Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://delta-execut...

windows11-21h2-x64

8

Analysis

  • max time kernel
    1130s
  • max time network
    1131s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11-11-2024 07:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://delta-executor.com/

Score
8/10
adwaredefense_evasiondiscoveryevasionpersistencephishingprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
    persistence
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • A potential corporate email address has been identified in the URL: e^^TaUJ@DP
    phishing
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery
  • Checks system information in the registry 2 TTPs 24 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Probable phishing domain 1 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 5 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 44 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    evasionspywaretrojan
  • NTFS ADS 5 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of UnmapMainImage 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
    1⤵
    • Executes dropped EXE
    PID:1236
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3604
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4412
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://delta-executor.com/
    1⤵
    • Loads dropped DLL
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3264
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0xdc,0x7ffc687a3cb8,0x7ffc687a3cc8,0x7ffc687a3cd8
      2⤵
      • Loads dropped DLL
      PID:2840
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
      2⤵
        PID:5100
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2680
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
        2⤵
          PID:2476
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
          2⤵
            PID:2060
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
            2⤵
              PID:724
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
              2⤵
                PID:1408
              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2232
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
                2⤵
                  PID:1812
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
                  2⤵
                    PID:1780
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
                    2⤵
                      PID:4960
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
                      2⤵
                        PID:4344
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
                        2⤵
                          PID:2380
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
                          2⤵
                            PID:3188
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:492
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
                            2⤵
                              PID:996
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
                              2⤵
                                PID:4832
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
                                2⤵
                                  PID:3348
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
                                  2⤵
                                    PID:5084
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
                                    2⤵
                                      PID:3644
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
                                      2⤵
                                        PID:4888
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3556 /prefetch:8
                                        2⤵
                                          PID:3268
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
                                          2⤵
                                            PID:4828
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
                                            2⤵
                                              PID:4512
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
                                              2⤵
                                                PID:2452
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7088 /prefetch:8
                                                2⤵
                                                  PID:2624
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6864 /prefetch:8
                                                  2⤵
                                                  • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                  • NTFS ADS
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3184
                                                • C:\Users\Admin\Downloads\Delta V3.61 b_30946817.exe
                                                  "C:\Users\Admin\Downloads\Delta V3.61 b_30946817.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4584
                                                  • C:\Users\Admin\AppData\Local\OperaGX.exe
                                                    C:\Users\Admin\AppData\Local\OperaGX.exe --silent --allusers=0
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3488
                                                    • C:\Users\Admin\AppData\Local\Temp\7zS0ADEFE09\setup.exe
                                                      C:\Users\Admin\AppData\Local\Temp\7zS0ADEFE09\setup.exe --silent --allusers=0 --server-tracking-blob=MmIwMGZkNTEwY2NiN2UzNjY3NDcxMzkxYTQxMWE0NTM5MzZlNzQ0ZDcxMDExNTJjMmJmOWVkMWI0ODNkZTQ4YTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD1lOWQ4OWY2MmVlY2E0Y2ZiYWQwYzc0MjIyOWJkMmIzZiZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInRpbWVzdGFtcCI6IjE3MzEzMDk0OTYuODg1NiIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdPVzY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfMzU3NSIsImNvbnRlbnQiOiIzNTc1X0ZpbGVETSIsImlkIjoiZTlkODlmNjJlZWNhNGNmYmFkMGM3NDIyMjliZDJiM2YiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI3MjEyNGFkNS1iN2QxLTQwYmMtOTQ1Zi1mYzFlOWQ5NWJhMjgifQ==
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Enumerates connected drives
                                                      • Modifies system certificate store
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4508
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS0ADEFE09\setup.exe
                                                        C:\Users\Admin\AppData\Local\Temp\7zS0ADEFE09\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.159 --initial-client-data=0x334,0x338,0x33c,0x310,0x340,0x717d8c5c,0x717d8c68,0x717d8c74
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:792
                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1480
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS0ADEFE09\setup.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\7zS0ADEFE09\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4508 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241111071818" --session-guid=eb54fcde-1ddf-4926-b8e6-33ee1716e30d --server-tracking-blob=ZWZiYjQ1ZGMwNmIzNjQzM2ZlNTFmOWFhZGM3MzhlZDM0NWE2OGFiZmU3MzNiNzE3MDc1MTUwNjM2ZTY3OWNjZTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD1lOWQ4OWY2MmVlY2E0Y2ZiYWQwYzc0MjIyOWJkMmIzZiZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMTMwOTQ5Ni44ODU2IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV09XNjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1BCNV8zNTc1IiwiY29udGVudCI6IjM1NzVfRmlsZURNIiwiaWQiOiJlOWQ4OWY2MmVlY2E0Y2ZiYWQwYzc0MjIyOWJkMmIzZiIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6IjcyMTI0YWQ1LWI3ZDEtNDBiYy05NDVmLWZjMWU5ZDk1YmEyOCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=4C06000000000000
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Enumerates connected drives
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:5032
                                                        • C:\Users\Admin\AppData\Local\Temp\7zS0ADEFE09\setup.exe
                                                          C:\Users\Admin\AppData\Local\Temp\7zS0ADEFE09\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.159 --initial-client-data=0x32c,0x330,0x340,0x308,0x344,0x70898c5c,0x70898c68,0x70898c74
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4552
                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411110718181\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411110718181\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:920
                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411110718181\assistant\assistant_installer.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411110718181\assistant\assistant_installer.exe" --version
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2412
                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411110718181\assistant\assistant_installer.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411110718181\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0xca4f48,0xca4f58,0xca4f64
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4776
                                                  • C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4000
                                                    • C:\Program Files (x86)\PremierOpinion\pmropn.exe
                                                      C:\Program Files (x86)\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:InstallUnion -bid:3HhY3ReQkY_qUBwI3iPOGG -o:0
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Modifies system certificate store
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1468
                                                  • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
                                                    3⤵
                                                    • Loads dropped DLL
                                                    • Opens file in notepad (likely ransom note)
                                                    PID:2692
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5544 /prefetch:2
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3604
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
                                                  2⤵
                                                    PID:3184
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7180 /prefetch:1
                                                    2⤵
                                                      PID:472
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
                                                      2⤵
                                                      • NTFS ADS
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3568
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
                                                      2⤵
                                                        PID:1812
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
                                                        2⤵
                                                          PID:728
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
                                                          2⤵
                                                            PID:2368
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
                                                            2⤵
                                                              PID:5336
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
                                                              2⤵
                                                                PID:5372
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6656 /prefetch:8
                                                                2⤵
                                                                  PID:5808
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7220 /prefetch:8
                                                                  2⤵
                                                                  • Loads dropped DLL
                                                                  PID:5400
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
                                                                  2⤵
                                                                    PID:5936
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
                                                                    2⤵
                                                                      PID:5928
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7340 /prefetch:1
                                                                      2⤵
                                                                        PID:3644
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7524 /prefetch:1
                                                                        2⤵
                                                                          PID:6112
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7836 /prefetch:1
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:6108
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=7264 /prefetch:8
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:5604
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7804 /prefetch:1
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:1136
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:5716
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6764 /prefetch:8
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:4560
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7580 /prefetch:8
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                          • NTFS ADS
                                                                          PID:5700
                                                                        • C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                                                          "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks whether UAC is enabled
                                                                          • Drops file in Program Files directory
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Enumerates system info in registry
                                                                          • Modifies Internet Explorer settings
                                                                          PID:5600
                                                                          • C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
                                                                            MicrosoftEdgeWebview2Setup.exe /silent /install
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Drops file in Program Files directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2028
                                                                            • C:\Program Files (x86)\Microsoft\Temp\EU84A4.tmp\MicrosoftEdgeUpdate.exe
                                                                              "C:\Program Files (x86)\Microsoft\Temp\EU84A4.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                                                                              4⤵
                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Checks system information in the registry
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:5940
                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                • Modifies registry class
                                                                                PID:5728
                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry class
                                                                                PID:2484
                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Modifies registry class
                                                                                  PID:584
                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Modifies registry class
                                                                                  PID:5148
                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Modifies registry class
                                                                                  PID:2016
                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Mjg1RUUxQ0YtNTg5Ni00NjZBLUEwMTgtRTEyQjUzMjAwRURFfSIgdXNlcmlkPSJ7MTVGNERFNjktQTU1RC00Mjg1LUFCQjItOEI5QzcwN0FBRjAyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszQTBGMUQzNi1GOEI5LTQ5MjktOEY3My1CM0QwQUZFQTIyN0N9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg1MjEyMDI5MDQiIGluc3RhbGxfdGltZV9tcz0iNjA0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Checks system information in the registry
                                                                                • System Location Discovery: System Language Discovery
                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                PID:1840
                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{285EE1CF-5896-466A-A018-E12B53200EDE}" /silent
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3596
                                                                          • C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe
                                                                            "C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe" -app -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5600
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                            • Suspicious use of UnmapMainImage
                                                                            PID:5620
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 812
                                                                            3⤵
                                                                            • Program crash
                                                                            PID:5832
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7804 /prefetch:1
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          PID:4660
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          PID:3516
                                                                        • C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe
                                                                          "C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:pAyo61nbgBd_woYuPcKzVubr-989zHzzuF-rvqlYcdD9uD1nMf4Fp86JkUOZ0ZUk8QdkCMkbwfXEcFWn8NZMWS1SiMHizSJqsl2X2L5h6oWX3WIv1Gbz2lRGcbVN9Ih5c20kVdxIptuLg4R4lJ7CKKjPpcmtcFtUYwImiDmXlECUK7Xem5GKUyPcr9suxD_TM2ShWg0UlygkQ57C_EpKLVdk8XdRiRgRmEX9XB-PBUc+launchtime:1731309710692+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1731309613333005%26placeId%3D5771467270%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D94c7229e-089e-444c-9ca2-faf18b01e3d7%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1731309613333005+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          • Suspicious use of UnmapMainImage
                                                                          PID:6028
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:1
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          PID:5636
                                                                        • C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe
                                                                          "C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:7OO83I0KmDbTAn4x49sYP7jzujBOnr3BlVMYORmdTfBSjhp85hlXxwVPYc_VS8LOBnQMJd_a747rlhzNZYO63vtkWXaTA32nf4742Gy9CNNf1kLJUUJvB08H6b_fZyEGIzQIroH51M1OnduIaHYfb1GHiAow-iRzFtleUSIPvR5s4YCKobB-2q5W3S4kG9-TDhwKdolJIw4yDNi7Csg461eCLy1mCQYdUpLfKTvok9E+launchtime:1731309710692+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1731309613333005%26placeId%3D5771467270%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D94c7229e-089e-444c-9ca2-faf18b01e3d7%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1731309613333005+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          • Suspicious use of UnmapMainImage
                                                                          PID:4612
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          PID:4584
                                                                        • C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe
                                                                          "C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:3SHFyO6Uv7F6db97J3O6yzCWqwKcFw951t9FQWOy8-GqDmtegZS9mssVKEvMjSuXfmyLI9L-3XOwYEfshkPc3yA8S0AD2Hx9pQn9Qqz-FLzlc2Bkpy3aDSvLnvM7l0EloDwNAKCtsw1mfR3wvxA_705goOKZ_UaUHLRUGWjfdLfct_gvPo02lH1NSp5YADXN-JyKAHUXtwZVEYf4brD5TsmccRKAKdbCp5mhs8TKP0w+launchtime:1731310047120+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1731309613333005%26placeId%3D5771467270%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D27f5ca45-aa97-43db-8321-43b6732ae1d1%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1731309613333005+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          • Suspicious use of UnmapMainImage
                                                                          PID:5324
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,17943363795627778856,6228083158264593068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1136 /prefetch:1
                                                                          2⤵
                                                                            PID:5300
                                                                          • C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe
                                                                            "C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:KSGLLNTqBXw0YOY5-D1Tou6w-g5EA-kYX2B-3LsFBH1W7xeiCEO4ipEpfkvJjYtCuP13_7e1yS0GF939D88fFleLS81-85pVTivbJLV4-MEiTmHg0XRFT9ZZKq2ZOzRlqSs0bRK3Fxzug6kHY5RygnBH57u8gltbqKpW-wrSJA9-RlPxEQKVZpQ0puchYC0r6TgBtX2g860vxoJQISuoIL6SjSakQf-JPxRs6KWfi6Q+launchtime:1731310509714+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1731309613333005%26placeId%3D5771467270%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D9d535aab-5b60-41cf-a694-dd746b7cf808%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1731309613333005+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                                            2⤵
                                                                            • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                            • Suspicious use of UnmapMainImage
                                                                            PID:5604
                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                          1⤵
                                                                            PID:3720
                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                            1⤵
                                                                              PID:5052
                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                              1⤵
                                                                                PID:4720
                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                1⤵
                                                                                  PID:4828
                                                                                • C:\Program Files (x86)\PremierOpinion\pmservice.exe
                                                                                  "C:\Program Files (x86)\PremierOpinion\pmservice.exe" /service
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Modifies system certificate store
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1592
                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                    C:\Windows\system32\rundll32.exe C:\Windows\system32\pmls64.dll,UpdateProcess 1236
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:4204
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg.exe EXPORT "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}" C:\PROGRA~2\PREMIE~1\RData.reg /y
                                                                                    2⤵
                                                                                      PID:4880
                                                                                    • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                                                      "c:\program files (x86)\premieropinion\pmropn.exe" -boot
                                                                                      2⤵
                                                                                      • Manipulates Digital Signatures
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • Drops file in System32 directory
                                                                                      • Drops file in Program Files directory
                                                                                      • Drops file in Windows directory
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Checks SCSI registry key(s)
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:2908
                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                        CheckNetIsolation.exe LoopbackExempt -s
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:6140
                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                        CheckNetIsolation.exe LoopbackExempt -s
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5348
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell Get-AppxPackage
                                                                                        3⤵
                                                                                        • Loads dropped DLL
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1512
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      /C C:\PROGRA~2\PREMIE~1\pmropn32.exe 2908
                                                                                      2⤵
                                                                                        PID:5456
                                                                                        • C:\PROGRA~2\PREMIE~1\pmropn32.exe
                                                                                          C:\PROGRA~2\PREMIE~1\pmropn32.exe 2908
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:5480
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        /C C:\PROGRA~2\PREMIE~1\pmropn64.exe 2908
                                                                                        2⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5468
                                                                                        • C:\PROGRA~2\PREMIE~1\pmropn64.exe
                                                                                          C:\PROGRA~2\PREMIE~1\pmropn64.exe 2908
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:5504
                                                                                      • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                                                        "c:\program files (x86)\premieropinion\pmropn.exe" -updateapps
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1748
                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy
                                                                                          3⤵
                                                                                            PID:4652
                                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1220
                                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:728
                                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=f46d4000-fd22-4db4-ac8e-4e1ddde828fe_cw5n1h2txyewy
                                                                                            3⤵
                                                                                              PID:5192
                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.aad.brokerplugin_cw5n1h2txyewy
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:5248
                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.accountscontrol_cw5n1h2txyewy
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:5324
                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.asynctextservice_8wekyb3d8bbwe
                                                                                              3⤵
                                                                                                PID:5356
                                                                                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.bioenrollment_cw5n1h2txyewy
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:5412
                                                                                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.creddialoghost_cw5n1h2txyewy
                                                                                                3⤵
                                                                                                  PID:5652
                                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.desktopappinstaller_8wekyb3d8bbwe
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5800
                                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ecapp_8wekyb3d8bbwe
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5836
                                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.lockapp_cw5n1h2txyewy
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5408
                                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedge_8wekyb3d8bbwe
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5896
                                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedgedevtoolsclient_8wekyb3d8bbwe
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5936
                                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.onedrivesync_8wekyb3d8bbwe
                                                                                                  3⤵
                                                                                                    PID:5888
                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ui.xaml.cbs_8wekyb3d8bbwe
                                                                                                    3⤵
                                                                                                      PID:6012
                                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00.uwpdesktop_8wekyb3d8bbwe
                                                                                                      3⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:6052
                                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00_8wekyb3d8bbwe
                                                                                                      3⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:6084
                                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.win32webviewhost_cw5n1h2txyewy
                                                                                                      3⤵
                                                                                                        PID:6132
                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.apprep.chxapp_cw5n1h2txyewy
                                                                                                        3⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:1812
                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy
                                                                                                        3⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:976
                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.callingshellapp_cw5n1h2txyewy
                                                                                                        3⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:1220
                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.capturepicker_cw5n1h2txyewy
                                                                                                        3⤵
                                                                                                          PID:5244
                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.cloudexperiencehost_cw5n1h2txyewy
                                                                                                          3⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:5260
                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.contentdeliverymanager_cw5n1h2txyewy
                                                                                                          3⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:5336
                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.narratorquickstart_8wekyb3d8bbwe
                                                                                                          3⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:5416
                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy
                                                                                                          3⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:5660
                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy
                                                                                                          3⤵
                                                                                                            PID:5808
                                                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.parentalcontrols_cw5n1h2txyewy
                                                                                                            3⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5752
                                                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.peopleexperiencehost_cw5n1h2txyewy
                                                                                                            3⤵
                                                                                                              PID:5832
                                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.pinningconfirmationdialog_cw5n1h2txyewy
                                                                                                              3⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:5880
                                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.search_cw5n1h2txyewy
                                                                                                              3⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:5904
                                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy
                                                                                                              3⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:5984
                                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.shellexperiencehost_cw5n1h2txyewy
                                                                                                              3⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:6016
                                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy
                                                                                                              3⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:6052
                                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.xgpuejectdialog_cw5n1h2txyewy
                                                                                                              3⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:6100
                                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.xboxgamecallableui_cw5n1h2txyewy
                                                                                                              3⤵
                                                                                                                PID:3208
                                                                                                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.client.cbs_cw5n1h2txyewy
                                                                                                                3⤵
                                                                                                                  PID:3068
                                                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.undockeddevkit_cw5n1h2txyewy
                                                                                                                  3⤵
                                                                                                                    PID:1192
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=ncsiuwpapp_8wekyb3d8bbwe
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1220
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=windows.cbspreview_cw5n1h2txyewy
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:5232
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=windows.printdialog_cw5n1h2txyewy
                                                                                                                    3⤵
                                                                                                                      PID:5320
                                                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=windows_ie_ac_001
                                                                                                                      3⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:5316
                                                                                                                  • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                                                                                    "c:\program files (x86)\premieropinion\pmropn.exe" -installmenu:PremierOpinion -v:NONE
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:1960
                                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:4064
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_Delta V3.61.zip\Delta V3.61\Delta.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Temp1_Delta V3.61.zip\Delta V3.61\Delta.exe"
                                                                                                                    1⤵
                                                                                                                    • Loads dropped DLL
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:5376
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 1576
                                                                                                                      2⤵
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Program crash
                                                                                                                      PID:5740
                                                                                                                  • C:\Windows\system32\wbem\unsecapp.exe
                                                                                                                    C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                                                    1⤵
                                                                                                                    • Loads dropped DLL
                                                                                                                    PID:5432
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5376 -ip 5376
                                                                                                                    1⤵
                                                                                                                      PID:5716
                                                                                                                    • C:\Users\Admin\Downloads\Delta V3.61\Delta V3.61\Delta.exe
                                                                                                                      "C:\Users\Admin\Downloads\Delta V3.61\Delta V3.61\Delta.exe"
                                                                                                                      1⤵
                                                                                                                      • Loads dropped DLL
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:6132
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/4TfpR6wUUu
                                                                                                                        2⤵
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:5232
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffc687a3cb8,0x7ffc687a3cc8,0x7ffc687a3cd8
                                                                                                                          3⤵
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:5204
                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                      1⤵
                                                                                                                      • Loads dropped DLL
                                                                                                                      PID:3036
                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks system information in the registry
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      PID:2236
                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Mjg1RUUxQ0YtNTg5Ni00NjZBLUEwMTgtRTEyQjUzMjAwRURFfSIgdXNlcmlkPSJ7MTVGNERFNjktQTU1RC00Mjg1LUFCQjItOEI5QzcwN0FBRjAyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCM0NEODg2Ni04QTFCLTQ4NUQtODU4Ni0xMEZCN0UwNUZBOTF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg1MjQ4ODI3NjUiLz48L2FwcD48L3JlcXVlc3Q-
                                                                                                                        2⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Checks system information in the registry
                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                        PID:3288
                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A7B0D10F-F2FC-4910-A205-DA84B3BBD619}\MicrosoftEdge_X64_130.0.2849.80.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A7B0D10F-F2FC-4910-A205-DA84B3BBD619}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                                                                        2⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:3744
                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A7B0D10F-F2FC-4910-A205-DA84B3BBD619}\EDGEMITMP_15B56.tmp\setup.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A7B0D10F-F2FC-4910-A205-DA84B3BBD619}\EDGEMITMP_15B56.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A7B0D10F-F2FC-4910-A205-DA84B3BBD619}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                                                                          3⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          PID:2160
                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A7B0D10F-F2FC-4910-A205-DA84B3BBD619}\EDGEMITMP_15B56.tmp\setup.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A7B0D10F-F2FC-4910-A205-DA84B3BBD619}\EDGEMITMP_15B56.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A7B0D10F-F2FC-4910-A205-DA84B3BBD619}\EDGEMITMP_15B56.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7ca4ad730,0x7ff7ca4ad73c,0x7ff7ca4ad748
                                                                                                                            4⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:6048
                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Mjg1RUUxQ0YtNTg5Ni00NjZBLUEwMTgtRTEyQjUzMjAwRURFfSIgdXNlcmlkPSJ7MTVGNERFNjktQTU1RC00Mjg1LUFCQjItOEI5QzcwN0FBRjAyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxMDdERDQzQy03OTJDLTQwNzctQkI4OC0wQ0IzMkM5MTEwNER9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMzAuMC4yODQ5LjgwIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NTMyNTMyOTg1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODUzMjY0MzAwNiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg5NzcxNDY5MjUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzI3Y2I3MjlkLWZmOTQtNGQzNC1hYWU0LTMzODVmYTA5YzQ0Yz9QMT0xNzMxOTE0NTk0JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWJSWFclMmIyR1BkcUwlMmYwbXd3VEtNbzBBRjdhc2FZWFBrWFo1MXE3UFZtbWlmMW9RRU8lMmJOUDN4N3ROQyUyYjRtNXU0VGc3UmViUFppZ2xVaFZONyUyZlA5RTJpUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3NTA3NjkyMCIgdG90YWw9IjE3NTA3NjkyMCIgZG93bmxvYWRfdGltZV9tcz0iMzY4MDQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4OTc3Mjc3MDg4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODk5NzY4NzAzMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTY1ODY4NzA2NiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM1MiIgZG93bmxvYWRfdGltZV9tcz0iNDQ0NTgiIGRvd25sb2FkZWQ9IjE3NTA3NjkyMCIgdG90YWw9IjE3NTA3NjkyMCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNjYwOTgiLz48L2FwcD48L3JlcXVlc3Q-
                                                                                                                        2⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Checks system information in the registry
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                        PID:5492
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5600 -ip 5600
                                                                                                                      1⤵
                                                                                                                        PID:1712
                                                                                                                      • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                        "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
                                                                                                                        1⤵
                                                                                                                          PID:1460
                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Checks system information in the registry
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:5864
                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{270D9AAF-E985-4207-A9FD-0260FEBA7AA0}\MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{270D9AAF-E985-4207-A9FD-0260FEBA7AA0}\MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe" /update /sessionid "{72D5926B-70BE-44A2-BD7E-B8BC5C1314FD}"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:5044
                                                                                                                            • C:\Program Files (x86)\Microsoft\Temp\EU95D2.tmp\MicrosoftEdgeUpdate.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Temp\EU95D2.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{72D5926B-70BE-44A2-BD7E-B8BC5C1314FD}"
                                                                                                                              3⤵
                                                                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Checks system information in the registry
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:3640
                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Modifies registry class
                                                                                                                                PID:1464
                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Modifies registry class
                                                                                                                                PID:2368
                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                                                  5⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Modifies registry class
                                                                                                                                  PID:5852
                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                                                  5⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Modifies registry class
                                                                                                                                  PID:1100
                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                                                  5⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Modifies registry class
                                                                                                                                  PID:5272
                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzJENTkyNkItNzBCRS00NEEyLUJEN0UtQjhCQzVDMTMxNEZEfSIgdXNlcmlkPSJ7MTVGNERFNjktQTU1RC00Mjg1LUFCQjItOEI5QzcwN0FBRjAyfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7OUIyREI4QkItRDMzMC00MzIxLUJDQ0YtOTIzQTJGOTgzOTE4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMzUiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzEzMDk3OTIiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExODQxNTY4NjkzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Checks system information in the registry
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                PID:2124
                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzJENTkyNkItNzBCRS00NEEyLUJEN0UtQjhCQzVDMTMxNEZEfSIgdXNlcmlkPSJ7MTVGNERFNjktQTU1RC00Mjg1LUFCQjItOEI5QzcwN0FBRjAyfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins5NzA2MzY4Ni1DNjBELTQwQ0YtOUJCNC01RUExNEY3MDRGMkR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTcxLjM5IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4zNSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNTU0NDc4OTY4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNTU0NzkwODI3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTgyNDM4MTIxOSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzY4ZDU3N2EwLTFmNGEtNDM0Zi1iZGNlLTE0OGVkYzFlNGE0MD9QMT0xNzMxOTE0ODk3JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWNsWXhpakFETk1lZ2YyRUh4ZURTWVpPVERDSUJIWll4WW9sbDRNNUlSVEVXWVdid1RTdlo3YlZSbXZoSGk0aGFpJTJiODZYTFJJbU8yclolMmJuRXR2M2NiZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExODI0MzgxMjE5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy82OGQ1NzdhMC0xZjRhLTQzNGYtYmRjZS0xNDhlZGMxZTRhNDA_UDE9MTczMTkxNDg5NyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1jbFl4aWpBRE5NZWdmMkVIeGVEU1laT1REQ0lCSFpZeFlvbGw0TTVJUlRFV1lXYndUU3ZaN2JWUm12aEhpNGhhaSUyYjg2WExSSW1PMnJaJTJibkV0djNjYmclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNjM1OTIwIiB0b3RhbD0iMTYzNTkyMCIgZG93bmxvYWRfdGltZV9tcz0iMjI2MzciLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE4MjQzODEyMTkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE4Mjk1Mzc5OTIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48cGluZyByPSItMSIgcmQ9Ii0xIi8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkwLjAuODE4LjY2IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzc1NzgzMTkyMzkzMTc4MCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9Ii0xIiByPSItMSIgYWQ9Ii0xIiByZD0iLTEiLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTMwLjAuMjg0OS44MCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIHVwZGF0ZV9jb3VudD0iMSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSItMSIgcmQ9Ii0xIiBwaW5nX2ZyZXNobmVzcz0ie0NCNTlFMDRFLTQzRTgtNDVBMC1CRjcwLTk5NUZGRDVFMzBFNX0iLz48L2FwcD48L3JlcXVlc3Q-
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Checks system information in the registry
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                            PID:440
                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Checks system information in the registry
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2728
                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0MwMzEwQkQtQzVBOC00NjEwLThEMUItOTVFM0ZFNTkwMEVFfSIgdXNlcmlkPSJ7MTVGNERFNjktQTU1RC00Mjg1LUFCQjItOEI5QzcwN0FBRjAyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OEEzQjU3MDgtNkZCQS00MTE3LThBODMtOTE1MzJFMThFQ0E2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7bGhWaTEyUWNrNlNsMHVVMU9CNlkxNTI5YlI2YnNleTQrY3U3ZEh4czZjaz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjM0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MjgzMDM2MzciIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM3Mjc3NjQyOTcwMTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNTAwNjU2MjYxNCIvPjwvYXBwPjwvcmVxdWVzdD4
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Checks system information in the registry
                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                            PID:1092
                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1CE78A66-78E8-436E-BA00-8FD03D191FF0}\MicrosoftEdge_X64_130.0.2849.80.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1CE78A66-78E8-436E-BA00-8FD03D191FF0}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                                                                                            2⤵
                                                                                                                              PID:5064
                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1CE78A66-78E8-436E-BA00-8FD03D191FF0}\EDGEMITMP_9A4E0.tmp\setup.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1CE78A66-78E8-436E-BA00-8FD03D191FF0}\EDGEMITMP_9A4E0.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1CE78A66-78E8-436E-BA00-8FD03D191FF0}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                                                                                                3⤵
                                                                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                • Installs/modifies Browser Helper Object
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                • System policy modification
                                                                                                                                PID:4340
                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1CE78A66-78E8-436E-BA00-8FD03D191FF0}\EDGEMITMP_9A4E0.tmp\setup.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1CE78A66-78E8-436E-BA00-8FD03D191FF0}\EDGEMITMP_9A4E0.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1CE78A66-78E8-436E-BA00-8FD03D191FF0}\EDGEMITMP_9A4E0.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff71fb6d730,0x7ff71fb6d73c,0x7ff71fb6d748
                                                                                                                                  4⤵
                                                                                                                                    PID:4896
                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1CE78A66-78E8-436E-BA00-8FD03D191FF0}\EDGEMITMP_9A4E0.tmp\setup.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1CE78A66-78E8-436E-BA00-8FD03D191FF0}\EDGEMITMP_9A4E0.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                                                                                                                                    4⤵
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    PID:808
                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1CE78A66-78E8-436E-BA00-8FD03D191FF0}\EDGEMITMP_9A4E0.tmp\setup.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1CE78A66-78E8-436E-BA00-8FD03D191FF0}\EDGEMITMP_9A4E0.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1CE78A66-78E8-436E-BA00-8FD03D191FF0}\EDGEMITMP_9A4E0.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff71fb6d730,0x7ff71fb6d73c,0x7ff71fb6d748
                                                                                                                                      5⤵
                                                                                                                                        PID:5952
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                                                                                                                                      4⤵
                                                                                                                                        PID:1360
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff66884d730,0x7ff66884d73c,0x7ff66884d748
                                                                                                                                          5⤵
                                                                                                                                            PID:1744
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
                                                                                                                                          4⤵
                                                                                                                                            PID:4600
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff66884d730,0x7ff66884d73c,0x7ff66884d748
                                                                                                                                              5⤵
                                                                                                                                                PID:2464
                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0MwMzEwQkQtQzVBOC00NjEwLThEMUItOTVFM0ZFNTkwMEVFfSIgdXNlcmlkPSJ7MTVGNERFNjktQTU1RC00Mjg1LUFCQjItOEI5QzcwN0FBRjAyfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InswMDNCNzM5Ri1BRTZDLTRCMDgtODM5Ri0yRjRENDMxNjI5NjJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjM1IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9IklzT25JbnRlcnZhbENvbW1hbmRzQWxsb3dlZD0lNUIlMjItdGFyZ2V0X2RldiUyMC1taW5fYnJvd3Nlcl92ZXJzaW9uX2NhbmFyeV9kZXYlMjAxMzEuMC4yODcxLjAlMjIlNUQiIGluc3RhbGxhZ2U9IjAiIGNvaG9ydD0icnJmQDAuODQiPjx1cGRhdGVjaGVjay8-PHBpbmcgcmQ9IjY1MjQiIHBpbmdfZnJlc2huZXNzPSJ7Q0RFRTQwOTktMzA0Qy00RUM5LTk1RTgtMEIzOTYxN0Y0RUEyfSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5MC4wLjgxOC42NiIgbmV4dHZlcnNpb249IjEzMC4wLjI4NDkuODAiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzc1NzgzMTkyMzkzMTc4MCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTUwMTk2ODc1MjIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTUwMTk4NDM3MzciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTUwNDg0MDY3MTkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTUwNjIzMTI3NjkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjE1NTg2NjU4OTgxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNzk3IiBkb3dubG9hZGVkPSIxNzUwNzY5MjAiIHRvdGFsPSIxNzUwNzY5MjAiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIyIiBpbnN0YWxsX3RpbWVfbXM9IjUyNDE5Ii8-PHBpbmcgYWN0aXZlPSIwIiByZD0iNjUyNCIgcGluZ19mcmVzaG5lc3M9Ins4OTBBMDlGQS0xM0JCLTQ2MjAtQkZGMS0wNTYxMTI2NDI2RUZ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEzMC4wLjI4NDkuODAiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBjb2hvcnQ9InJyZkAwLjM1IiB1cGRhdGVfY291bnQ9IjEiPjx1cGRhdGVjaGVjay8-PHBpbmcgcmQ9IjY1MjQiIHBpbmdfZnJlc2huZXNzPSJ7NjkzOTJFNEUtQjQ2Ni00NzFBLUI2NDMtMzcyMDBDRjNCMDREfSIvPjwvYXBwPjwvcmVxdWVzdD4
                                                                                                                                          2⤵
                                                                                                                                          • Checks system information in the registry
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                          PID:5664

                                                                                                                                      Network

                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                      Reconnaissance

                                                                                                                                      Resource Development

                                                                                                                                      Initial Access

                                                                                                                                      Phishing

                                                                                                                                      1
                                                                                                                                      T1566

                                                                                                                                      Execution

                                                                                                                                      Persistence

                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                      1
                                                                                                                                      T1547

                                                                                                                                      Active Setup

                                                                                                                                      1
                                                                                                                                      T1547.014

                                                                                                                                      Browser Extensions

                                                                                                                                      1
                                                                                                                                      T1176

                                                                                                                                      Event Triggered Execution

                                                                                                                                      2
                                                                                                                                      T1546

                                                                                                                                      Component Object Model Hijacking

                                                                                                                                      1
                                                                                                                                      T1546.015

                                                                                                                                      Image File Execution Options Injection

                                                                                                                                      1
                                                                                                                                      T1546.012

                                                                                                                                      Privilege Escalation

                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                      1
                                                                                                                                      T1547

                                                                                                                                      Active Setup

                                                                                                                                      1
                                                                                                                                      T1547.014

                                                                                                                                      Event Triggered Execution

                                                                                                                                      2
                                                                                                                                      T1546

                                                                                                                                      Component Object Model Hijacking

                                                                                                                                      1
                                                                                                                                      T1546.015

                                                                                                                                      Image File Execution Options Injection

                                                                                                                                      1
                                                                                                                                      T1546.012

                                                                                                                                      Defense Evasion

                                                                                                                                      Modify Registry

                                                                                                                                      5
                                                                                                                                      T1112

                                                                                                                                      Subvert Trust Controls

                                                                                                                                      2
                                                                                                                                      T1553

                                                                                                                                      Install Root Certificate

                                                                                                                                      1
                                                                                                                                      T1553.004

                                                                                                                                      SIP and Trust Provider Hijacking

                                                                                                                                      1
                                                                                                                                      T1553.003

                                                                                                                                      Credential Access

                                                                                                                                      Credentials from Password Stores

                                                                                                                                      1
                                                                                                                                      T1555

                                                                                                                                      Credentials from Web Browsers

                                                                                                                                      1
                                                                                                                                      T1555.003

                                                                                                                                      Unsecured Credentials

                                                                                                                                      1
                                                                                                                                      T1552

                                                                                                                                      Credentials In Files

                                                                                                                                      1
                                                                                                                                      T1552.001

                                                                                                                                      Discovery

                                                                                                                                      Browser Information Discovery

                                                                                                                                      1
                                                                                                                                      T1217

                                                                                                                                      Network Share Discovery

                                                                                                                                      1
                                                                                                                                      T1135

                                                                                                                                      Password Policy Discovery

                                                                                                                                      1
                                                                                                                                      T1201

                                                                                                                                      Peripheral Device Discovery

                                                                                                                                      2
                                                                                                                                      T1120

                                                                                                                                      Query Registry

                                                                                                                                      6
                                                                                                                                      T1012

                                                                                                                                      System Information Discovery

                                                                                                                                      6
                                                                                                                                      T1082

                                                                                                                                      System Location Discovery

                                                                                                                                      1
                                                                                                                                      T1614

                                                                                                                                      System Language Discovery

                                                                                                                                      1
                                                                                                                                      T1614.001

                                                                                                                                      System Network Configuration Discovery

                                                                                                                                      1
                                                                                                                                      T1016

                                                                                                                                      Internet Connection Discovery

                                                                                                                                      1
                                                                                                                                      T1016.001

                                                                                                                                      Lateral Movement

                                                                                                                                      Collection

                                                                                                                                      Data from Local System

                                                                                                                                      1
                                                                                                                                      T1005

                                                                                                                                      Command and Control

                                                                                                                                      Web Service

                                                                                                                                      1
                                                                                                                                      T1102

                                                                                                                                      Exfiltration

                                                                                                                                      Impact

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • C:\PROGRA~2\PREMIE~1\RData.reg
                                                                                                                                        Filesize

                                                                                                                                        3KB

                                                                                                                                        MD5

                                                                                                                                        bac045fa2209f06c4483831e685ebb33

                                                                                                                                        SHA1

                                                                                                                                        cc295497e2e39057fa89b6a578559be59882b8b7

                                                                                                                                        SHA256

                                                                                                                                        23f8d6e43e9ac9001328020a07dcc8184f79973f4f5c8f75f8e1e0650033329f

                                                                                                                                        SHA512

                                                                                                                                        0e23d40e4d06c473948e7d462ffb3ae71f749812fdebbef1f2f94220698ff6c26405c3315bde5890abdd29d5a585602462fb607e98fd65ee1cbcf9de623c5498

                                                                                                                                        Download Submit

                                                                                                                                      • C:\PROGRA~2\PREMIE~1\snt.dat
                                                                                                                                        Filesize

                                                                                                                                        3.1MB

                                                                                                                                        MD5

                                                                                                                                        39d79081d053c786328f09ccb448030f

                                                                                                                                        SHA1

                                                                                                                                        e5901cfedf9566a3b6ae8c37621e6f7fee62c56c

                                                                                                                                        SHA256

                                                                                                                                        5e139d6b4d66b6c1dcaad36701ecef1098876de33c1c45adafa5e76e960445b0

                                                                                                                                        SHA512

                                                                                                                                        d26032ff9b364f5d69fbe6f073659092eec6e90a384d7889cdcfacd4640edd22e8c4ece1cfdc2bdcc3ea4d0b15f2c4f08cb6fc049d869ffc0c2790bd558e92a6

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Installer\setup.exe
                                                                                                                                        Filesize

                                                                                                                                        6.5MB

                                                                                                                                        MD5

                                                                                                                                        b621cf9d3506d2cd18dc516d9570cd9c

                                                                                                                                        SHA1

                                                                                                                                        f90ed12727015e78f07692cbcd9e3c0999a03c3a

                                                                                                                                        SHA256

                                                                                                                                        64050839b4a6f27d896e1194e902a2f7a3c1cab0ef864b558ab77f1be25145d6

                                                                                                                                        SHA512

                                                                                                                                        167c73cf457689f8ba031015c1e411545550f602919c35aff6fd4d602bd591d34e8c12887a946902b798bf4cf98aadfce3c2de810bf16c7c24a216bfd8abec19

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.35\MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe
                                                                                                                                        Filesize

                                                                                                                                        1.6MB

                                                                                                                                        MD5

                                                                                                                                        dc1543edd0dcd56536304bdf56ef93f1

                                                                                                                                        SHA1

                                                                                                                                        1a8b2c7791f2faa1eb0a98478edee1c45847075c

                                                                                                                                        SHA256

                                                                                                                                        ccbb3d9a4877999a55b2ca6b8128481e91c4b56780f581226f916c0fb2db0772

                                                                                                                                        SHA512

                                                                                                                                        2a6b4aa39bc3e4d234909077d5c6d75b9968c1778d505cc12431afd7aebd01eb65ed2f6f0c53c67f18eed7e97b67a93bab8c44574e3918ccd5cfcd8681767056

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1CE78A66-78E8-436E-BA00-8FD03D191FF0}\EDGEMITMP_9A4E0.tmp\SETUP.EX_
                                                                                                                                        Filesize

                                                                                                                                        2.6MB

                                                                                                                                        MD5

                                                                                                                                        958befee6afc25fa51e4bf538d0894c7

                                                                                                                                        SHA1

                                                                                                                                        70a2f157988f6cef27048bc2b3c81e8ab4b41552

                                                                                                                                        SHA256

                                                                                                                                        5422f0b35bac6fc926c6f537d42cfa4aaa7985e89e4e680acc467d804071a006

                                                                                                                                        SHA512

                                                                                                                                        7ecf452f007d849268b4cc2644ecb239b2a4309a80f4350dfb215f6fc34950cabf1bb233f43bc6678547931af7b427517ed8c88cd214aa0358122777a5a8cce2

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                                        Filesize

                                                                                                                                        201KB

                                                                                                                                        MD5

                                                                                                                                        4dc57ab56e37cd05e81f0d8aaafc5179

                                                                                                                                        SHA1

                                                                                                                                        494a90728d7680f979b0ad87f09b5b58f16d1cd5

                                                                                                                                        SHA256

                                                                                                                                        87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

                                                                                                                                        SHA512

                                                                                                                                        320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\PremierOpinion\cacert.pem
                                                                                                                                        Filesize

                                                                                                                                        3KB

                                                                                                                                        MD5

                                                                                                                                        77eb3ade4c5b0db67c6e8a26f131073c

                                                                                                                                        SHA1

                                                                                                                                        ad9e8c00174cc2e707f59df671f89a9d7fc2ffc7

                                                                                                                                        SHA256

                                                                                                                                        9f19e7a7139cca8373b516ab1ae49c644aa1c8048e8c7aa5784774a081dcbb87

                                                                                                                                        SHA512

                                                                                                                                        20eb7d34c80bb8d8a415bcdccf8e46cb36396c095ed1468b69c0cb91da915e3a14c7fd55247f68e64ff71cf8d336cc286c3662710ca6281840fdc2f1eb7ac6a1

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\PremierOpinion\pmls.dll
                                                                                                                                        Filesize

                                                                                                                                        885KB

                                                                                                                                        MD5

                                                                                                                                        50a0c6c01cdc5d2690ccd1f1541f6670

                                                                                                                                        SHA1

                                                                                                                                        c5e017a468efb70eabb1f861784edac62acb0e17

                                                                                                                                        SHA256

                                                                                                                                        f9a853830949bb22d6f4d128d71a0ab923d9b5549c0dc8785c7de7d1a4eabf99

                                                                                                                                        SHA512

                                                                                                                                        028d5a56c581d3751628c7503e83aa52c332678495943c3648049ae0b26a7190e98395ad205cf60896140d1a802c14a346a2d1553e7b53090c3f5beefd66e9b1

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\PremierOpinion\pmls64.dll
                                                                                                                                        Filesize

                                                                                                                                        1.1MB

                                                                                                                                        MD5

                                                                                                                                        aa56cb7fd83150c3a75cd6a0de97eb78

                                                                                                                                        SHA1

                                                                                                                                        34415c5c8e57cfe9a7b4a498eacfe1403f3191ec

                                                                                                                                        SHA256

                                                                                                                                        034e066829d28bbc81604250f6df721a35ab1c0898ab82bef6305ffada240765

                                                                                                                                        SHA512

                                                                                                                                        765f12e5e060db934d0f4e8159bb9bd10cdbe797d79488a0dc88215a73e49101e279ca69e10c1775a5e161bb4dd02585724c7c87bbefdcdd047adb4277804fa2

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\PremierOpinion\pmph.dll
                                                                                                                                        Filesize

                                                                                                                                        807KB

                                                                                                                                        MD5

                                                                                                                                        9d96ccb0d5ab5541b61d5c138d91796f

                                                                                                                                        SHA1

                                                                                                                                        cf3ee3e66c8f9c23e3efd29978215461347e650d

                                                                                                                                        SHA256

                                                                                                                                        379a1f1f02c8cb704f248c2f1ff79c8986f73c350a3bf6d9bbc93aeacd286e36

                                                                                                                                        SHA512

                                                                                                                                        69ca7d96896d872eefa63f0c0bd9613526a914e99c4cf12b5d221315277aa64894d99d0f5ce9c5e0ef640d61c9202cd3d51ddb2ab4c55f8fdf60d24a8c1ff6ac

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\PremierOpinion\pmropn.exe
                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                        MD5

                                                                                                                                        f27f98c1a877f9ca6f06c23bed4014ca

                                                                                                                                        SHA1

                                                                                                                                        25a231319659c30d6f86a5c9cdd1747d7c471542

                                                                                                                                        SHA256

                                                                                                                                        1ed47933c9f33c4860ecc0bf1ba7525212aa00054037a9a51a8d8f5ce3b821bd

                                                                                                                                        SHA512

                                                                                                                                        f054a618d2f8e7a829c26548312b436e21058ee1ff64b40e7c19be2bde037003c21332af3c60e2fd92675af80526ef6faf84b8c1d7a095bb2c4d0b799e66599c

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\PremierOpinion\pmropn32.exe
                                                                                                                                        Filesize

                                                                                                                                        245KB

                                                                                                                                        MD5

                                                                                                                                        6e4d6b68e9565c4cc7791b00c2094ff9

                                                                                                                                        SHA1

                                                                                                                                        965a00a5a8bb05b35fbaa357951779ea3b71e392

                                                                                                                                        SHA256

                                                                                                                                        65d6f18e1b366aff5343c3f6628041329e7c1375d18ba57076b19bf5f48bc483

                                                                                                                                        SHA512

                                                                                                                                        0cb1396822c7350057cfc7280e1c67ccf1e1a2206347a10025e285f00e9364563685ba5282775960a9329511fd321a631222c87ae7ca8106eca00fb78722b20f

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\PremierOpinion\pmropn64.exe
                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                        MD5

                                                                                                                                        ae5bbcc69b05359d0d5cc72ca6a1262e

                                                                                                                                        SHA1

                                                                                                                                        6843bd883d50216be44065411a983a4bcccdcc91

                                                                                                                                        SHA256

                                                                                                                                        12bfd1007634138b22c56ead24db02a1fe3a4d4b7fe04d30cd07a0ff5d4c8425

                                                                                                                                        SHA512

                                                                                                                                        6417aaeb4ccd86504bc1f83e32c91a60920e98fff833c02fdbef974819a3288cab0c96d6b114ceed4432c305d49120cacbc7e0da69c911f4035aadfbec7a91de

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                        MD5

                                                                                                                                        b68e7f7ae52ef8e962723c7ddda4f75d

                                                                                                                                        SHA1

                                                                                                                                        686bdf2057cdd7b16877fb5eec0aff150fa074d0

                                                                                                                                        SHA256

                                                                                                                                        d779b2acc52b4b3e72c1461dbc7e950f0b650e924b3799db425942f64624e94d

                                                                                                                                        SHA512

                                                                                                                                        cb0ecf531c95d657019b0188e648520b36b8386516d2e640239d99972ae44439d21ec6fcbe7902fc59c6f65db3571db0944e48f2207a442f3be5d10c9655bbb1

                                                                                                                                        Download Submit

                                                                                                                                      • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                                                                                                                        Filesize

                                                                                                                                        14KB

                                                                                                                                        MD5

                                                                                                                                        d54b5c811a779858bf408d63121043b6

                                                                                                                                        SHA1

                                                                                                                                        8cacfafe58581b076d5345cc46c90f5b6d4789d2

                                                                                                                                        SHA256

                                                                                                                                        7abcf21ea92b08321f50283af7475cde57a099cc69c9a676950d249a6c9a8596

                                                                                                                                        SHA512

                                                                                                                                        48866a8bf614f9f86a64f07bb3d65c6416152705435553499dff57687267656dcb5a3edd4acfac91af1fe43c7cc40df6dca5eef06644b5fa17018f81f9483da8

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        67e486b2f148a3fca863728242b6273e

                                                                                                                                        SHA1

                                                                                                                                        452a84c183d7ea5b7c015b597e94af8eef66d44a

                                                                                                                                        SHA256

                                                                                                                                        facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

                                                                                                                                        SHA512

                                                                                                                                        d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                                                                                                                                        Filesize

                                                                                                                                        436B

                                                                                                                                        MD5

                                                                                                                                        971c514f84bba0785f80aa1c23edfd79

                                                                                                                                        SHA1

                                                                                                                                        732acea710a87530c6b08ecdf32a110d254a54c8

                                                                                                                                        SHA256

                                                                                                                                        f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

                                                                                                                                        SHA512

                                                                                                                                        43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                                                                                                        Filesize

                                                                                                                                        174B

                                                                                                                                        MD5

                                                                                                                                        04d68a878a1114a69a74fc3c2c268506

                                                                                                                                        SHA1

                                                                                                                                        e73482e85f76a00e763644d137ab884366e48cd0

                                                                                                                                        SHA256

                                                                                                                                        d936ae2422ee09392f3db3fb05ac383c00c56559a5a041c6fd757225efba088c

                                                                                                                                        SHA512

                                                                                                                                        3f9b10d642d378db3f8acd1b3e1ca91f92cfe2794a3808f68d572e3939aeb6fc5ac9ee1b717acd9e1cd255ceaf6b6f6d059fc9d281636aad9822665cd7e5d41d

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                                                                                                                                        Filesize

                                                                                                                                        170B

                                                                                                                                        MD5

                                                                                                                                        244a0c13590fe89513a686f53e34c4f8

                                                                                                                                        SHA1

                                                                                                                                        a838846844b239a72d85a4c6ee393cbc702e9801

                                                                                                                                        SHA256

                                                                                                                                        e2d7ada655ba66432b3ca19b1c241574d6dc578a3ce4488ea896bf7c0a23428c

                                                                                                                                        SHA512

                                                                                                                                        a7f8e13b895e2baf8d704742bc1a472eaf64adf84287b5d514970321db410c047208ba0db52d3d878e20c35b9f23c561fd5c6fa61062238c6fc09d13fede9c14

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\D3DSCache\3231ae299a0af0b2\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        MD5

                                                                                                                                        0083b29045af4f4d3ecd49f5fd541bfe

                                                                                                                                        SHA1

                                                                                                                                        83b92c5187e7b93298f86d83826c73da1098850c

                                                                                                                                        SHA256

                                                                                                                                        cc62ff55c91b10f17b0543d59486a3fb907d7be658043a3b23ece70dbfac797d

                                                                                                                                        SHA512

                                                                                                                                        006257f5be6341184434d071f7c38984d9f1aee74602475f38ca0637c66a5169856e21603d758c3f3a47fbf1aa65aa5f798e2e49b598f75147c4fd47207bbc51

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\D3DSCache\3231ae299a0af0b2\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                        Filesize

                                                                                                                                        4B

                                                                                                                                        MD5

                                                                                                                                        f49655f856acb8884cc0ace29216f511

                                                                                                                                        SHA1

                                                                                                                                        cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                                                        SHA256

                                                                                                                                        7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                                                        SHA512

                                                                                                                                        599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\D3DSCache\3231ae299a0af0b2\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                        Filesize

                                                                                                                                        992B

                                                                                                                                        MD5

                                                                                                                                        2e56822cad031b72223f47167d62bf5b

                                                                                                                                        SHA1

                                                                                                                                        1403ee99a61e9ae9d15a22106700044e30873b91

                                                                                                                                        SHA256

                                                                                                                                        8200a2554862473fb558df7f62dea2553e92d883ff9c808aba22d7c9572185fa

                                                                                                                                        SHA512

                                                                                                                                        852b024b63259d5a6b6690f94761faed40bac758662f23496fb1c3839e99062fe37d6487b423cf1d145265e1bbdfb3d4bda37b3e74eaa136bd5b8e61838d5817

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                        Filesize

                                                                                                                                        152B

                                                                                                                                        MD5

                                                                                                                                        aad1d98ca9748cc4c31aa3b5abfe0fed

                                                                                                                                        SHA1

                                                                                                                                        32e8d4d9447b13bc00ec3eb15a88c55c29489495

                                                                                                                                        SHA256

                                                                                                                                        2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

                                                                                                                                        SHA512

                                                                                                                                        150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                        Filesize

                                                                                                                                        152B

                                                                                                                                        MD5

                                                                                                                                        cb557349d7af9d6754aed39b4ace5bee

                                                                                                                                        SHA1

                                                                                                                                        04de2ac30defbb36508a41872ddb475effe2d793

                                                                                                                                        SHA256

                                                                                                                                        cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

                                                                                                                                        SHA512

                                                                                                                                        f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ed214b9-dd1c-4a70-990b-82d65487b6ac.tmp
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        84a304a8a11790a30d3ba8b1f58a3f11

                                                                                                                                        SHA1

                                                                                                                                        2012638c8c2b7a7153653d1e7b184302fb0f67b8

                                                                                                                                        SHA256

                                                                                                                                        ef719a732f04e1ddabb06584765cbfb63daf45341bd311a60a037a49978684b4

                                                                                                                                        SHA512

                                                                                                                                        3f03435c87d6df18f4a02b82068b2f47198ae4b6eb2b524c3c8e62ef47d82b79d74367d15425f70bbe199055af40e9fb2d7e6b39bcd306c49745ee21e9ec6aa5

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                        MD5

                                                                                                                                        51da7ce00c201752e3703845ff55bf5e

                                                                                                                                        SHA1

                                                                                                                                        b4a1dc1eb28945b6c7eccfbe8920918c168e81d5

                                                                                                                                        SHA256

                                                                                                                                        120c5e791aa9f91ddb99fe3ea88c83b7f1f60caf8336307af747439e56bb8967

                                                                                                                                        SHA512

                                                                                                                                        6602f1860b4178ac3fb4d90f43dc36929f4b3b76ae2ae800f830964a0521c41fbce6675e469146c5a909196df302ab9a5a99417be628078573037091ae6c1e34

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035
                                                                                                                                        Filesize

                                                                                                                                        92KB

                                                                                                                                        MD5

                                                                                                                                        97b9940ce8ba7b3f3eda7bb55435f3d7

                                                                                                                                        SHA1

                                                                                                                                        b1f6aec1ccde480c2901c791c678fdafd8e2c7fe

                                                                                                                                        SHA256

                                                                                                                                        d96902ab2818db4cc66aa586715f1bea2b011d51dd5b90cb05b20b0decb58e2f

                                                                                                                                        SHA512

                                                                                                                                        01eee053051102b2f2c2f640cfe136d744380bfaea62caa63c84f63c85283a430fc48f4bee0ed3c9c0ffe441a2ae265ca670ed050f6cd05e2338208fc250c47d

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000104
                                                                                                                                        Filesize

                                                                                                                                        51KB

                                                                                                                                        MD5

                                                                                                                                        588ee33c26fe83cb97ca65e3c66b2e87

                                                                                                                                        SHA1

                                                                                                                                        842429b803132c3e7827af42fe4dc7a66e736b37

                                                                                                                                        SHA256

                                                                                                                                        bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

                                                                                                                                        SHA512

                                                                                                                                        6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000112
                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                        MD5

                                                                                                                                        da5705f4ae30d837139cb7380d941e1b

                                                                                                                                        SHA1

                                                                                                                                        08ae6cb9b2703df17b2bf554586a36f4b73502a6

                                                                                                                                        SHA256

                                                                                                                                        9f205a55a45a2a45d2ebb98afb21499b191a4b2e26f4311568d0337b32faa1ca

                                                                                                                                        SHA512

                                                                                                                                        f3042947d05222aff5facc14ac6123380d502435e98608dc6d053848997cdd0fb22b121a381e67df893c15ae14ed836a58fca5898540ea5dfb0a0da32ed8dbef

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        476c9d3258a0e50aa31a0b6fe56e422f

                                                                                                                                        SHA1

                                                                                                                                        dfeff3661a3aa55439b1d74434d313d462697f47

                                                                                                                                        SHA256

                                                                                                                                        b636ea4b27a8a3d30342af376730834f2e76655e05f3035f85f4392a170d1393

                                                                                                                                        SHA512

                                                                                                                                        a607a192f1b356a345a0c754c7bd72e40a6b9f02bfdd3fd2cb76913be75f11d3376f6ea9253b1f19498e5fce151bad2564ecd307be53e846342a55c20081045d

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        MD5

                                                                                                                                        3048840113eceabe72e09d36be5a1cd9

                                                                                                                                        SHA1

                                                                                                                                        4bb7b3c28c63c4aaca203ff62183c1365012d8d9

                                                                                                                                        SHA256

                                                                                                                                        5d32c573dd7e14597934257ef90ad66365f1f527001bbaf7c0008f8d17649266

                                                                                                                                        SHA512

                                                                                                                                        200fe519066df242c511ff433d0651267be00ed4baaef060ebf1ba37b5e672ee424b7f6ab8b7eab4b49664993fc298a190b10f477786f103dc848493d75b20f3

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        d58c631153869d4c8e5e7021d1df97bd

                                                                                                                                        SHA1

                                                                                                                                        961272f9f64b579e376a0ca4b6148991b062fe6f

                                                                                                                                        SHA256

                                                                                                                                        12a8d061bee3fa746593e2249d1a1c4a15eadc89d0592ac91da0343e66407027

                                                                                                                                        SHA512

                                                                                                                                        91968b1dec1a55bdb25ec656fcc92f2ba772f342979959be264793d901af6af555a40a943f636c1adf23e1106ca5dc1604cf899309e57d96c94f4a34142af66b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                        Filesize

                                                                                                                                        3KB

                                                                                                                                        MD5

                                                                                                                                        6f49a62853958965da4f997c8839f829

                                                                                                                                        SHA1

                                                                                                                                        1ac0cb9e9267123e07644b81ae80cb8ec30b0400

                                                                                                                                        SHA256

                                                                                                                                        14edf4dd9da508c5f0e32ee8d5b5289505a4444b270b67c19057ec3ef72e9675

                                                                                                                                        SHA512

                                                                                                                                        86e2921a43a488f525b870453b307365c12bbc747469c2ffad6511b99775ac9e2bb4580d1e0e55f9fbb9641df32bc409bd9725937159544c005d1fe6d172372d

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        d701a43904911036b5eb53384408a68d

                                                                                                                                        SHA1

                                                                                                                                        e1b1489578bec335996e6b6d69e8cbd97ffbc707

                                                                                                                                        SHA256

                                                                                                                                        5a06c7ae1f446cb114b5bd8f3aa5847521bd30a8172f32d481014a9b899856b7

                                                                                                                                        SHA512

                                                                                                                                        be95cbb4f872e6eccd72787f849ecb85f4dc0e33a1aa376b88592bb814bbbed9374023098f1bbf588f99a6360f80fedae4820e55e35353a4f1bfdb6223101124

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000008.ldb
                                                                                                                                        Filesize

                                                                                                                                        707B

                                                                                                                                        MD5

                                                                                                                                        7e1aa108d3b92c4dc915e1ae140a68ac

                                                                                                                                        SHA1

                                                                                                                                        6383f1c980845eb989ca70b974ed504374ffe25b

                                                                                                                                        SHA256

                                                                                                                                        c5394c73292465b0d48a60c23912583a4a2621da4050106cacc054e8848c26f6

                                                                                                                                        SHA512

                                                                                                                                        458a11ee015804a9894f7ba489fe91a974719ade8ca29f4a9350304b31aea00154a0823dbc4863604460d36350203cfcf73b9b0cb14579e4134d46f3447226aa

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
                                                                                                                                        Filesize

                                                                                                                                        16B

                                                                                                                                        MD5

                                                                                                                                        46295cac801e5d4857d09837238a6394

                                                                                                                                        SHA1

                                                                                                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                        SHA256

                                                                                                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                        SHA512

                                                                                                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
                                                                                                                                        Filesize

                                                                                                                                        753B

                                                                                                                                        MD5

                                                                                                                                        9077c5dfe7762d54e05759e9cfe64b78

                                                                                                                                        SHA1

                                                                                                                                        24dbd884bd5ef1bac8a7fb84d725db945af25b5a

                                                                                                                                        SHA256

                                                                                                                                        96f99162fe961619b7729362e2ed9e4550810e2ec3df6f91e7e552fa81e20271

                                                                                                                                        SHA512

                                                                                                                                        659d054c06a9d936733f16f8c2fdbc3ea982f7584432a22e1189c65a1413cfb063d48af315651423e96a4a3a4bd37c7305a703574bf417d1b881e6ee509b13bc

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
                                                                                                                                        Filesize

                                                                                                                                        752B

                                                                                                                                        MD5

                                                                                                                                        69d708f81d6708e9e39a2cc4da7baf97

                                                                                                                                        SHA1

                                                                                                                                        f666d379189ab41fd90c0b81a31277c4053efc30

                                                                                                                                        SHA256

                                                                                                                                        2d847857a74e2ed765de53315d60b50f20a91ac9c7b9988462d9e940c7c82a51

                                                                                                                                        SHA512

                                                                                                                                        e80c3682cc8d1e940900ab072acb5607a23c1238192594fe0e52e929cea47b2c39951587efac8732377e7b817d18f62319dddf97a2216bd38f9cac03d8db0b58

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5c0651.TMP
                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        baabcb796ad5cdec8fcf2c3dc1c3798b

                                                                                                                                        SHA1

                                                                                                                                        7b27b6e2250e68e77b08931cf48dc87731e79c0b

                                                                                                                                        SHA256

                                                                                                                                        bceda5ea4d9fc73e957dbc709eef7044d56b66a09ed1714f2f903d3339b1cfe9

                                                                                                                                        SHA512

                                                                                                                                        d7829c36885625f8d1f7ee265ef026b02160ce7c72845bd6a85e003af34492f0e1a49bb34b17640cf3fe197da02b9fd3d52c329e1d48a564a108b59a4ec04e6e

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        5c66534fb881fafa025311df59877635

                                                                                                                                        SHA1

                                                                                                                                        9b53187ab550bd82c6a4935ba0fc956f44b44a8c

                                                                                                                                        SHA256

                                                                                                                                        58cf3fbb67db33c9d674a19a638c7fb7f085545bfd3b4968590536fb0b451f0d

                                                                                                                                        SHA512

                                                                                                                                        11d8803085fce983d298e708340226131b2fc8b627596feecf3e9c7c4754ac95c4dc2d2f05a6dc5588ce48b97c34569dc9160543173c5001c166a55c843a9a27

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        192ad50877dac86c350fed8cbe66c920

                                                                                                                                        SHA1

                                                                                                                                        8124b924261ccffc4b29de336b7b9ffbefb307e8

                                                                                                                                        SHA256

                                                                                                                                        eefd43389d939414e028334e40dc200f49c47e3c5fa30a283a4503ccc0e078f3

                                                                                                                                        SHA512

                                                                                                                                        de3d385073e75dfdf08348709cc7eb5ee100e92383ea5d501bec213aa8081d7e8aff7a1f607d848286e06f754d1910128ed3a464cdd0e2ddfb5f02b1ab3dbfab

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                        Filesize

                                                                                                                                        6KB

                                                                                                                                        MD5

                                                                                                                                        b6656afd1599049207e61093c9830541

                                                                                                                                        SHA1

                                                                                                                                        955ea26e84ca366da45bc9c659c79878a90d52af

                                                                                                                                        SHA256

                                                                                                                                        683d60ce99647e7dbdfb1b234e546f36fe9506fad33e919b6cb64d62b1df8c0c

                                                                                                                                        SHA512

                                                                                                                                        a4c0ce6e7c236b909c7c2e0e2a3d0d5d982a8d4d0f7c3a12703587cf5891e1dc559adc77061489258b4f4925781df032bc3cabc08bc66d80700dedcfea20dc9f

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        Filesize

                                                                                                                                        8KB

                                                                                                                                        MD5

                                                                                                                                        41d7e4bc49982a130aaf789ff0e52918

                                                                                                                                        SHA1

                                                                                                                                        0ae7e7b0851db49c6893260fc08dae756ed083fd

                                                                                                                                        SHA256

                                                                                                                                        3f733c056b91107f0f41a82c196df5eee40b7b63caf4047295c63c19281716da

                                                                                                                                        SHA512

                                                                                                                                        dd7b4783671b833cc917f1334402d662f1bea1cf3a17ec4258fee4bbe3fe8a695d09e7feaff12337bb948d5a2d53383d4dd3967c99af1f2e0037aa9e8ab00b33

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        Filesize

                                                                                                                                        9KB

                                                                                                                                        MD5

                                                                                                                                        10e6ae2b4898be71ee40004ae3dba1d7

                                                                                                                                        SHA1

                                                                                                                                        6c7df7445e8e148d4dd785f5f3b864e2d4d91a90

                                                                                                                                        SHA256

                                                                                                                                        38638fd14f9b460b7864827f43d887ad037c14ff5d8b71099fad4d60b574b680

                                                                                                                                        SHA512

                                                                                                                                        a50b16cee941a4fbaa800b5577e4ae234f193f65f6548e60ae0d3bf94a44ba7b7d0ef6b434edac24d8cd08ab6aa2f80780624df3606a8982fa017b92daa2804b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        Filesize

                                                                                                                                        9KB

                                                                                                                                        MD5

                                                                                                                                        242ce96bcfcd64e9e1f0a0a0b5abc718

                                                                                                                                        SHA1

                                                                                                                                        e84e7c555c8cb859512c0f627d8eb990c667b9c4

                                                                                                                                        SHA256

                                                                                                                                        e08db71151ae47c45e26c555c51450a544fc979b761d726749e4209df205460e

                                                                                                                                        SHA512

                                                                                                                                        c65bb4b63d8d91e2c1ee8bb8add349637aa3e48913ac0470068cd2373c1cbeb762bcd6c3c82640aca9fa485177b7d688454c5f1be357f34298f944b359ee786e

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        d4327c740b0575bd89b9468497e6f838

                                                                                                                                        SHA1

                                                                                                                                        86368583c37049e59038c4d699b2b77f36264e5b

                                                                                                                                        SHA256

                                                                                                                                        f12bfd10cb1b3d71f5bac008e90c0f4999a1739593d73635cd7b007d105497d2

                                                                                                                                        SHA512

                                                                                                                                        6b3255762fd934eb8ecb54e0be6d535e34a74b03b1b06813139efc221050a62950da8dbe73c7946ba5d83fe4750938d3ec7604996135ecf96e0a90650cb7a68d

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        Filesize

                                                                                                                                        8KB

                                                                                                                                        MD5

                                                                                                                                        2382dac2238d5141c41173437152b8a2

                                                                                                                                        SHA1

                                                                                                                                        6047cccc385c56633a43bf6c54ccff0809522189

                                                                                                                                        SHA256

                                                                                                                                        cfce4ed52cb8307a270473b119550ecdce27d876136b2e39eb9a4e24171d1101

                                                                                                                                        SHA512

                                                                                                                                        aa2150239f4fdd066e02d0319a89820bdba70da73b2c118bc920eb0b002c2792e7a3e5beec8d4a40ead9ce32dcdb2a40e104d034bbb28bb37a7e07049f5b5ca1

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        Filesize

                                                                                                                                        9KB

                                                                                                                                        MD5

                                                                                                                                        961bd9c928529aedf7a3fff3a125ba2e

                                                                                                                                        SHA1

                                                                                                                                        645f4de41b2047eea7c34fbd303c424e1e32d468

                                                                                                                                        SHA256

                                                                                                                                        3558b7953301f4385e7e855efef9bee94777cfa6c10afc39ca27f7d342d57735

                                                                                                                                        SHA512

                                                                                                                                        9bdd966a5490248f7f2936559b6f4591239f85490bdcd34db4daea7094b20ef9bb289464541414f9c47cdc1e30537a238d0970f50a47562bb36cc9bfc975efc0

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        Filesize

                                                                                                                                        9KB

                                                                                                                                        MD5

                                                                                                                                        a5c315bf4da3c79ed49bda34456f0b7d

                                                                                                                                        SHA1

                                                                                                                                        c7448d8346146573272e9e6c331014e26e257f04

                                                                                                                                        SHA256

                                                                                                                                        38e5fd984e33dd2d9b7b93f218b9a6ae02c0af46833df707774d89339f507a44

                                                                                                                                        SHA512

                                                                                                                                        82f842c816a2b365f0b93d7fac2cd427d0e690224e08edbb40b9f968b03b716e35111e64d89447d391bf21d61a63ffdec3c7ac4c769cd00bcd8d01a6414ce4c7

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        Filesize

                                                                                                                                        7KB

                                                                                                                                        MD5

                                                                                                                                        2528c3a0a2a4f63360bb7a76d85f3216

                                                                                                                                        SHA1

                                                                                                                                        ca09320738d89e1c4aff28b6fbe3fd67f57e5b48

                                                                                                                                        SHA256

                                                                                                                                        b3469769314ace16a3a0f6e2ca52372021b57f10a2bceab692bc7bd6ea32dd6c

                                                                                                                                        SHA512

                                                                                                                                        4995ee3e311a792e2c3963489916579aba7a421e0268ba7131e934e9045b7ae3d137ee16b2c21a4d33463e181564bc256a13893cccab7d50935c2ae3005229bc

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        Filesize

                                                                                                                                        8KB

                                                                                                                                        MD5

                                                                                                                                        1ed4a33b855c8561277fc43020eadf18

                                                                                                                                        SHA1

                                                                                                                                        e643241fbc5f558d6a9d14492e2251be5dcaa53a

                                                                                                                                        SHA256

                                                                                                                                        2b5c4237ed9018d43ac38e867147342c0a2ccab139999b7b0772be8634be61e0

                                                                                                                                        SHA512

                                                                                                                                        7f5430c3b48be0034e8b222b749c1a02f866172257b9ef05a6433dd2a548ee4d075650009b5c0f2bc40a5aaa3dd2f0ed715213e8780ac48bb5b6f3e6107d1b6d

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        Filesize

                                                                                                                                        9KB

                                                                                                                                        MD5

                                                                                                                                        f60dbf8e8dc5b668d7a24b027a3db6b3

                                                                                                                                        SHA1

                                                                                                                                        bc6d2cf9a82dc0c4fc6c5d2feb251bbbdb6a2f72

                                                                                                                                        SHA256

                                                                                                                                        542073a2df91cd015bb0b3495929b0ca4a7bc64339ebe3e33a4f78c31d6dd61a

                                                                                                                                        SHA512

                                                                                                                                        15f8cc4f4713e6c571f181af7f88e892236d475bcd86016cd504fca42a4726cd938d02e25334dea2c0716cd21f78130add38b21edd9f1a73c87a6d16940ae691

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        Filesize

                                                                                                                                        7KB

                                                                                                                                        MD5

                                                                                                                                        44efeee4e0dd6996103e1956d45b8ca4

                                                                                                                                        SHA1

                                                                                                                                        de3f291b7ab841b00834f266a5a23daebf246490

                                                                                                                                        SHA256

                                                                                                                                        e62795f6f851da314800080ed38196bf9819aba8f200ac87d560d3f6eca8f235

                                                                                                                                        SHA512

                                                                                                                                        0d3ae71f87fbb9357d15af14213d1d8bd4731422289bcd41a2efc2ada1ee9290d22fe5cc6431ada427c14cdefcc59847e5aa3c3814d1ac91351af667ca2f0251

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        4915e5bd9841e5a4c4e913b400277805

                                                                                                                                        SHA1

                                                                                                                                        78a72b50f14ae93611ff86d2f258e0d9fb10256f

                                                                                                                                        SHA256

                                                                                                                                        dfab08f7d97d0b938ac2733937b35cada35e99e64036a369e42ba3afc4282587

                                                                                                                                        SHA512

                                                                                                                                        1cbaa6e1867eb4d101df9f44da188fff7d1aa4333eba53c2d7766e3370a64fb49214feddda0ecdadef2e24c59850126acd893555e17ab61cabc81810eb557686

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        386df2d4e4bff252d9a87854015390fa

                                                                                                                                        SHA1

                                                                                                                                        a135d48330f8ff5acceb75865b817d44ff8ea45b

                                                                                                                                        SHA256

                                                                                                                                        23c5da3898d875e98ad9d58194d283989c35422dd9db3c2a8ba4e60d06ffbd07

                                                                                                                                        SHA512

                                                                                                                                        d194b5e8def86a5861f38486e52cf53ed2ecd4a6308d8cef0d8bb06e87a333ebe4ee3365900c575e216bba063ece41fd8b4b119a0139147afcf287aba4ddd0eb

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        37ec7239e23ac007f644814e47d5a09b

                                                                                                                                        SHA1

                                                                                                                                        c11225a5defaaf7bc80dd915f4ca944e0df97e6e

                                                                                                                                        SHA256

                                                                                                                                        2ae4f93bfaccadb44d68323945b2a0eff4ef66e14f3fdfe15f2d8cde92e21c9d

                                                                                                                                        SHA512

                                                                                                                                        0127da67919072291b67fc27a8eb74c6bbecba64e7912faf1bdc0a17de082c451e72df860ba4dc5a81b4e37146281b983101864723745b60a5e9e98eaeec2583

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        6b07196788ac1b241a0a2ef2fbb528bb

                                                                                                                                        SHA1

                                                                                                                                        e887c680d7a3d02ef49e87631a075be69174f91b

                                                                                                                                        SHA256

                                                                                                                                        3f1a10d1af5ee7f0e9402ec1463df542cb5a8d86fe244706cbd12553502c5dba

                                                                                                                                        SHA512

                                                                                                                                        f534cc57b04c1e2abe1c2347aaade65203f6def84bdbaa3f687ac6333a3a50c1322cb3122927d9ddcb8fe4860b5dfd97c5519ae5dd8d3456f68649197c3d537f

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        a4a6da91a6d92da5929f2872dcfab2c5

                                                                                                                                        SHA1

                                                                                                                                        7a6c81a9333bcbaca11cc41a30ca474ba5ed5b82

                                                                                                                                        SHA256

                                                                                                                                        233f8d5d0f48fc8f9ec40403506c7129ae251c026952c33f895aa08d2e5e2b14

                                                                                                                                        SHA512

                                                                                                                                        f122b501d5c7d1fbea02c116a05ed76b6e29c8eacaa44a3bd26f523d8f3de2ea011e91f66f194b49327b763aae546cce33c8f9e76f50f8273f914b69caff12be

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        bafb7f56851decd5aa8ff76a56b2e116

                                                                                                                                        SHA1

                                                                                                                                        f34d8acfb67315a1c882646c89a0ffa8ad35a0c2

                                                                                                                                        SHA256

                                                                                                                                        8c2d444b262eeb477e69b4ea5112aa4f99ca7fcc0acbc4c79dc6df498160239c

                                                                                                                                        SHA512

                                                                                                                                        0673a49005f8e3b9ac11d731cb56ae9cd7898560f32d4de518dbea890c551ef2021e64ca99a1a1509557d78c62baa700edbf1e43105dd135e42105755c6ea41c

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        f110c98b992a273d2384421e7896ddef

                                                                                                                                        SHA1

                                                                                                                                        77299e97ab4d449eb5522f851ad8d3a93bc80f15

                                                                                                                                        SHA256

                                                                                                                                        3e2ec27f5be66ecbc7b69456255ba8c484bced16c01d21d6aad4e52ce98fd446

                                                                                                                                        SHA512

                                                                                                                                        d283761c2b8de8727f73fd182fcd11a8a16b99932a78539295ae669c8da32e99c6f245f519b118d2a6ffec380360c188f661e012e3af9fd266ba69238a2090e3

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        90f0a175196b24aead86f4661c54336a

                                                                                                                                        SHA1

                                                                                                                                        56022335d7e8291bfaf9a95b873bae41e99454b3

                                                                                                                                        SHA256

                                                                                                                                        7efd4d60cac88743779c270696b645c04d6a6169f3f37afd8e3e4f5a06565ca2

                                                                                                                                        SHA512

                                                                                                                                        395fc81edac82b233e5b92b6885ecaad11fc9fc076cf95a3c0f6124fe9613690980dc5e49e5b02571b2b8c73fff9dd6323368a1065a73c9015596ebf2b203d5b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        ecdb739e8df6383bd3d15715e1e97138

                                                                                                                                        SHA1

                                                                                                                                        347daafdca088328675a568f9cd8ed568e8d11c8

                                                                                                                                        SHA256

                                                                                                                                        1d509bcc825d6c62bdfe385d100b3f579e5981c52e44f97b45e3dd3d7dea6513

                                                                                                                                        SHA512

                                                                                                                                        ea4db05f0d58cdb8f595c97800da8ad7665da5d022ae2f7c299580f0c8a589d79b1c27c485183edf2e54f1d8592f45743dec10a618f1c1b46ac9b7b60ee61c00

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        04848c942cc47eded6ac737a05a1536d

                                                                                                                                        SHA1

                                                                                                                                        7255e9cd12e65a4c68525f87e071b8413df1aca2

                                                                                                                                        SHA256

                                                                                                                                        78f3275d2c9ef29ceea6fb78ec912e982a54992a6888588e8edae4c1877ca6f0

                                                                                                                                        SHA512

                                                                                                                                        7ea932cb4e22039d69dd2f4413483dd5bd0fe2f59995eaafe68d8d5cb6da50ba412ea8a6b6e5892ea1f589dfc5e096bddcc858a99cdde34479f5add8e36a5752

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        1647ac392c5828816cdbd635aab95681

                                                                                                                                        SHA1

                                                                                                                                        11c369b1471b12b215ce02fd02f2ef6ddb43ba9c

                                                                                                                                        SHA256

                                                                                                                                        09fe934327cfe6faa57c1f41a7e361177f0bd35e5bfc1a8cc44bb15ecd902d6c

                                                                                                                                        SHA512

                                                                                                                                        b137a6181a58bc24b200ed4766ee4af7238c0e09cce95d03762b1f12c591466c7d5d71419ff971741b39521186395e2c04c25acda2e48f95761f567ae2de7ecd

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        9a37c19ca02825d9041ad0ca1bda18f4

                                                                                                                                        SHA1

                                                                                                                                        5261214f3a21a498d7ddfa0d7373b3c08c33b331

                                                                                                                                        SHA256

                                                                                                                                        f962ea20c7606cdc323c7c95aeadbc3c831eecd4d3840528a23df9a8293498ca

                                                                                                                                        SHA512

                                                                                                                                        6e5f09eb0c73be52511bde3d5deba665d84b4752c4292aeb3d0a000fbff6539745e7c7661cdc27cde387557633decdcf3839088f9cbf726dde13b03f9dd5e829

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        9de350828d2775bdea53a0c9f91990ca

                                                                                                                                        SHA1

                                                                                                                                        572a0757432a9f5fd123dc049665faefd666dd65

                                                                                                                                        SHA256

                                                                                                                                        6b72e3dbfee1b9e3666a5ef53ca54432a6c3f1a94b9a4b49990381fec43c5165

                                                                                                                                        SHA512

                                                                                                                                        59b90b0e371d09f56e3225ca458d8bd33f950e849895a2c35c151c489e698f7eb739edbc77525a8ddd0f889c6d434d9cdc204f42c84654dd8111fa05cd7090e8

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        c70819ce1ca766f02bc38306ce9ae5ff

                                                                                                                                        SHA1

                                                                                                                                        5d716980e52f0a7563a615a9fa3b5c1bf27cbab0

                                                                                                                                        SHA256

                                                                                                                                        6cd157f1ff407edd3ce6a56d5e8be3c4c20a4ed60e68ba887c5222d3172e38eb

                                                                                                                                        SHA512

                                                                                                                                        5a80c4e4b3a394140e8671f492027b20a97687a2ce43fb546b5ef8f7b670613d24e2cff3f1e3d681a09c73be38e9dc2941e4e2df4c07db09d5b7443f8f0cb0a0

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        d4e75c43b0d7da2dc38f9766dde23a84

                                                                                                                                        SHA1

                                                                                                                                        dc0ecc9d2d74b3b93e0ae20b40ac4ddc97d68246

                                                                                                                                        SHA256

                                                                                                                                        7077badb8663ae56fe99d922c9e1cc32ff3e11c98e37d929881372824e5cbdf0

                                                                                                                                        SHA512

                                                                                                                                        738004b5ce3b997893dc86b626394906ec27f121f39cf7bcd51bd57293702b266f3f96c19a04d0b18b21cb91d508fb1f37b1f8bf20484a327618e4248d711286

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        4f7cac74c27bef12f74ef2221a3845b2

                                                                                                                                        SHA1

                                                                                                                                        3132f507d0c88670a5356d6ba3dcfb7d3e5abd75

                                                                                                                                        SHA256

                                                                                                                                        8e927d37a8926d88d94c05e4ce234e71cbfb6587b28c64fd2cdcd78049e899b9

                                                                                                                                        SHA512

                                                                                                                                        c2f120f832eff8d186a2133a3b342264a9970d7522593bcc539a2621c20772a71060a64f7184590bbfece377898d65b7ddbf994d34f08fb30c40dc1a4a5359f2

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        257825af6cfa4e2deb16229257607591

                                                                                                                                        SHA1

                                                                                                                                        9a3b043231266ccf65d6f37e61645f40dcadd1a0

                                                                                                                                        SHA256

                                                                                                                                        12c07162ca1bd14988cded2305d81d0852541c48fbc7510153c050a73226c6be

                                                                                                                                        SHA512

                                                                                                                                        5067b5835d5c98677ba54376703cc1aa740e1e23810101273692d22da850ddb494d6d39f973f217b0a80a71e154bcb496a99e8399ce97c6924cdf533daec1eed

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        7e79cd77dfd8a7b2c17ae338465fb94c

                                                                                                                                        SHA1

                                                                                                                                        ec8f0748b5dd9fa2d59a5a40a212d472bb43345f

                                                                                                                                        SHA256

                                                                                                                                        96a2312afedc742a2b5a54f613024ea5c4b13333dccb9e3ce9a27eb143b0051c

                                                                                                                                        SHA512

                                                                                                                                        99a459f1eb41ba4a9f7cd16fe229e1ed6507980b1f557437922234668a7e6f007a9a2d7b7be8df278c17e3c508ae587c6fc18fb51152dc430412d5cf04656f65

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        f59c480437e04acbcb532876e4747114

                                                                                                                                        SHA1

                                                                                                                                        b8bdf94a750a58671e37bea3fe8a87b3a102a724

                                                                                                                                        SHA256

                                                                                                                                        cd251db77121e0e62943aa4ea52cc19ace5e036e916f91c267ecf33fbec9de34

                                                                                                                                        SHA512

                                                                                                                                        c9e0cbee59163824943875437296544183b2c22f76e5d5c74a2eecf023790560b2f6b6e169f4e438cfffecf178620a4ca1f4cc7fdce733ce3186410186e5af51

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        cb99a4adb8f34e9b66ef2612e31aa15d

                                                                                                                                        SHA1

                                                                                                                                        8bfe12b4327d1041df26a75126c0578f7d3998aa

                                                                                                                                        SHA256

                                                                                                                                        e01392d1abed486855cdf390b9ca702dfb8fbec1c00ca2e0b5fbe22a6607279d

                                                                                                                                        SHA512

                                                                                                                                        a920fc421d193229fcf9de45103267915deb2974384bfca3c055eec48adbb0355face05923581cfcaff9b1b0fa82212fb89348e77566ad6452d8cf382e52a320

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        01fec6ec1a9f0d43009dfe1dfdc0f549

                                                                                                                                        SHA1

                                                                                                                                        edf7f6b6971a35a4566eea6504eb71a2e50bf3ec

                                                                                                                                        SHA256

                                                                                                                                        df3853065577bfcfa263df3b5db873cc2aeb979994d190c98d687e9be7147e71

                                                                                                                                        SHA512

                                                                                                                                        2b9d47179887ff527d95d6d4b8bbdb7b60014d1d4869df7cade933172ece9ea607a388e437f7bb34647dea841cd0ba97848739d9260b1c682b71237dc550cfe1

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        1b23cfb3709b5fa73e35a098e5f43193

                                                                                                                                        SHA1

                                                                                                                                        1bffd746c1da6470fab6a6e9d539dcdb25b738e1

                                                                                                                                        SHA256

                                                                                                                                        0899418634c163d4ffd82f7deead21a08e5a2a6bb6d55748647fc99e5f3bcb7d

                                                                                                                                        SHA512

                                                                                                                                        23bcd2425db1a8f923c662a97b457e6b39b6e77429fe9f6151ccc1fbe93c9dad822a3d0642256155160926cfcf0fe84392e77983df08273d1035c3e8df8085a9

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        e51de2d0c214c087c98223f986305c41

                                                                                                                                        SHA1

                                                                                                                                        a1c35b4a06ab1c78362e63a0aa98703401bd31c8

                                                                                                                                        SHA256

                                                                                                                                        bf2524f340fa9f06841bd80290473a240aafa5df2d1c169ebb3724d1def19d09

                                                                                                                                        SHA512

                                                                                                                                        189e88c87871df477a7c28ce3b8ec8d6296d58ea7b8ace7e02ebfd69e0e307a4e5d73a4eb6b7cc870d42c38690914cfa41c187ec5097fc5eda76b042f2d80816

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        8f957dd5c81fb50d91649f8bc07e0431

                                                                                                                                        SHA1

                                                                                                                                        6657a12aa8a2b4a92601e70e5e927f0bd3120e3b

                                                                                                                                        SHA256

                                                                                                                                        6ff3f6c65cfcf27a43b228ecd4b05dc15a47a6872a31fe42eaddc0b9c92ac5fb

                                                                                                                                        SHA512

                                                                                                                                        069bce33f9644af0734bcaca56a10ebde501c2761728d6ec2c28e059926f5282b77b36e0b7e757ba435ce4183350f6208c0a0d6243dce4a959a4cb42ac93fcfc

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        3212138ff3c05f86b5421110860b19ff

                                                                                                                                        SHA1

                                                                                                                                        21f2265808dceac761026d2842ece5a5d1d66315

                                                                                                                                        SHA256

                                                                                                                                        465328267e3d7b044a471b03bcc7993fbc9f8865e139a23ae2a66a1e8ba7773b

                                                                                                                                        SHA512

                                                                                                                                        9fa304661f93c9f1334dd7b970b9ab779ae7c121bf50c3de9e836b96f02a0dc84378f9d41ea14f75b0b55a93eb5b97d8269e2182519e36f09537bb3496edf354

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        d3a37e009548f920d41b4841a5c07beb

                                                                                                                                        SHA1

                                                                                                                                        a56cc0b2d648d1b0bf878681ba3af5d1bc7efd5a

                                                                                                                                        SHA256

                                                                                                                                        a1171c4892a9ecfa590aaaa9cf022390a47aa01779da2874371b09f1a5351598

                                                                                                                                        SHA512

                                                                                                                                        2bc1033f46b16dc40e871a1d5eab3894fbf08269ea70c7e809ce83f8586ef39cde60c974a6a92e57ff2a7ae6fd3bdf4da6676769402223a2438d8a7db09d6fe3

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        11f0c8122a4b465d719a4689b9ef9dcf

                                                                                                                                        SHA1

                                                                                                                                        485e654c9ca35d675092cb1620a023a3ac79a5cc

                                                                                                                                        SHA256

                                                                                                                                        82367ddd9efc6f4e8d98fa47b86d09241793f2381c76607a6b5b70506d34fd40

                                                                                                                                        SHA512

                                                                                                                                        7ba1ba9db6efb846ed261e848390188a05dc2f8b321c2a34969b46e9b8e8bc5c3803c55e4264790e565bccbeabe8e9f5d76d20152e11b7bcf5d5f01742d8a443

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        f6ad6a831d033c204c3a86ad03892d6f

                                                                                                                                        SHA1

                                                                                                                                        99a60b89179adec96029af74515574e529cca5ba

                                                                                                                                        SHA256

                                                                                                                                        41c5e49af33354813dbd18b4175e4d764ab394cc9b095316d7a49471dc43451d

                                                                                                                                        SHA512

                                                                                                                                        2d84ebc20910a680fb91ff8736220984ce33421d918e37e5280604ec0acdacb6a3cc586567ea08358b8fa45f92cb11994bcc3e80693eefad00974494a8fe2db0

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        6c58e5f4cb01b2b2a97109f695376459

                                                                                                                                        SHA1

                                                                                                                                        826292d3f9e8ea7f52a4b93f7fed3c9abd7dc066

                                                                                                                                        SHA256

                                                                                                                                        b350c4f2a7dc758e68ccb4df2c18717d641fcd22f519374c8dd82bf12ef2f8fc

                                                                                                                                        SHA512

                                                                                                                                        777dd4e004d873afaae3c8f95dd658d17a2f346f2827f24f9f0a64d0d71a186e16cf4b2298d0a54098ca897cd4fd5fb0819280396cfa8431034ad772ed9e24d4

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        4cfb0f080cbcb3134050c7fc664dc5a4

                                                                                                                                        SHA1

                                                                                                                                        10ac9d6f9173f2ae73a8265a78bb34a65c92148c

                                                                                                                                        SHA256

                                                                                                                                        c06c6561ec9f6d6dab96ba42a43d0876effc0d580cd5964f8ff249034074e23f

                                                                                                                                        SHA512

                                                                                                                                        628fd9ead9d308c1aeb73452ac17f273b4f20a037638bd26eb65e1da0f8ec8f7564511e909bd51411fb739fb36e88d58438f3fb4a346a5cb5f2b0abf0811bcc9

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        8ad7fead65e96c14417beb0bc54ca125

                                                                                                                                        SHA1

                                                                                                                                        61a75990db6436decdbd447c4f8b56c3a91f4dcc

                                                                                                                                        SHA256

                                                                                                                                        841068e9ed99e1396198a0522936f391cf63740cafd02f09e5bdc98b8164115d

                                                                                                                                        SHA512

                                                                                                                                        da637e7f8fb7474ba4201488585894576c9cc465dd60eb0f1d7e802c7a8f2e01830eaee60023f501898666e4b53c439957ff82e719fc7b0e5c5c872ad6c5fc0c

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        a8f0613df6a3ec1cc66fdb34c3cb64e5

                                                                                                                                        SHA1

                                                                                                                                        52da34d7580a816f0a94644ec0055fd237a6cfa0

                                                                                                                                        SHA256

                                                                                                                                        b1fc99f3ad350c87017fb63bfa715e424e2e6e57efafe528ec197b4f2ae9ea37

                                                                                                                                        SHA512

                                                                                                                                        d44927cca992af9ce4e52e23e1789d08f418bfbfb6f2d4d3d5ba546026d41e032249ae3ed20932d1a227e1dfebbf33c5bb6547bc5f40c1122b9f6ce1790608af

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        7f6e8c22fd68bb517d4b9fe6a5d8d997

                                                                                                                                        SHA1

                                                                                                                                        f3444e9355f2e46c20a6802e91209e4696fc61b3

                                                                                                                                        SHA256

                                                                                                                                        497c0ff62e91507929c94d06d02f18c6e5a407475dbd4c22e50f994c8b107734

                                                                                                                                        SHA512

                                                                                                                                        394283e52015e4a935a7d8e54b02cd822c3fa498ca802255202f376346aec143cf0999480750517559f977133c4eca321be3c24296dabf0354b0c91ef76b240e

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        c2115bbd500a9cf603545c0e2fb04777

                                                                                                                                        SHA1

                                                                                                                                        e89a8296bde64886934eee8b1ca84c1066af4be7

                                                                                                                                        SHA256

                                                                                                                                        6db9ad06b509b970997c6b518b67ce25dcfb7df8e7108355f82394e445ec4cf7

                                                                                                                                        SHA512

                                                                                                                                        5f609e839ba3e7bbf830e5af8cd3849e274824133e6f90803b74835c1e7b25d8cb9807899295d0fd2126fe17f31f5233452cbf5f66c66c9c48db0feb8d356d63

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        f8f03fa9b1ec55d9c49867e67b522389

                                                                                                                                        SHA1

                                                                                                                                        a4ff9ac47cf921c4aa55dc2894a616e2d9cd7b6f

                                                                                                                                        SHA256

                                                                                                                                        9f2f43f4e509202a74dee02188acf2cc1796969d1e87c7da1d1fce3bb7cd766b

                                                                                                                                        SHA512

                                                                                                                                        be0a6543b48bcb70b9b6a37d6a4d449cb1b531b9d4ed68d52a07f74bd0b735047fa8090c024263670053eb6940fdb30609d9a2632902224a3c64bb7a0218ba65

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        abc51065f1d85b9c9dcd3795998aad85

                                                                                                                                        SHA1

                                                                                                                                        a76b26dc8204c80e36998fa2c72d806a0d06df45

                                                                                                                                        SHA256

                                                                                                                                        805148541d1718a334d9b242779a88c99c494a3458730bc43e107ffa371a070f

                                                                                                                                        SHA512

                                                                                                                                        c3b77d0a2e2704fef85b17380c7127cfdba1831ff9de8b010e4f0e26588bc40b3f697978e02ded08b1c07d1d00bcf5c87b22bf5405e43306a045d80f510725ed

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        1dfaaf8259ad070b3d275c81d9511794

                                                                                                                                        SHA1

                                                                                                                                        c07276001534db5a6a3e2a8736a8a8a9a0728822

                                                                                                                                        SHA256

                                                                                                                                        2d2ee699c2b6c29b57f01a62f9f57b7b6ed03d66816699701fac5b300c25c938

                                                                                                                                        SHA512

                                                                                                                                        e88aa89d33c5f7dddea35ecd5d6e210ff83aa1361816cbf127f9f91f165d33ec903a792713ef403bcb367c157596f0bdfb44d5195edbbe92e75b056f588a70d8

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        9720ac38d6cdc03b821750cb7d1c3fd0

                                                                                                                                        SHA1

                                                                                                                                        aa830c262773608e30c8c752ed88b7768e63623b

                                                                                                                                        SHA256

                                                                                                                                        211858bba00ccc45b3c73b60e41346375220ee53ef888f07e13770ce2886c235

                                                                                                                                        SHA512

                                                                                                                                        f8b83625f9170bf48ce6ff54282de4b3ece5c1755a53afea116171023857fa8b08beb0f133e4198cce8ebddefb01faf2900e2fb6c38633dfddb2f300378512fb

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        04f72783c15bf4d110cf42033962c26b

                                                                                                                                        SHA1

                                                                                                                                        219d9c6b5887510599d421dc91c57dbc6cdc7d70

                                                                                                                                        SHA256

                                                                                                                                        886387fe53a74c3b7f8d871276156ada3834f5a1c9b2a67ad78c7ddd4fbd1eaf

                                                                                                                                        SHA512

                                                                                                                                        1ec84e10ce1a55b40762347968c8b1f6d29ae79498d3616c14b661873d8e8c64337737033b9834a41936ce759eb82a8ca501d60f1f6ff586c904d828fa8dd5a8

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        8b52f2d0756e74aca0d6ef12524af163

                                                                                                                                        SHA1

                                                                                                                                        02a44e88d8a26af02ba581c0806f34d75a82fa29

                                                                                                                                        SHA256

                                                                                                                                        035e165f6aa4aaaa4f00c8f97ed0c848c79023d1f57b2bfa8c311fd634df6e3f

                                                                                                                                        SHA512

                                                                                                                                        14652f87a6af210142cd969e7984390a69456962655479d1bb02aed082e5d0c628987f202c9578d1548e8458fabad27eb606ef1aa9885889c5dc1e2596813eb0

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        df4e1629d14a89666bbd5da376f411f4

                                                                                                                                        SHA1

                                                                                                                                        a91151a2e62e22f2f6c54891f8ec91dcb1b5c72c

                                                                                                                                        SHA256

                                                                                                                                        519bf3174df49d0e85b0fcc941f483bd00f59699bf6e586425f47dd4e1ec8355

                                                                                                                                        SHA512

                                                                                                                                        ee3b9c69f0962cce1d99891fbc51628368babfecc33df0386efda431ce60a85ed4f1c3e330b413b230d305cc55670637a95b72176c55b46a7fd1ed603b049e19

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        e538721a4cd7d08f11e6d044f6da0c00

                                                                                                                                        SHA1

                                                                                                                                        19636a38daa21f9d72053ea7020d479d95753266

                                                                                                                                        SHA256

                                                                                                                                        0db1f741d99358950a13cfe45648e25007e21e02fd9aa7d37ba87bba8f62842b

                                                                                                                                        SHA512

                                                                                                                                        f0acb82558189bb3f6697b6d74183d6f8bac5b6a9a16b9d550dc91d2ab8981284397526846647d740c4a81d676d4adac03971c4debc69cce1a1776943a3e15b9

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        37db12aeb27b0ccf119356b16dc751fa

                                                                                                                                        SHA1

                                                                                                                                        a8bdcd77433e34cfdba461458c397a89734baa6e

                                                                                                                                        SHA256

                                                                                                                                        507ef41d3697337a89d154574575c0cd40faff286cc39fce8544fbc61d85fa10

                                                                                                                                        SHA512

                                                                                                                                        444ad325b42727a75a371b9bf5501d3ec0f783ef597f47f9b20c94c024a2860b5c92ffae891583475d58259d31a79326458c470da00f12df5f7dd63aa0046720

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        c2685573ef2d5d3113754efbc21fc699

                                                                                                                                        SHA1

                                                                                                                                        4604b534d87f90279d464a62e330b71f39251c64

                                                                                                                                        SHA256

                                                                                                                                        887d89e25a3e8d844e531320f1e1fce2cc61bc31b9ec0ead42ab42303a007412

                                                                                                                                        SHA512

                                                                                                                                        644c85720bd096c25f2582069700f4a1a569a192e7d8f1d40e8e3acf4ce3dbf67d45f95e6ed08bfe15b1962a5af2746b184a8a61d5d0191bfda7cf13899956e2

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        768a7e52a6765458f9df6ba98122132b

                                                                                                                                        SHA1

                                                                                                                                        da98c7493f36b3617392c70467ce5c006f627b04

                                                                                                                                        SHA256

                                                                                                                                        64314814cbd2b27b553cb0005bc0d8510de3ef3532212a3acd2096586cd98616

                                                                                                                                        SHA512

                                                                                                                                        ea0153b32959f9c95e0537e3ce84729cdad61e951b4ff61af0fdf8a5cc070ba14ebb0224c16ec3b466db336639b7d9180f961c6bb1a2ccf3f7222d1a947389e3

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        15b184cd13e1f3917e42340ac31f4c20

                                                                                                                                        SHA1

                                                                                                                                        68363d61ad84c84e11aaa7b38a8092a1b8dab5d7

                                                                                                                                        SHA256

                                                                                                                                        5f91670b8e3958a82450315f627be0e4c7d8a6bd2a266c938f357c0532844439

                                                                                                                                        SHA512

                                                                                                                                        8bc207eb9f330da219f25857f3a20c95b8ca86ffca73684a4c2f5b899ff03a2b1d7923abf579a96e75103528d78baa73f7f6507959a0edd61a9d2eec92ba3e04

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        f55f595c2d2eed0b7a29eb238fa0206e

                                                                                                                                        SHA1

                                                                                                                                        d444219b248b785cb8ca2cc3cd2db5a027379380

                                                                                                                                        SHA256

                                                                                                                                        78af499072127bada53316729ea953c7ebd2c0f8237ffb92a6fa3d579a225907

                                                                                                                                        SHA512

                                                                                                                                        cf2274476104d937a1bc11f1942380986bd3b065927f3cf46647387d1b0413e441a282eff7a2668688926fedfea1daa3598a00785f2edafdcaf0c9756f96838b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        f2023db302538bc2bf6f6d29f59fe14e

                                                                                                                                        SHA1

                                                                                                                                        ae99df3121187efff45f348a166db913852056ca

                                                                                                                                        SHA256

                                                                                                                                        c7aa20c0303ac463215d439b7c3359c61612e6ab66541a87e65ffe9cfa231e11

                                                                                                                                        SHA512

                                                                                                                                        bfe3619dc4974beefc5e0e5e14860cb52625c98a44f6c6b4bd30b8de5a6fcbbbfdfc506b0d664fb5ccea2d177563466ebf7bc02d8995fdc601641474aa2e7a54

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        3ca2cdfab216e4219de382588aba68df

                                                                                                                                        SHA1

                                                                                                                                        e6c7e78add937f9dffd991d232a23a254fc9655c

                                                                                                                                        SHA256

                                                                                                                                        e976a1f0aa9910d90d2ce442b499bb8b20da159887d2beb340766d3aec8a7912

                                                                                                                                        SHA512

                                                                                                                                        a3c986b59e6ee50915eca52b837bedfbf25f2b48976ce66713f03bc5e6a1e78ea9d2ff5c54918d49e4970dba106b5cc01dadff75bf0b11557a95269a1cc37eb1

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        1bd373da72435372a6a98e29a279186e

                                                                                                                                        SHA1

                                                                                                                                        70a860306bb50ce141e4450b733c4b14bdc9f7e9

                                                                                                                                        SHA256

                                                                                                                                        fb5fd4cad97b72d923bafc9bed60ec7d169eb6e1d83c183b67570f00df564d8e

                                                                                                                                        SHA512

                                                                                                                                        fa5d5bda5ba7e29604aa297210934a65f106bed3b2aadc8e979a42795963720b9d34edfe17e7ade64665ee78ab6b13b81799f0645f395015c1b430621668a1dc

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        26ffbe46c3b7ea93ccbfa458cec92bfa

                                                                                                                                        SHA1

                                                                                                                                        6d7f86c26c3177549f555c9b7faec8a8977d9157

                                                                                                                                        SHA256

                                                                                                                                        18ce8eeb9c4d1bdbd7431765a3bc81d3b38519a4d513f592b8e806088c9c9708

                                                                                                                                        SHA512

                                                                                                                                        d5615bac39856adebeb6a5a200d0cc59d7ed2ff76fc20fe6cc5067ea934bf491a481023d242ddddee3972bb6edef5492e71041249a45711e16e0252ca154a8ba

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        6c3e7c380ce849dc30f68263e6948361

                                                                                                                                        SHA1

                                                                                                                                        97cc4c804e659c780110325d078b29ee4f56f78c

                                                                                                                                        SHA256

                                                                                                                                        f953324a08a509c5e726bec36513c27bb4f4c85475f955b2f774df438a853fb5

                                                                                                                                        SHA512

                                                                                                                                        2b45e88acc27d769118c76c610dbcaa11bb64fa22a2c0ab268dda4047d08f4371d31e02851ef143ee48931984e8c0867036ab7bf7fdb33b6d8bcb7fa80312b9d

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        0e89cf4195d1a442c44678ab29dab642

                                                                                                                                        SHA1

                                                                                                                                        1a7e8b09d4b3112cbc28f1dc840466899873a606

                                                                                                                                        SHA256

                                                                                                                                        42f4569c98c0f69b0407c3f9b3162ae26f0c2194e51245c56b1b2ccaafdd3ecb

                                                                                                                                        SHA512

                                                                                                                                        6eb1f3b764bd28c41ac2c8def4bc8dc8e9d19efedd9608365c4f8fa0c97d77b9dd68cb2ae1a5f19ec4c5f88d5524e8beab8556e025fb5e283ab916a0018cdde7

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        2eda5d1199e39241e272c356fcddfd90

                                                                                                                                        SHA1

                                                                                                                                        10c06c078025bc3acf28c996c8b8b2f4c086f942

                                                                                                                                        SHA256

                                                                                                                                        648479f9c1ddbc1a866b1aeed91847e52afe15801c1a311a7af8c3aaf3199308

                                                                                                                                        SHA512

                                                                                                                                        258324ca5b8576564f9250bbc688b4923f7168bec357e25e89814dfa3e2359128b21b5a1ca0bdb262d04428d80b7a1b27f2988d883351d1acb7e5799649efb9e

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        8f8cdbe887492fb3edcd43721ee2f3dd

                                                                                                                                        SHA1

                                                                                                                                        4bf09f6716f8797e8c3b1caaa2ef85a0777e1e91

                                                                                                                                        SHA256

                                                                                                                                        6510d4a744c8d8acdda2df8bed45174544ef52e83fd832cedbb0125818838bf7

                                                                                                                                        SHA512

                                                                                                                                        e242d8305f9d3bec4890638b88ee5f626e451fafd2ab83279fcb4d5bd5ee97b3173095953255a177d44d8bd1bb14c542007c5f341ded281a918af8f14df25c07

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        ab38d3b2d0a399ae798f0592564ff9f2

                                                                                                                                        SHA1

                                                                                                                                        b84215fc942540377eea432dd29e0fd63b6f0412

                                                                                                                                        SHA256

                                                                                                                                        dbbf43cf6f0fc5d9c407d35359d69974225d9d616ac8a86c3aefce63141845c1

                                                                                                                                        SHA512

                                                                                                                                        c79757ae9aa54e6c19a4a9bb56e866873ee11666aca50f4bbfe4ae9bc1b6560603a64f7899db10acd0ebb61f479ed7a679166ce3a8c318e1a3fb119491392591

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        26ecc540f1a585bb0fcf82a18019e38c

                                                                                                                                        SHA1

                                                                                                                                        7f472b41edd3ea28ac019de61d3ef5958a2dd887

                                                                                                                                        SHA256

                                                                                                                                        27a521bca63315fd1c8cf5941817fc71cacbfbbbe60531b5762f8b4da6b6def8

                                                                                                                                        SHA512

                                                                                                                                        158f62b9cdec45ade62d5f608d206c7899ad29c8dc19ae515106d07538e0e589ddd5b23445c822a6354ae36c476c5aca8e47602b62e75c5b751a84e397a8b160

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        234a201634f16d523b24c5958d24193e

                                                                                                                                        SHA1

                                                                                                                                        833755488b7455fbf7612d9f1751b02864129ce1

                                                                                                                                        SHA256

                                                                                                                                        a126dfffa46ff39044369e9b29edc80cca8d328bc7cbe559795e9811ccf17873

                                                                                                                                        SHA512

                                                                                                                                        cb8c242f9141a09cf52c619a83eea730670b00e232b53063e24c37aefbbcfe25a042af256b09b51df803db33635623e3b57a76dd8b8be674434f3750b135f4e6

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        58a2a0a83a828ddfab239b346c561ebb

                                                                                                                                        SHA1

                                                                                                                                        5f44f88ae87ac88ad1171feb72f6bc2fc1d38885

                                                                                                                                        SHA256

                                                                                                                                        64a5bc071469be6fd3ad5797648370af7ddd1d0e6edebd133b10933b21e5765e

                                                                                                                                        SHA512

                                                                                                                                        1bc6a0a1760dfe0bbcaa5efcb7449dce4a4ce1e83cb233d6d9c61f00f1a52e8e377ea92169242e5c57dcf7d173f6175d4f80dc2de1309705408b6d13e243e835

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        665c5a1d16c4ebedafd44de701e72948

                                                                                                                                        SHA1

                                                                                                                                        c14895bbca685589fbcd0322d5970390dc64ac73

                                                                                                                                        SHA256

                                                                                                                                        e6700913e5a291e6b1500ac0510bd472e06d8a022e7831a8a811fed68f48a5cc

                                                                                                                                        SHA512

                                                                                                                                        24b75ab9dbb43be27867530bd5a48ef87b3ca75512eb77a0c6b83de08e4af980dc53b77c8fa529e43817d22071369e2debdbfcbfef5a94ed51ef0fa278322de8

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        MD5

                                                                                                                                        9d14cdb3854cc27852413ca28e31a099

                                                                                                                                        SHA1

                                                                                                                                        0eef78ed90c5d1ac6cf3a40f069cb8bb440be296

                                                                                                                                        SHA256

                                                                                                                                        95b6b5d3b65a3a930ac09c8e5dc511ac7d0b3bcfb75bc2ed92498f71de16623c

                                                                                                                                        SHA512

                                                                                                                                        20e6bdc8440f490f288f19bb5ae1d831acc41d1afeb40881018cbfee8433019b9f994fd16f6f1a54cff3b83f91c44c359a90761e43d3b4c9127428979368aee2

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        MD5

                                                                                                                                        82b14cffc0e275b08df234040af41427

                                                                                                                                        SHA1

                                                                                                                                        f338d8e63b75edd22fd5b670f037702ee590282a

                                                                                                                                        SHA256

                                                                                                                                        a4794c4ccd3025dc8bc7f4c43fcaf631938ef8178c997af2352544d636f750bc

                                                                                                                                        SHA512

                                                                                                                                        3498e6d27ebfed13447d06c9d89ef387f93533796a5dc05b3a69e42f002bf0b09b85ef8ff8fe8a14df0b3aff9dd1fffc3fdfa53ccb58c92060d7d1d7ceeb5d9c

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        MD5

                                                                                                                                        5a254333d9a8fb756a0208f4a0832b23

                                                                                                                                        SHA1

                                                                                                                                        dfe57dcfbb1c93e2a2d7ef25c1b83ed330a00313

                                                                                                                                        SHA256

                                                                                                                                        85f738a2cc273ee2bd5be97be25ca434b88b078346ff382a8c4d6f2edf26134d

                                                                                                                                        SHA512

                                                                                                                                        a6add28da0cda0f1904a82334b969e87c8888a0287d409d846ba086af79a58c46bde935ecef5096858746c037ed219ae9a4fe447bde2b21b56fe0d2d6837ec0b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        526e685583c751e1cad3f1c0ccf0bfd2

                                                                                                                                        SHA1

                                                                                                                                        25b19ee5e55e7e9c53a146c2bf045ca2215f771f

                                                                                                                                        SHA256

                                                                                                                                        23a5b73c216df209aa58a2457a3351964adddfbf6d97aa463db68ce5c5c42f60

                                                                                                                                        SHA512

                                                                                                                                        d40168beec81c2591db6e9c2419198a0d809455bf074ae141978e773493f25646dbceaf3e81dc56b3ca77101445c583ab41065ad660c075bf02c341c18ca3ec2

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        bf6453b7a5e4db5b0ef19b5aba983140

                                                                                                                                        SHA1

                                                                                                                                        841c3b5dfda36423e1bc16059e4bc03f37c4ffed

                                                                                                                                        SHA256

                                                                                                                                        f4c999a40a10edbba7842720df25a408e13eed951be6eac2d3eb2ca91374f2a2

                                                                                                                                        SHA512

                                                                                                                                        ae0e10d38ad77c10215ee6d63c0a1a0b97614a50b809c3162441fb2729b3eac55551ee4ad14c9c213150d81960276fe3b87664efdca27bd1b3fdc1580b2912a9

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        ce184fa7e7a9625b6f84ad5bbb00877f

                                                                                                                                        SHA1

                                                                                                                                        fbef458b7cf9e0bfd41145b798824d9936f4af8a

                                                                                                                                        SHA256

                                                                                                                                        856db4f3cd782716740d30fcd95bd2a8c0559ae3cf6b1ee47c1da8e2a95c55ad

                                                                                                                                        SHA512

                                                                                                                                        a3447e9e85dc9e7624a098a1e2fc426711ac9393fd95597809600fc8c8b70dbfaebb53ebaf796c999344ba3390238ff21c2ebf450533073e8a3902014d519a7f

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        78824f84fa999c12434ae1c58bf437fe

                                                                                                                                        SHA1

                                                                                                                                        d018ce11c75fee9541d3e829be99b768980547f5

                                                                                                                                        SHA256

                                                                                                                                        b975509e2c9a8c49e8ead5d3bf23ba423667e76675f8e224f232e5e6141a2e2d

                                                                                                                                        SHA512

                                                                                                                                        ceb111972dc3658d970a7d556afb6a64e923aa7c08f57356c57c76090064afcb0804605479d8eec679c7febe88fc615700a935ba7deb56e209c4e2f3d7d03546

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        cac157a60e6e5466ee211dd4c4522c82

                                                                                                                                        SHA1

                                                                                                                                        a328fcaccd0659f93d65b8ae6c389fd5163daffb

                                                                                                                                        SHA256

                                                                                                                                        71a3633d439daeb97e3c86230a1ef222651151a8b0075639f4d46702efad0af0

                                                                                                                                        SHA512

                                                                                                                                        2da1bc7e964d9a7080f26dc019a4ceca8819af48a0bbc8139566a4b10a45614be55b5e78b5f6ea1cab9454693c932cec3d5faed4e5692375210aa2aabb6ce7e4

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        MD5

                                                                                                                                        b4ae287db3e220f5bb8f720469aca6c2

                                                                                                                                        SHA1

                                                                                                                                        2f00ad3338f8d6240885a911ba2f2d2e4701f457

                                                                                                                                        SHA256

                                                                                                                                        1e76da18a7f93eb67634f3c90ea4928a6e73c3c102dd41c1af1240312ce8ba6b

                                                                                                                                        SHA512

                                                                                                                                        3ea2069cd8c7b5cbbf325f638759412201cd9173058d2d7c486116fcf931868323bd85bd0c4ad8cb53fb5f56fbb6282644ed067b49f05c69290a9c198c084e5a

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        c94638dade0f26a918c49cd71810aa97

                                                                                                                                        SHA1

                                                                                                                                        f353871abf8db100b19fc190d5ceb63d21d01184

                                                                                                                                        SHA256

                                                                                                                                        6ff08f00619a4db089e64c08cb267ddf07e55ea29b1c47e54a2cb45b06e78bf1

                                                                                                                                        SHA512

                                                                                                                                        4da0e23f6c742efbc574ea742a02248f18d12f32275021f394555ad897e65cd02566deb0ef34cce16a118828c74ac5aceebf19b380a85e9b59077226a32a955a

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        11ec50b457453e69ae7dc389f0362b87

                                                                                                                                        SHA1

                                                                                                                                        fe10b1c7e2454d8f1d4878b89a59e8c3c10b9341

                                                                                                                                        SHA256

                                                                                                                                        34d6b9246587af3673219341ed42ab92028eb5d9ab30e8a429b09e65397012e6

                                                                                                                                        SHA512

                                                                                                                                        0e8c2d2be8d57a83bf94820ea037f102f681586c54707bc0a5b24aa62e74110ce2c1ce142520036145914c0ca963a776e1cfd24e4d498a49fcff498208f4e9a5

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        704B

                                                                                                                                        MD5

                                                                                                                                        9bcb7bb77cb78dc6e28621c1cc065130

                                                                                                                                        SHA1

                                                                                                                                        c5271dd53198ca9a0b926f5f857c2f335c9368dc

                                                                                                                                        SHA256

                                                                                                                                        cb8e8e811dac37e6783a177571720e5d3cacb38916dd8ce4a6ff3948a4e5ae10

                                                                                                                                        SHA512

                                                                                                                                        2d377c2537a36dbd6755675264f645fb6d6064f7501cf97f1ae9f10414998a7954c59a1136c800cfa09f3a6d1b841623ba26fed55face5bc990b086a7a7ccf12

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        0a482792eb86d3afc203da8b2094b6a9

                                                                                                                                        SHA1

                                                                                                                                        8fadb00eaa5199208fa778f551c8734d8273ed25

                                                                                                                                        SHA256

                                                                                                                                        afa00373d5672bf94522dddd8755f03700f6e370d6db49ab03bb5390d9e8b9ff

                                                                                                                                        SHA512

                                                                                                                                        5fc84317b44f5b589597f63d661d7eac898286c4f6186fbb3d12f1ba42bf50d8b84c1bf3eee65048bd906dd0d7b09bf5472d2ba7c74157a89d98c317319d2b7d

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        2b387712c1cc86c363484078500114e2

                                                                                                                                        SHA1

                                                                                                                                        54b04bb699fe74387f2cecd4f06185111480ff23

                                                                                                                                        SHA256

                                                                                                                                        f4f78936abcaa8f6bedb8ba31c7d753532d71758b67a52853f5a7b8ff26c633c

                                                                                                                                        SHA512

                                                                                                                                        c908e06ac1bf1ae9757e86549b756d4ec59146e1b816f6c4dae00ac5a1138420c215630309ae94045dd388def64ce68703f8724d83d4c32c4dbd5e13542cdb9b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        d576788bc0413923eafb475827389e9f

                                                                                                                                        SHA1

                                                                                                                                        45fda298a6c8ac7fd21b3fbd1f7f1a24c165d1bb

                                                                                                                                        SHA256

                                                                                                                                        0d6f1a6d6f8ef5254a29d4a28b5533ee87163cc3adf312a5b04f5936814936b1

                                                                                                                                        SHA512

                                                                                                                                        bfed526fb8f872983ded833f2ba256fad4b7c04eca1673f3200abb5bef3298017fea4dd5579272c65130bb76825811b93b50ec8edd3b25dc3e51e4fb6e08f0cb

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        a8f1fb37ed0ab25ccf85a3e48da6a01a

                                                                                                                                        SHA1

                                                                                                                                        892fa0080cda29940f47a46b6d844c415be75cd5

                                                                                                                                        SHA256

                                                                                                                                        7a5aaebdf58c0057a3edb0c2a76213f4d94492f6b9e45c600515718c44a72939

                                                                                                                                        SHA512

                                                                                                                                        18278bb363fcd379181fcaea3efa904fbf540ca7db72be3c0e5d31f0d6e0cd42ceaae9a1b981778a678a4921d707ec744d0704746b881fc5648fb071d7b8ce51

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c138.TMP
                                                                                                                                        Filesize

                                                                                                                                        704B

                                                                                                                                        MD5

                                                                                                                                        4954281769a922bd4627d95ef96f1346

                                                                                                                                        SHA1

                                                                                                                                        503c7ba3a72a0e96101ff1c8d157a5d860a81c03

                                                                                                                                        SHA256

                                                                                                                                        6854a6b7305f6b7f42ff5ad198fe66c76c461864899f0ff98f6a2ec3669fdd86

                                                                                                                                        SHA512

                                                                                                                                        7d5367795b1c84521d6b95499f415757acdc47bc45cbf553e1f39c8e21a35938f6a262b0ff8bb7d7b186710d012e3952b48ddafbb0dc00bf1259ee174ae403bc

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d25e00a8-34de-4205-9db5-449fbfd47e96.tmp
                                                                                                                                        Filesize

                                                                                                                                        5KB

                                                                                                                                        MD5

                                                                                                                                        b2510de3b67c3fb4efab9727d86d993d

                                                                                                                                        SHA1

                                                                                                                                        44d569950554a70e46740e8957d281a97d9f7164

                                                                                                                                        SHA256

                                                                                                                                        00a8cba5e610ba207e2344111c96c2d234666a5e28fdcd480b03a43d325abbf3

                                                                                                                                        SHA512

                                                                                                                                        514496994bd6a3b40141a2f44b7ed88f63b28dfc2d782229e3e1a0e976f0b6d4639d88aeda63315d63749d5e29ec3e784583d8ee9b95d2edfcb83f7b1388a451

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                        Filesize

                                                                                                                                        16B

                                                                                                                                        MD5

                                                                                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                                                                                        SHA1

                                                                                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                        SHA256

                                                                                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                        SHA512

                                                                                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        65f4b60162ad5c6197c9c918341cea7a

                                                                                                                                        SHA1

                                                                                                                                        30899404cc1977e2ac8706c65593f6e9047f49a0

                                                                                                                                        SHA256

                                                                                                                                        20add6be93bb0eda26cf72d04075bb028314d5e595fec46dda45400cdc1f62ca

                                                                                                                                        SHA512

                                                                                                                                        4931f3ca21cc7acaf6a042a3601b26c5e64d3ec9616ad7482966c0a4591700d2ff0d986e52f3577aed86f6cec4824de15ad794952d7f32472a23329792061575

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        88362fc1a04454410bb6fc334b362bb4

                                                                                                                                        SHA1

                                                                                                                                        cb972b8204eebd4ccb444d2907ca5dab216f5bb4

                                                                                                                                        SHA256

                                                                                                                                        1f864cb81f215b26e486087f5395f25637686916eeff73fe9b3eca5131bb4343

                                                                                                                                        SHA512

                                                                                                                                        5c8a860706240d836bdabab5a6e6c14c178487de2e416cb752174c03f61f57a567fd7ee7bdf23413af2cc470af5800e223b20389cc5f246e9616a18564321476

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        8431175ceeb30759e50478fa4a16af4d

                                                                                                                                        SHA1

                                                                                                                                        e47a7cd5e37a9cd143e674ab613cc6e9cf2a5a17

                                                                                                                                        SHA256

                                                                                                                                        6b8138678986c8cf64e079b2286bd59cb5c6f914cd09dead2b1bc96ca1c4e921

                                                                                                                                        SHA512

                                                                                                                                        7e5e3f9667d826b2f3ec54338c639942fcd7b9382ef647c708eb1747b03f00343af0d4bfe819c5a554ff9fe6ad36e4dc896a7afa1d23b8b54d29dcf59d1614ab

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        4baeecd60fad270608e0491080debf63

                                                                                                                                        SHA1

                                                                                                                                        052b8b7d55bf56fe0242e70ff59be1f348c48015

                                                                                                                                        SHA256

                                                                                                                                        ce20892ba4481bd1b6b648bdf7cf709005447507ded011c9d908417c71f73100

                                                                                                                                        SHA512

                                                                                                                                        a1213bbe0d4d2e35a8783eeb886e1013c068189369ee96152e680c6c8d61d7970349c32c8bac8a6fc09587039a2c12d3b6838d36ba2d6b78a13cda32e3ec7ba3

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        5e32b2eb4ef7b7cf725e44980e71b35f

                                                                                                                                        SHA1

                                                                                                                                        125f62d0265e3a8d5d482eedc204da48c5f6a054

                                                                                                                                        SHA256

                                                                                                                                        0701ce2cb9818fa43f0f37a39f6b2c609a497c260c509559acd592c822f62373

                                                                                                                                        SHA512

                                                                                                                                        806b62ac49af768fd610eb296299912e9541d4e6d8aa0691ca504a76dbfc3776e3e59d8bd3a722ba37294568d2a839aadc5ba534c08cacfaa72382bb7081fe6d

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        10KB

                                                                                                                                        MD5

                                                                                                                                        f4a96c627f056ca33c83041154164c98

                                                                                                                                        SHA1

                                                                                                                                        bd353ebe41fe62e82b7c83f22b8056af0c62818d

                                                                                                                                        SHA256

                                                                                                                                        88ceb16f37cf1abb02ca1f1d1a6f73fc24798b7c778d536d0a41cb46bbe56f91

                                                                                                                                        SHA512

                                                                                                                                        6f575617fef2c1af7e8bd232ebcf93e7413194324202049ab464b3a1755376bc52456874b9652180508ab43e979b4899f0fa48ec1f1095dc2484d32765a4c4d4

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        1094316e53f49c0342ccd16c79db7e43

                                                                                                                                        SHA1

                                                                                                                                        4ee1e04540c64ceadf84a727e420f394c6089e10

                                                                                                                                        SHA256

                                                                                                                                        8779610ff81c876d2257de0aba2844c0f00989b7c49cbb1e0115f7da3d36a04d

                                                                                                                                        SHA512

                                                                                                                                        d8a9e1a1fa5c372a989b72257adc7098ee7468b6bc422b087c635522f91bce0ff49a51db803ac5647dd5065c7df439a6917f747b6d91d6ef8538d71f81c82973

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        9d08ef49802248dd148d51e5a63cb79c

                                                                                                                                        SHA1

                                                                                                                                        d59e6b4ae2e5c67b35ee7f0ac9f4ea790d0bebab

                                                                                                                                        SHA256

                                                                                                                                        aeb7a4ec00673ffc75797cff0c2b313a8310b11205ab0072485ab88f430c50a0

                                                                                                                                        SHA512

                                                                                                                                        e57b2c391c4ff393110ce818c6f6fc1be3934028e77517fbe2a21c5e9944064fc80bb6d37c04eaaca91a84f1209371bdbb9f074ed072c9e073c097684b8395f3

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        f81fbc6d680ccf6c0e6838b25e3f1800

                                                                                                                                        SHA1

                                                                                                                                        8fa1ed337fb90cdb42b0bfda214e61aab8016a97

                                                                                                                                        SHA256

                                                                                                                                        8f71b6167f8691a58f168746cea24224f83689c73b2d0869f8151bca81e6936d

                                                                                                                                        SHA512

                                                                                                                                        a178612107e640729c5086f2e6d05f471488131147750fad6dab1c2aaf230c1e76a0bff2dae0d73849791ea55d53ca4cc93b9183b0f203aaf81d79af46ec638e

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        7cac44665ff9af27a805905486b48750

                                                                                                                                        SHA1

                                                                                                                                        6002cdf4d806f28bd665d0dc5cd43ff059d94ad6

                                                                                                                                        SHA256

                                                                                                                                        52ac30069ac8cae7221cfb9f30b42616ed8dd4efdcd498541519c20aa2dddd13

                                                                                                                                        SHA512

                                                                                                                                        0b9b979dfb3d872123ae25956c8e8e7ece9863aa17654871050600c6a69ac588e973dbbbe10b5fe578c67f761ccdfa50822d5283db4f255f71084ee59e52f543

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OY0860T8\POicon[1].bin
                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        MD5

                                                                                                                                        3ef9efb5c3c17e2b685057beac484e0b

                                                                                                                                        SHA1

                                                                                                                                        92e7ae0ebf2b57d72ea4091f065f29187cdf76fa

                                                                                                                                        SHA256

                                                                                                                                        20b0f94844860501e115fccd5c1462b2e2c932041d7989dc51c6d885b3429d8a

                                                                                                                                        SHA512

                                                                                                                                        6631ba4269375b502eccbcf601b0daccc98538f36bc0e1e2e5e48a28b4b9f523e06cb46d14b7ac2c60f70ce258b873fc42e31ebfb5237cb43cba7fb6a428eafc

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\OperaGX.exe
                                                                                                                                        Filesize

                                                                                                                                        3.2MB

                                                                                                                                        MD5

                                                                                                                                        b5f1c960a78c15e6bc1e1ad2f6dd924d

                                                                                                                                        SHA1

                                                                                                                                        6aa83952c863d281857996ded4be5411d6d7bfb0

                                                                                                                                        SHA256

                                                                                                                                        1617c6a6ffdf7655f74699172568d3ad03b6268387e22ffae8007bd7be06a903

                                                                                                                                        SHA512

                                                                                                                                        a6546d4217922f3f272a936f58d5e6ebfc4b02adc702d201c1fca42429f657d9729c01aaf541fde2c61baf499dff53085ea762a571c76db84f1f4e1d4559bdf3

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\3b1f17c7-84dd-47fc-830e-359d83a28912.down_data
                                                                                                                                        Filesize

                                                                                                                                        555KB

                                                                                                                                        MD5

                                                                                                                                        5683c0028832cae4ef93ca39c8ac5029

                                                                                                                                        SHA1

                                                                                                                                        248755e4e1db552e0b6f8651b04ca6d1b31a86fb

                                                                                                                                        SHA256

                                                                                                                                        855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

                                                                                                                                        SHA512

                                                                                                                                        aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\7f3632afdee7118812dd116069729b41
                                                                                                                                        Filesize

                                                                                                                                        6.9MB

                                                                                                                                        MD5

                                                                                                                                        7f3632afdee7118812dd116069729b41

                                                                                                                                        SHA1

                                                                                                                                        ed116033aff765c3eb24c3059aff6c6fb0be0c0c

                                                                                                                                        SHA256

                                                                                                                                        6c98e86a6d732761ef8b8b2df2646f55190657e02201ec8ab8b9137345154c5a

                                                                                                                                        SHA512

                                                                                                                                        44948874e9d243c234882ab1db269fd729f57ad5fb36a3b22428e0d78a9fe5a05366ed2eb97d0331caa0ef1b622528130344016e13f809b266dc1bdc10ebf9ed

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411110718181\additional_file0.tmp
                                                                                                                                        Filesize

                                                                                                                                        1.4MB

                                                                                                                                        MD5

                                                                                                                                        e9a2209b61f4be34f25069a6e54affea

                                                                                                                                        SHA1

                                                                                                                                        6368b0a81608c701b06b97aeff194ce88fd0e3c0

                                                                                                                                        SHA256

                                                                                                                                        e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

                                                                                                                                        SHA512

                                                                                                                                        59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411110718181\assistant\assistant_installer.exe
                                                                                                                                        Filesize

                                                                                                                                        1.8MB

                                                                                                                                        MD5

                                                                                                                                        4c8fbed0044da34ad25f781c3d117a66

                                                                                                                                        SHA1

                                                                                                                                        8dd93340e3d09de993c3bc12db82680a8e69d653

                                                                                                                                        SHA256

                                                                                                                                        afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

                                                                                                                                        SHA512

                                                                                                                                        a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS0ADEFE09\setup.exe
                                                                                                                                        Filesize

                                                                                                                                        6.5MB

                                                                                                                                        MD5

                                                                                                                                        dcc0d15e77a7872758e65deb0bfc6745

                                                                                                                                        SHA1

                                                                                                                                        1efb89e143bf5edd34d46ae8370ecc13d4c3339f

                                                                                                                                        SHA256

                                                                                                                                        87a168a04a254b1cf1adfe732e8b7b08d5c3e76ddca4e8b7fb4e58ebef85fe64

                                                                                                                                        SHA512

                                                                                                                                        9cb972bcd99fd03a924bbff79e8989a040d1202a77c9d8f62ea862cc6b1d258778410ad9a4de5f2aab43062f5e9fe17d7ab9baa000de98d22a47f1471d1de778

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2411110718177354508.dll
                                                                                                                                        Filesize

                                                                                                                                        6.0MB

                                                                                                                                        MD5

                                                                                                                                        1b07ce60bc1c77f0cadf13c2e62b1383

                                                                                                                                        SHA1

                                                                                                                                        ca70d0ef99ae5d1ebf85880ee669ad1145e4d79d

                                                                                                                                        SHA256

                                                                                                                                        e48eb19ca0210f9063f4e77c2f14293ee940eeaef2ecb9efceac7f6336cc203f

                                                                                                                                        SHA512

                                                                                                                                        94c358b6dfef0fcb0012a3a43235292b18ebf897043baef0c110570e91cc73721b12f1f771df6d000b4097f3c0cc22dcc65330a9153c7a9643787d24da6108f0

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
                                                                                                                                        Filesize

                                                                                                                                        3.8MB

                                                                                                                                        MD5

                                                                                                                                        bf6eed6cdc17a0130189a33a55ef5209

                                                                                                                                        SHA1

                                                                                                                                        e337f5a0931f69c464f162385f1330b4d27b372f

                                                                                                                                        SHA256

                                                                                                                                        ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168

                                                                                                                                        SHA512

                                                                                                                                        90d23fd84007343e85f9fc003cf826b112fd930216a24d8c1488468443ae2a4b0c3cc2426b91c81a8228e125050e922fce05672e010e65247709fc4a7b856f1d

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_43aag455.cps.ps1
                                                                                                                                        Filesize

                                                                                                                                        60B

                                                                                                                                        MD5

                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                        SHA1

                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                        SHA256

                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                        SHA512

                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\~os7C1D.tmp\pmservice.exe
                                                                                                                                        Filesize

                                                                                                                                        4.2MB

                                                                                                                                        MD5

                                                                                                                                        4ef95918e313c7ca01084629416fc714

                                                                                                                                        SHA1

                                                                                                                                        5bdaba6920d3f4d1f8ea47ce693276530b5f2a9c

                                                                                                                                        SHA256

                                                                                                                                        303707068aab06ab0341178558c28ce1670d10f16c39522859c4f21097a87ee9

                                                                                                                                        SHA512

                                                                                                                                        75861731e9ec1a43741b2b84f60677e9fdf26d5db8d6e4e91297f826fc2c357272c18cede7f64c42798f5459900b33d693ababe4e1140e4cfc54ef7a04af633a

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\link.txt
                                                                                                                                        Filesize

                                                                                                                                        56B

                                                                                                                                        MD5

                                                                                                                                        2e9d3a427cb6930acd2659c0ee7b6442

                                                                                                                                        SHA1

                                                                                                                                        884021846a57fa95d1e8e12e632ec2837900b090

                                                                                                                                        SHA256

                                                                                                                                        064e43454d3c72ee5e250b3425d25677cac58fe82147bba3d5d547766f618a1f

                                                                                                                                        SHA512

                                                                                                                                        3820f8c0a07de611c41de1bbbd8b55a352d7f5031b411e3b9f7891e86ecc1c38cde97bb2afd2294e5bd3e9a18e057c389f4ae7a9f8c1b8249206f691a7a23611

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                        Filesize

                                                                                                                                        2B

                                                                                                                                        MD5

                                                                                                                                        f3b25701fe362ec84616a93a45ce9998

                                                                                                                                        SHA1

                                                                                                                                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                                                        SHA256

                                                                                                                                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                                                        SHA512

                                                                                                                                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                                                                                                                        Filesize

                                                                                                                                        40B

                                                                                                                                        MD5

                                                                                                                                        b65c5c633e2f14819937041a3b8dde55

                                                                                                                                        SHA1

                                                                                                                                        b51ede54214fae487c8f21f67a3c9c4011dfa195

                                                                                                                                        SHA256

                                                                                                                                        b09a59124969b0a5723154ceab08dcec174c970580534f43d598aabfaab68c1e

                                                                                                                                        SHA512

                                                                                                                                        907095ee4625121668f57466d86d30a23defe87ebac57f77742ed92d454f70b714eaf55a7cf16e18b6ac50d6d7268afc1a0f9382f1ac98c00c42ecab3f90aba2

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                                                                                                                        Filesize

                                                                                                                                        40B

                                                                                                                                        MD5

                                                                                                                                        677618d9216d52cd9bfcb7ababf36398

                                                                                                                                        SHA1

                                                                                                                                        74a782d62a3ea5cbafa6a0998255f15c1060b2b6

                                                                                                                                        SHA256

                                                                                                                                        facf92440b813335ed7e085f90b6fe6ab66a18709ef61675e9b2656469c27e46

                                                                                                                                        SHA512

                                                                                                                                        4bbb9b4c426c3c460d50293c3fd062d0fde2082e211d69fac6828d4343253deeac3b1f52da4dcdb1cb03e1140fdebb8c2aa6ea137f576bd3781543a400737b27

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\Downloads\Delta V3.61 b_30946817.exe
                                                                                                                                        Filesize

                                                                                                                                        5.7MB

                                                                                                                                        MD5

                                                                                                                                        15d1c495ff66bf7cea8a6d14bfdf0a20

                                                                                                                                        SHA1

                                                                                                                                        942814521fa406a225522f208ac67f90dbde0ae7

                                                                                                                                        SHA256

                                                                                                                                        61c2c4a5d7c14f77ee88871ded4cc7f1e49dae3e4ef209504c66fedf4d22de42

                                                                                                                                        SHA512

                                                                                                                                        063169f22108ac97a3ccb6f8e97380b1e48eef7a07b8fb20870b9bd5f03d7279d3fb10a69c09868beb4a1672ebe826198ae2d0ea81df4d29f9a288ea4f2b98d8

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat
                                                                                                                                        Filesize

                                                                                                                                        280B

                                                                                                                                        MD5

                                                                                                                                        de0e4aac2b8623de31fbe1fc42303b60

                                                                                                                                        SHA1

                                                                                                                                        80c29edc89a3c18f4a666f90ffacfa8fee95d0c8

                                                                                                                                        SHA256

                                                                                                                                        dda3a1a6290f404f1dd86a37ed694e590a255e4edcf7841fcd9b046d05540d10

                                                                                                                                        SHA512

                                                                                                                                        cb33aad0f77b412f1b6ac949d4b021650c2f74f21095a271157ba995dddc1299a02046c62220b5ea02914813f386ec16d369af40835e00dba91246e0103254c5

                                                                                                                                        Download Submit

                                                                                                                                      • memory/1468-641-0x00000000036E0000-0x00000000036E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/1468-652-0x00000000036E0000-0x00000000036E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/1468-649-0x00000000036E0000-0x00000000036E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/1468-651-0x00000000036E0000-0x00000000036E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/1468-650-0x00000000036E0000-0x00000000036E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/1468-648-0x00000000036E0000-0x00000000036E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/1468-647-0x00000000036E0000-0x00000000036E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/1468-646-0x00000000036E0000-0x00000000036E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/1468-642-0x00000000036E0000-0x00000000036E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/1468-640-0x00000000036E0000-0x00000000036E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1593-0x0000000007AB0000-0x0000000007ABA000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        40KB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1594-0x0000000007EA0000-0x0000000007EC6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        152KB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1592-0x0000000007E10000-0x0000000007E2C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        112KB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1590-0x0000000008280000-0x00000000088FA000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.5MB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1591-0x0000000007C30000-0x0000000007C4A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        104KB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1589-0x0000000007AD0000-0x0000000007B74000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        656KB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1588-0x0000000007AA0000-0x0000000007ABE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        120KB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1579-0x0000000066070000-0x00000000660BC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1578-0x0000000007A60000-0x0000000007A94000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        208KB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1577-0x00000000068F0000-0x000000000693C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1576-0x00000000068D0000-0x00000000068EE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        120KB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1567-0x0000000005D30000-0x0000000005D96000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        408KB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1566-0x0000000005CC0000-0x0000000005D26000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        408KB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1557-0x0000000005E00000-0x000000000642A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.2MB

                                                                                                                                        Download

                                                                                                                                      • memory/1512-1556-0x0000000005660000-0x0000000005696000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        216KB

                                                                                                                                        Download

                                                                                                                                      • memory/2908-785-0x0000000005A80000-0x0000000005A81000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/2908-786-0x0000000005A80000-0x0000000005A81000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/4204-717-0x00007FFC75F70000-0x00007FFC7602D000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        756KB

                                                                                                                                        Download

                                                                                                                                      • memory/4204-725-0x00007FFC76D20000-0x00007FFC76D8F000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        444KB

                                                                                                                                        Download

                                                                                                                                      • memory/4204-718-0x00007FFC74BF0000-0x00007FFC74F64000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.5MB

                                                                                                                                        Download

                                                                                                                                      • memory/4204-729-0x00007FFC73DF0000-0x00007FFC73E32000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        264KB

                                                                                                                                        Download

                                                                                                                                      • memory/4204-726-0x00007FFC60C10000-0x00007FFC6110A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        5.0MB

                                                                                                                                        Download

                                                                                                                                      • memory/4204-728-0x00007FFC6DE70000-0x00007FFC6DF7C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.0MB

                                                                                                                                        Download

                                                                                                                                      • memory/4204-730-0x00007FFC760E0000-0x00007FFC7688E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/4204-727-0x00007FFC74000000-0x00007FFC74067000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        412KB

                                                                                                                                        Download

                                                                                                                                      • memory/5376-913-0x0000000006840000-0x0000000006848000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                        Download

                                                                                                                                      • memory/5376-911-0x0000000000C80000-0x0000000001D86000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        17.0MB

                                                                                                                                        Download

                                                                                                                                      • memory/5376-914-0x0000000007090000-0x00000000070C8000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        224KB

                                                                                                                                        Download

                                                                                                                                      • memory/5376-915-0x0000000006850000-0x000000000685E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        56KB

                                                                                                                                        Download

                                                                                                                                      • memory/6132-1078-0x0000000010760000-0x0000000010D06000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        5.6MB

                                                                                                                                        Download

                                                                                                                                      • memory/6132-1079-0x000000000F6D0000-0x000000000F762000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        584KB

                                                                                                                                        Download

                                                                                                                                      • memory/6132-1046-0x0000000006BC0000-0x0000000006C70000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        704KB

                                                                                                                                        Download

                                                                                                                                      • memory/6132-1047-0x0000000007030000-0x00000000070A6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        472KB

                                                                                                                                        Download

                                                                                                                                      • memory/6132-1050-0x0000000006FE0000-0x0000000007002000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                        Download

                                                                                                                                      • memory/6132-1051-0x00000000070B0000-0x00000000070CE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        120KB

                                                                                                                                        Download

                                                                                                                                      • memory/6132-1052-0x0000000007560000-0x00000000078B7000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/6132-1053-0x00000000079D0000-0x0000000007A6C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        624KB

                                                                                                                                        Download

                                                                                                                                      • memory/6132-1054-0x000000000C700000-0x000000000C708000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                        Download