e7f6ea40584baa081924c08d0e35ab773bf8c4067e8e1e76fd00898c

                                              SHA512

                                              bbaf76f5afc88a94f1fc82740bfdab48db6a35f7dea0874a9f27bf707387aea4ae942288b4691f4cdfa78dc40d16b0dd08d1a0b2bea0493377b6d6c0091430df

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                              Filesize

                                              28KB

                                              MD5

                                              2a620770dca3ea404fb85f8594344960

                                              SHA1

                                              50f9fd0a942c0c34d560cd8b693d3a81536c177f

                                              SHA256

                                              c324e742cf37204b8c8a64a0cd2e884600663eb5978db97669298b0236277316

                                              SHA512

                                              26418a4151711b4b0b2596c1ae8d63947871d3d2a6256953bd1039b08c726d86cc1e65ddf3e302010eb82d2d6c8ac2f8eea08f5c7d1b32ed4e490a9a0a044372

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\1.20240804.1.0\typosquatting_list.pb
                                              Filesize

                                              609KB

                                              MD5

                                              95a382664dfdc4972058926fab5fb8d9

                                              SHA1

                                              2db2e132f1658830fc2c00aef794c9c5ef118e3b

                                              SHA256

                                              0c3f09f0cc4147c7f8745abd5fd3aa5f8c0a86480c1e6ba36021be8d164add0f

                                              SHA512

                                              a570525f9503a7e6194aca8f2cf12ce08dd3d77b6241c54accb4394fb3a52c7958ff21d2c22c162b346e20fbc09e473b373cfc0a6a828d395aa2a45e3369f18a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\adahrqhl.default-release\activity-stream.discovery_stream.json.tmp
                                              Filesize

                                              18KB

                                              MD5

                                              d3253a37886c6bd3029885951dce99e5

                                              SHA1

                                              2e98d39ea21089643c6efd7d1c79d40f147cd3a4

                                              SHA256

                                              c16704b52c0477f9c76759e8606d6aca7628460e9fdf6219a3da8a321075be48

                                              SHA512

                                              691b67b32a593d1d312a96288510aa95c9a621ded99ce7addc953cc760c3a95ee79c53d7ca6871650afa05be58bd76967476a03426c0593c4a7d6ed40cd5769b

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
                                              Filesize

                                              1.6MB

                                              MD5

                                              45e5ca74b9ae3c3fc6f6a63c609783b6

                                              SHA1

                                              f36715bea96d69bb18075fac30b90502c6d2464b

                                              SHA256

                                              b4afd37b9087df7e041ae749fd0fa342926d9cce533bde9cdc4283132c3820a9

                                              SHA512

                                              014fd398d456fcb118dfd6b038b6f96008ca209d44d9707e175e85e7f14cfb3f2886deaed0d8ed25971813035e8dd7f88142c06972f3e2c9b4a534d84bec661a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pahfjksl.v3g.ps1
                                              Filesize

                                              60B

                                              MD5

                                              d17fe0a3f47be24a6453e9ef58c94641

                                              SHA1

                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                              SHA256

                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                              SHA512

                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\scoped_dir5748_1039536985\34e01163-3bdf-44c9-a848-fa8e81ccf9f7.tmp
                                              Filesize

                                              10KB

                                              MD5

                                              78e47dda17341bed7be45dccfd89ac87

                                              SHA1

                                              1afde30e46997452d11e4a2adbbf35cce7a1404f

                                              SHA256

                                              67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

                                              SHA512

                                              9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\scoped_dir5748_1564389370\465b9b82-3aab-4b93-b85d-5c5c46875183.tmp
                                              Filesize

                                              132KB

                                              MD5

                                              83ef25fbee6866a64f09323bfe1536e0

                                              SHA1

                                              24e8bd033cd15e3cf4f4ff4c8123e1868544ac65

                                              SHA256

                                              f421d74829f2923fd9e5a06153e4e42db011824c33475e564b17091598996e6f

                                              SHA512

                                              c699d1c9649977731eea0cb4740c4beaaceec82aecc43f9f2b1e5625c487c0bc45fa08a1152a35efbdb3db73b8af3625206315d1f9645a24e1969316f9f5b38c

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                              Filesize

                                              451B

                                              MD5

                                              1a65d136b459d30122296600c1f1b707

                                              SHA1

                                              cc9efd1ae933828bd6862fbf88df0b2a808572b1

                                              SHA256

                                              ade5afdde97f20caa6e8fa6cf162e43a54eadcdc6ba975be18868f6bebdd2d7c

                                              SHA512

                                              07e23825888c0bf1e71a1e7bcb5ddb04613f9d7e04c0843b8ad3d1e72d3f28eae47f407816eaab28377f449c0305cf6151be32304ee67db9b2b01e8f646e68f8

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp
                                              Filesize

                                              6KB

                                              MD5

                                              f82605c951f7538e11a7f6a4db234315

                                              SHA1

                                              ea7853eadd48b8e1a82b3847469f55eaf9ebe9af

                                              SHA256

                                              fd453d221f0eb31038ef4ae9d2ce52a6c09022abc8eeeddbbf617b57afdfe620

                                              SHA512

                                              2890181355385f28522b4e839177bb579035360ef45fbd9328354d1fe117b4694b9553224b42f0fdae1737af7868f43d2cddae1a8a7b569f44b516223edcbd95

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp
                                              Filesize

                                              5KB

                                              MD5

                                              9ad6229fa39413f3dd047f84c45a3e8c

                                              SHA1

                                              82c73f92131ea58f7f38f528637eae96ea5878a8

                                              SHA256

                                              e1c2d322cdfd8d2702046ca7c4d46012d1ec17eca30d350731f8023c676f4dc0

                                              SHA512

                                              fc7d9860758e2efc53c678b5f07e0c2ed7919e7c8838df854dce29bc19516f805545e88172768efe60a65f7a3e380a249f09a6ed553300df02c6866e7f606dd1

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp
                                              Filesize

                                              5KB

                                              MD5

                                              4266f6b53e925cd4bf6268f162cdbb88

                                              SHA1

                                              3bfbf286a821a60652d0a6f35ed798877d063fb6

                                              SHA256

                                              9d978013a77508d256f2e913977c5d3f6a87310bdd6cf89c59be01e4cd54d941

                                              SHA512

                                              5a46b10947593fcac33579d1fc5cf68a793530adc1bf9e1bcf4a61adda6a808e84c7a602deab10ab3b3d0b68f64c65355b3c04b90070f46c8daae59b39fb9286

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp
                                              Filesize

                                              5KB

                                              MD5

                                              7435831905439f74757420050010c710

                                              SHA1

                                              acf26d47a49f2aa179f1a883824c14b88eac7b2e

                                              SHA256

                                              ce2549039eab29fd7815a21ba7c918dd5ab60850e65527e08ff7ec86b1e749cc

                                              SHA512

                                              b9b0a214efe4f13ff0ca21e974fc75274e05bb2b4b96b6be2682163f9ad4e4ee09bb708c4a233b28d406a11992549e8e9e00302c7fd138d018974754e9b820ca

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp
                                              Filesize

                                              6KB

                                              MD5

                                              19c286b351a075b667912a3758a43406

                                              SHA1

                                              7480ca6aa91605e361f2519fc9b03bd5b4b0db14

                                              SHA256

                                              8efec1b50d100f38d3a32d54619928abf9cda1e95bde7863c314372f482827e7

                                              SHA512

                                              a68aacf15946db90014ab43616746fd00cd66339c229c9489e6c37a66232a2b28b0d6d1a93e40ffff3ce886c9448d08860c047d54946ab906a73995c04d343d7

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\pending_pings\085f4a62-fc16-4b52-ba23-6ded324865c1
                                              Filesize

                                              26KB

                                              MD5

                                              9e9ad44f26ccbccf5e96a068b6c4d268

                                              SHA1

                                              83f3e2b268af0ff5da47ff270f0635e525ffed88

                                              SHA256

                                              23b081c992b1753a65a9d28fca7b9cf2fe0533c23c5b8da7101aa6c2ef1827e9

                                              SHA512

                                              3add730861564e2893119715ad33507203109489f41c2b46de4ceeb1cd2d13ed235c83f578b856de48b8c13047235ae60265405cefb7daf9b97afdfbaa79c258

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\pending_pings\09d154e0-8356-4fab-8bb9-51f9cb532572
                                              Filesize

                                              671B

                                              MD5

                                              eead1e3c91ee32915219a418e6ee1364

                                              SHA1

                                              2050898b81d238137a90d679ad3dfdb24cf3d122

                                              SHA256

                                              7ea9c49376787728a50f2875709640370f7859c938874e0e2074f8007961b5cc

                                              SHA512

                                              560f959fca0698105f5e63626089c276e5347d39ac43ae1e27699988062389063cf41c42c5818a8b471ba927820e47dfd1abe35cc3d4863d2f2101cc4cd659a3

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\pending_pings\54598f95-061f-47b9-bfd0-82e108afe827
                                              Filesize

                                              982B

                                              MD5

                                              a45c7b096d6930a69166697d5117aab4

                                              SHA1

                                              3f289828878b3f62e63b78416ae03480b2fa7f79

                                              SHA256

                                              bb4501e41bb3a3132762c06d4a23662b0908b11eaa836d534174eb0c3671fb1f

                                              SHA512

                                              2a8705ead88f9ec6c26fe9623c586cc1419bfd914f3bbd9a764f5ad8f8be8fc85c4d773bff004ce8d0b19348c53b7a8afa9b4cb7de885ab81d44c80530b58fb2

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\prefs-1.js
                                              Filesize

                                              10KB

                                              MD5

                                              b4723f2ce60fba9274d206a1588d8b62

                                              SHA1

                                              fe4efbe90f768a99319030757ee8f08d085cd711

                                              SHA256

                                              c80bf60a845d5cefe79d56df09318fbeaa48d8fd86edb272fffda19d7af3f507

                                              SHA512

                                              552aad5868cb8f5fd0dbcde66a288d4b9e9b0fcd5e4f2e08de0297b25b6edeb88c68b6b302e68d1eb62733bdc2afbdb4caaabdf2d4aa46075437e645fe707702

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Crashpad\settings.dat
                                              Filesize

                                              280B

                                              MD5

                                              139c239c822ce85d97a518325fb81951

                                              SHA1

                                              eee66ae12f08161be4252d36be2706a01aee5726

                                              SHA256

                                              d820ee1116ba72d26076fe9fb79e5f3732e625bcbd3f0dd91c074c04ce0aa3ce

                                              SHA512

                                              4555a38c0323a11d10b07202ee8b5983852ae699c94033ba014b67740997d893fadbfbd2d788b7e56af847016cbc33d2f9729394a60c0a6ae37e552e38c716d6

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                              Filesize

                                              48B

                                              MD5

                                              7f6c82076c0049cf9c04e5ceafd8fa04

                                              SHA1

                                              9383f5a5cae81cb997e4e80695a25e75ae1024ec

                                              SHA256

                                              20456131b3e4f1ecd0d7016630ee0ca7f2b4748bf41be131b88b8360b12a6c60

                                              SHA512

                                              d26b8f94fb989eeff6a9bdebe23cc9efc7a506e08f7e637014e34bebc80719378aac88b4d78db9bbe371f7ab4cc3af49d091d2f6f31dcaefd9f1f8ea170e5c9e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                              Filesize

                                              96B

                                              MD5

                                              1ae8beb70b0cb94811731a36ba93fdc3

                                              SHA1

                                              0d006f5b5238d211ea28bc733f29b6c464493681

                                              SHA256

                                              4038cc8d1a51859b06637c592d6fcafa0ed0105f5d0213b68bac2859b18c0f47

                                              SHA512

                                              128aecb8f6cec8a59e231384450b61829502ee64fe5b838cae39b5da65fd417dbfe6815c912d1543e72033e66ccff323affcaf08dee029b488e32a18dd82e635

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
                                              Filesize

                                              41B

                                              MD5

                                              5af87dfd673ba2115e2fcf5cfdb727ab

                                              SHA1

                                              d5b5bbf396dc291274584ef71f444f420b6056f1

                                              SHA256

                                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                              SHA512

                                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Default\Network\Network Persistent State
                                              Filesize

                                              111B

                                              MD5

                                              285252a2f6327d41eab203dc2f402c67

                                              SHA1

                                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                              SHA256

                                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                              SHA512

                                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Default\Network\Network Persistent State~RFe596632.TMP
                                              Filesize

                                              59B

                                              MD5

                                              2800881c775077e1c4b6e06bf4676de4

                                              SHA1

                                              2873631068c8b3b9495638c865915be822442c8b

                                              SHA256

                                              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                              SHA512

                                              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
                                              Filesize

                                              2B

                                              MD5

                                              d751713988987e9331980363e24189ce

                                              SHA1

                                              97d170e1550eee4afc0af065b78cda302a97674c

                                              SHA256

                                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                              SHA512

                                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Default\Preferences
                                              Filesize

                                              6KB

                                              MD5

                                              313c74827a54f74d9f39dc2abd1dce3d

                                              SHA1

                                              6215da5197cf565bcf7aee9719b659daa62cb687

                                              SHA256

                                              1b15c4bac3062ba15964c12cd4143dd8e445d2c8352d30ecd453b0a6ac091e39

                                              SHA512

                                              0c9a685fe5388b05f5a084b4eb6df980b31261288cd9ec947bdffb46359c98f56dfc5306038730eb8e271899e95a68c2185de2c5ad66f139037602c395a737a7

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Default\Preferences~RFe596603.TMP
                                              Filesize

                                              6KB

                                              MD5

                                              56b46adbdef5dfbb4eea1272e6b9f9ce

                                              SHA1

                                              1a83530563731e3a9b08e14de14c9cbff17335b1

                                              SHA256

                                              656d1446563dd9811e7d93a44f006bec41486bc42d7845baea4bb0cf101f9785

                                              SHA512

                                              c9ae4e9a53b00ecca8ba8dd8306035d41f562f0f1d87f1032454be8f3ed3c6400d7ea8482f3b8c80eb42ccd144e33105546191a452cb4611cf0b4d5eb45e1e6d

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Default\Site Characteristics Database\CURRENT
                                              Filesize

                                              16B

                                              MD5

                                              46295cac801e5d4857d09837238a6394

                                              SHA1

                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                              SHA256

                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                              SHA512

                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\GrShaderCache\data_0
                                              Filesize

                                              8KB

                                              MD5

                                              cf89d16bb9107c631daabf0c0ee58efb

                                              SHA1

                                              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                              SHA256

                                              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                              SHA512

                                              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\GrShaderCache\data_1
                                              Filesize

                                              264KB

                                              MD5

                                              d0d388f3865d0523e451d6ba0be34cc4

                                              SHA1

                                              8571c6a52aacc2747c048e3419e5657b74612995

                                              SHA256

                                              902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

                                              SHA512

                                              376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\GrShaderCache\data_2
                                              Filesize

                                              8KB

                                              MD5

                                              0962291d6d367570bee5454721c17e11

                                              SHA1

                                              59d10a893ef321a706a9255176761366115bedcb

                                              SHA256

                                              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                              SHA512

                                              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\GrShaderCache\data_3
                                              Filesize

                                              8KB

                                              MD5

                                              41876349cb12d6db992f1309f22df3f0

                                              SHA1

                                              5cf26b3420fc0302cd0a71e8d029739b8765be27

                                              SHA256

                                              e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                              SHA512

                                              e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Local State
                                              Filesize

                                              16KB

                                              MD5

                                              98ee0a2acd5bb6f4f75bcc6c2dd3c5b9

                                              SHA1

                                              8b76c47e9997f2708f12e2e72c7a456916dbb281

                                              SHA256

                                              5c75b2786239c7d14b70c2e3934c41e850e87a89505bb24367f0b0f779131268

                                              SHA512

                                              d2c57f1f48532c670960651db6d59e30f76ccad39cf4f77902be041e0e409ec52f26ecec7240f875c7a952afd3227529dc3989f3fa545f96a43ccdc86f24c233

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Local State
                                              Filesize

                                              16KB

                                              MD5

                                              0c87552258b90413e20ae7d9ab990623

                                              SHA1

                                              405d0ee33900da59c8ec439dd4f9349c8f39bc6a

                                              SHA256

                                              e171621a8a700233de783416cf6a94320bbc797601409d885d6fff03ff8351e9

                                              SHA512

                                              2a501899991d8d249c3a8bd4ade53edb81c2b086ca3cbe0338d38c560a8301bd839ee48f498ba9a6f7500897f67bd7cd44ca0a8aba24c837dddb606afdcbc396

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Local State
                                              Filesize

                                              1KB

                                              MD5

                                              7fa3088c51f2bf60c4565db71ef6b7eb

                                              SHA1

                                              73098a353f8412e713c891906f3f46be96df01cf

                                              SHA256

                                              195c02ef57e85d968c11bb3c1f67eb7435d5042999c14fd3c00c69f4716a7719

                                              SHA512

                                              453ea0abb4c46f446054b91b0da7b97a0558b9b9eca266eded48cd1092ee55809f2fcd708a8979d43c032a531fbfc7c30afdbb4a848090cdb674f396a219aea7

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Local State
                                              Filesize

                                              2KB

                                              MD5

                                              5ad352f2e131659db4ab3a55bffdc9b2

                                              SHA1

                                              9da9691777460f8bb42f80e1d81f22e6fb25a31d

                                              SHA256

                                              b553a239e51d37ef54a669d400b264316e7a62d897e729c755fa4e09f8d6c161

                                              SHA512

                                              ae81126c55676b1a5a53c69cd59a66188461e09205e5f9509befcd93e5a4507d67b3c6d79335ec2dd9045757de03969ea6367041cc96f17b2df78af5728f561f

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Local State
                                              Filesize

                                              3KB

                                              MD5

                                              e7c309046ca4b144ecab0be21bc10465

                                              SHA1

                                              3c27f6f1c2e1421ba1f1d3ea62fa7e2b6feeb724

                                              SHA256

                                              e957d3e59bfe7da82bb52af93156b5e9aad8e7ab36fd3de479c0bfc00adc9a8d

                                              SHA512

                                              ba5d783038b3752df00d41af26aa656c0e3ee61087f489337758a100ea19bfe63551a2d56717462b906cbfea9bbbef3611491f06c01daeffdeeffffa00e85982

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\SetupV4.5.exe\EBWebView\Local State~RFe58cc73.TMP
                                              Filesize

                                              1KB

                                              MD5

                                              af119044de03558c7a9ccfe891e93fdd

                                              SHA1

                                              951bb950a88d57a3bcb07beec4fb679243196116

                                              SHA256

                                              4d8ea7d9a03150c455f7e282bd87ae732f330dfa80cb50ce8d44a3cc0ff017e9

                                              SHA512

                                              c6540d91cf1583857ce7841ac91b9d58c04a7b9a8e2babcc6db0dd7641c0345a4c45e74bb6dc47b3d8fe5ee0395ca1c941040d2adf97641ed6c60aa7736dade4

                                              Download Submit

                                            • C:\Users\Admin\Desktop\setup.zip
                                              Filesize

                                              15.0MB

                                              MD5

                                              0885d0c87354528911f49d315897fdd1

                                              SHA1

                                              5fe60967ed1afa998376f712e4fa8af3bca1fa88

                                              SHA256

                                              242d45f5768636258f25d282c74c933d2707fb13a7a54e893329ecc9e13ef50f

                                              SHA512

                                              ed957e4a9361f3af3b99d2347b049d6a20921fd0e802dc9e5b01f3ef8da92134056a5ef9170f817e7c6bf4ec08cf107ffbb59eae4f76a669ddedca71c7d0bae8

                                              Download Submit

                                            • C:\Users\Admin\Downloads\YyN_l_YX.part
                                              Filesize

                                              42KB

                                              MD5

                                              56157edcfd5fb97c478ec60c85d5bc4a

                                              SHA1

                                              a1905bb3ca089b639f851aaf8bc992f80397ae82

                                              SHA256

                                              ee5e57598345b9d5acab2acd8fda7db4ef351b2cb02a991d2a8245c524707d4b

                                              SHA512

                                              f2abf819becd7c624d987c45abccb7f42231aacfaeb275d5a34dce1e05e0bc6d89046147bbdb0c0113691814e307f543d5f2197c1cdd36595afa9ed5c79b21c3

                                              Download Submit

                                            • C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat
                                              Filesize

                                              280B

                                              MD5

                                              aea39fe68342e8129be89bbb547610bb

                                              SHA1

                                              106ccbc46c4da01d7cc20aca58eae81c72dd2a25

                                              SHA256

                                              52b0fae187baf470110c26dd03b5be2b850578461eaeb54e30620a6767f9ae7f

                                              SHA512

                                              e781cd428ec4e88f2c86e2c7c09ac46e5e1c7172df643bb5be065ec039207e130b4821cc00abcf6c255b2c1f9baefd2718ee3e1af68450c699463383cc16125b

                                              Download Submit

                                            • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5748_1349192162\manifest.json
                                              Filesize

                                              76B

                                              MD5

                                              ba25fcf816a017558d3434583e9746b8

                                              SHA1

                                              be05c87f7adf6b21273a4e94b3592618b6a4a624

                                              SHA256

                                              0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

                                              SHA512

                                              3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

                                              Download Submit

                                            • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5748_971914852\manifest.json
                                              Filesize

                                              122B

                                              MD5

                                              2a762821a150615718ae1acaa956c1bf

                                              SHA1

                                              d08878ec73eae0251dd6e74eb734d53bfb31cb84

                                              SHA256

                                              36b182a49345ea4ce5e2d0dfef818723522ede073ab1a935fd6780bcc62540d8

                                              SHA512

                                              97c8042a6f00dd6c1eeb4d13858076cb146decc3c9b204de4badfe154e5c43e1ab7dac13583fd85d60a4eb811432e59e472dc554ab3d8eb3585d9fd432ae415e

                                              Download Submit

                                            • memory/1560-432-0x0000019086320000-0x000001908640A000-memory.dmp

                                              Filesize

                                              936KB

                                              Download

                                            • memory/1560-238-0x00007FFAB6650000-0x00007FFAB6651000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/1668-398-0x000001E2A5740000-0x000001E2A5762000-memory.dmp

                                              Filesize

                                              136KB

                                              Download

                                            • memory/1868-460-0x00007FF62F1D0000-0x00007FF62FD2D000-memory.dmp

                                              Filesize

                                              11.4MB

                                              Download

                                            • memory/2212-273-0x00007FFAB6650000-0x00007FFAB6651000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2720-647-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2720-644-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2720-676-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2720-648-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2720-677-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2720-650-0x00007FFA757D0000-0x00007FFA757E0000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2720-649-0x00007FFA757D0000-0x00007FFA757E0000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2720-645-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2720-679-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2720-678-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2720-646-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/4468-638-0x0000000000AD0000-0x0000000000AD9000-memory.dmp

                                              Filesize

                                              36KB

                                              Download

                                            • memory/4468-643-0x0000000076AD0000-0x0000000076D22000-memory.dmp

                                              Filesize

                                              2.3MB

                                              Download

                                            • memory/4468-641-0x00007FFAB7FA0000-0x00007FFAB81A9000-memory.dmp

                                              Filesize

                                              2.0MB

                                              Download

                                            • memory/4468-640-0x00000000027C0000-0x0000000002BC0000-memory.dmp

                                              Filesize

                                              4.0MB

                                              Download

                                            • memory/5308-183-0x0000000074590000-0x00000000747B5000-memory.dmp

                                              Filesize

                                              2.1MB

                                              Download

                                            • memory/5308-208-0x0000000074590000-0x00000000747B5000-memory.dmp

                                              Filesize

                                              2.1MB

                                              Download

                                            • memory/5308-182-0x0000000000AE0000-0x0000000000B15000-memory.dmp

                                              Filesize

                                              212KB

                                              Download

                                            • memory/5308-226-0x0000000000AE0000-0x0000000000B15000-memory.dmp

                                              Filesize

                                              212KB

                                              Download

                                            • memory/5916-634-0x0000000003D80000-0x0000000004180000-memory.dmp

                                              Filesize

                                              4.0MB

                                              Download

                                            • memory/5916-459-0x0000000000E00000-0x0000000000E7E000-memory.dmp

                                              Filesize

                                              504KB

                                              Download

                                            • memory/5916-637-0x0000000076AD0000-0x0000000076D22000-memory.dmp

                                              Filesize

                                              2.3MB

                                              Download

                                            • memory/5916-635-0x00007FFAB7FA0000-0x00007FFAB81A9000-memory.dmp

                                              Filesize

                                              2.0MB

                                              Download

                                            • memory/5916-633-0x0000000003D80000-0x0000000004180000-memory.dmp

                                              Filesize

                                              4.0MB

                                              Download

                                            • memory/5916-461-0x0000000000E00000-0x0000000000E7E000-memory.dmp

                                              Filesize

                                              504KB

                                              Download

                                            • memory/6092-2236-0x00007FFA757D0000-0x00007FFA757E0000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/6092-2231-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/6092-2237-0x00007FFA757D0000-0x00007FFA757E0000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/6092-2274-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/6092-2275-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/6092-2276-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/6092-2277-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/6092-2235-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/6092-2232-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/6092-2233-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/6092-2234-0x00007FFA78030000-0x00007FFA78040000-memory.dmp

                                              Filesize

                                              64KB

                                              Download