hxxps://captechu-csm[.]symplicity[.]com/track/f5e362lfff37616874ff0f55c7b29a91/2309202309420/realurl=hxxps://dsenet[.]web[.]app/bnydaBM2x0gprWO3fi2Ps3Ri2PWO3dy9s3RWO3BM2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2023 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://captechu-csm.symplicity.com/track/f5e362lfff37616874ff0f55c7b29a91/2309202309420/realurl=https://dsenet.web.app/bnydaBM2x0gprWO3fi2Ps3Ri2PWO3dy9s3RWO3BM2

Score

8^/10

adware discovery persistence stealer

Malware Config

Signatures

Downloads MZ/PE file

Modifies Installed Components in the registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

setup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.34\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe

Executes dropped EXE 15 IoCs

Processes:

MicrosoftEdgeSetup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_112.0.1722.34.exesetup.exesetup.exesetup.exe

pid	process
1520	MicrosoftEdgeSetup.exe
1312	MicrosoftEdgeUpdate.exe
3192	MicrosoftEdgeUpdate.exe
4740	MicrosoftEdgeUpdate.exe
1276	MicrosoftEdgeUpdateComRegisterShell64.exe
3336	MicrosoftEdgeUpdateComRegisterShell64.exe
312	MicrosoftEdgeUpdateComRegisterShell64.exe
4260	MicrosoftEdgeUpdate.exe
2712	MicrosoftEdgeUpdate.exe
8	MicrosoftEdgeUpdate.exe
3684	MicrosoftEdgeUpdate.exe
436	MicrosoftEdge_X64_112.0.1722.34.exe
4296	setup.exe
2400	setup.exe
2972	setup.exe

Loads dropped DLL 15 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

pid	process
1312	MicrosoftEdgeUpdate.exe
3192	MicrosoftEdgeUpdate.exe
4740	MicrosoftEdgeUpdate.exe
1276	MicrosoftEdgeUpdateComRegisterShell64.exe
4740	MicrosoftEdgeUpdate.exe
3336	MicrosoftEdgeUpdateComRegisterShell64.exe
4740	MicrosoftEdgeUpdate.exe
312	MicrosoftEdgeUpdateComRegisterShell64.exe
4740	MicrosoftEdgeUpdate.exe
4260	MicrosoftEdgeUpdate.exe
2712	MicrosoftEdgeUpdate.exe
8	MicrosoftEdgeUpdate.exe
8	MicrosoftEdgeUpdate.exe
2712	MicrosoftEdgeUpdate.exe
3684	MicrosoftEdgeUpdate.exe

Registers COM server for autorun 1 TTPs 43 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exesetup.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.34\\notification_helper.exe\""	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.34\\BHO\\ie_to_edge_bho_64.dll"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.34\\notification_helper.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.34\\notification_click_helper.exe\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.34\\notification_click_helper.exe"	setup.exe

Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

setup.exe

description ioc process

Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce setup.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	setup.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

setup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

Processes:

setup.exeMicrosoftEdgeSetup.exeMicrosoftEdge_X64_112.0.1722.34.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\wns_push_client.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\MEIPreload\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Locales\ne.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\identity_proxy\beta.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\identity_proxy\win11\identity_helper.Sparse.Dev.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\msedge.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\icudtl.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Locales\as.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Locales\tt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\Locales\lb.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_gd.dll	MicrosoftEdgeSetup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\vccorlib140.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\mspdf.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\VisualElements\SmallLogo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\dwritemin.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Locales\eu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\Locales\bg.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_ar.dll	MicrosoftEdgeSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_quz.dll	MicrosoftEdgeSetup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\ffmpeg.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\identity_proxy\win11\identity_helper.Sparse.Canary.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\VisualElements\LogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\Trust Protection Lists\Sigma\Analytics	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_pt-BR.dll	MicrosoftEdgeSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B613497B-6D49-4525-9435-8A18F74A67B2}\EDGEMITMP_98C91.tmp\SETUP.EX_	MicrosoftEdge_X64_112.0.1722.34.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Locales\mr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\show_third_party_software_licenses.bat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\wdag.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Trust Protection Lists\Mu\Entities	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\MEIPreload\preloaded_data.pb	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\Locales\nn.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_id.dll	MicrosoftEdgeSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_as.dll	MicrosoftEdgeSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_tt.dll	MicrosoftEdgeSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\v8_context_snapshot.bin	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Locales\he.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Locales\lb.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\Trust Protection Lists\manifest.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_sr-Latn-RS.dll	MicrosoftEdgeSetup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Locales\bg.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Locales\en-GB.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\Locales\ur.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\Trust Protection Lists\Mu\LICENSE	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\MicrosoftEdgeUpdateOnDemand.exe	MicrosoftEdgeSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\msedge.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Trust Protection Lists\Sigma\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\Trust Protection Lists\Mu\Fingerprinting	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\Trust Protection Lists\Mu\TransparentAdvertisers	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\Locales\sl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\identity_proxy\win10\identity_helper.Sparse.Stable.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B613497B-6D49-4525-9435-8A18F74A67B2}\EDGEMITMP_98C91.tmp\setup.exe	MicrosoftEdge_X64_112.0.1722.34.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_ru.dll	MicrosoftEdgeSetup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\identity_proxy\dev.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Locales\sr-Latn-RS.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\identity_proxy\win10\identity_helper.Sparse.Stable.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\Locales\fil.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Locales\en-GB.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\msedge_wer.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\mip_core.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\Trust Protection Lists\Mu\Content	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\VisualElements\LogoCanary.png	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d42e80ebae45d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

setup.exeiexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E1F655EA-D585-11ED-9EF6-C2E0088FA829} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3080356558"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70646db49269d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000016b1b6fc7cfc59429b2ebf78760d5fe30000000002000000000010660000000100002000000080a1d77332f63416030cb78a5ff269c99359ae6661770a20add04a35c5ac7c22000000000e8000000002000020000000c50794219c1a8f0a94148e0fa18a39a32b51a9180a20cb5c234edfff8ce731f72000000089315183427a058b8315c69bb82168d602692eb5c8fc28b1d0f9e7347cb6d0b340000000322de0e981d5dd97b87f4f16899e605315c3e46e6f5128d93c615692de5afbc11fd75bb48643d510174cc6ca5e78eb8e80240c84bcad9949862e96d6372574b6	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{C1322D7D-78E1-42EE-8139-ED57E3F75A2F}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "387665630"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\symplicity.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.34\\BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\112.0.1722.34\\BHO"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31025554"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31025554"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\DOMStorage\symplicity.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\symplicity.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3080356558"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute	setup.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exesetup.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xht	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CurVer\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.mht\OpenWithProgids	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.shtml\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO.1\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ie_to_edge_bho.dll	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

MicrosoftEdgeUpdate.exesetup.exewwahost.exeLocalBridge.exe

pid	process
1312	MicrosoftEdgeUpdate.exe
1312	MicrosoftEdgeUpdate.exe
2972	setup.exe
2972	setup.exe
4348	wwahost.exe
4348	wwahost.exe
3352	LocalBridge.exe
3352	LocalBridge.exe
3352	LocalBridge.exe
3352	LocalBridge.exe
3352	LocalBridge.exe
3352	LocalBridge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

MicrosoftEdgeUpdate.exewwahost.exe

description pid process

Token: SeDebugPrivilege 1312 MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege 4348 wwahost.exe
Token: SeDebugPrivilege 4348 wwahost.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

1252 iexplore.exe
1252 iexplore.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exeIEXPLORE.EXEwwahost.exe

pid process

1252 iexplore.exe
1252 iexplore.exe
968 IEXPLORE.EXE
968 IEXPLORE.EXE
968 IEXPLORE.EXE
968 IEXPLORE.EXE
4348 wwahost.exe

description	pid	process
Token: SeDebugPrivilege	1312	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4348	wwahost.exe
Token: SeDebugPrivilege	4348	wwahost.exe

pid	process
1252	iexplore.exe
1252	iexplore.exe

pid	process
1252	iexplore.exe
1252	iexplore.exe
968	IEXPLORE.EXE
968	IEXPLORE.EXE
968	IEXPLORE.EXE
968	IEXPLORE.EXE
4348	wwahost.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

iexplore.exeMicrosoftEdgeSetup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_112.0.1722.34.exesetup.exe

description	pid	process	target process
PID 1252 wrote to memory of 968	1252	iexplore.exe	IEXPLORE.EXE
PID 1252 wrote to memory of 968	1252	iexplore.exe	IEXPLORE.EXE
PID 1252 wrote to memory of 968	1252	iexplore.exe	IEXPLORE.EXE
PID 1252 wrote to memory of 1520	1252	iexplore.exe	MicrosoftEdgeSetup.exe
PID 1252 wrote to memory of 1520	1252	iexplore.exe	MicrosoftEdgeSetup.exe
PID 1252 wrote to memory of 1520	1252	iexplore.exe	MicrosoftEdgeSetup.exe
PID 1520 wrote to memory of 1312	1520	MicrosoftEdgeSetup.exe	MicrosoftEdgeUpdate.exe
PID 1520 wrote to memory of 1312	1520	MicrosoftEdgeSetup.exe	MicrosoftEdgeUpdate.exe
PID 1520 wrote to memory of 1312	1520	MicrosoftEdgeSetup.exe	MicrosoftEdgeUpdate.exe
PID 1312 wrote to memory of 3192	1312	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1312 wrote to memory of 3192	1312	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1312 wrote to memory of 3192	1312	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1312 wrote to memory of 4740	1312	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1312 wrote to memory of 4740	1312	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1312 wrote to memory of 4740	1312	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4740 wrote to memory of 1276	4740	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 4740 wrote to memory of 1276	4740	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 4740 wrote to memory of 3336	4740	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 4740 wrote to memory of 3336	4740	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 4740 wrote to memory of 312	4740	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 4740 wrote to memory of 312	4740	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 1312 wrote to memory of 4260	1312	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1312 wrote to memory of 4260	1312	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1312 wrote to memory of 4260	1312	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1312 wrote to memory of 2712	1312	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1312 wrote to memory of 2712	1312	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1312 wrote to memory of 2712	1312	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 8 wrote to memory of 3684	8	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 8 wrote to memory of 3684	8	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 8 wrote to memory of 3684	8	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 8 wrote to memory of 436	8	MicrosoftEdgeUpdate.exe	MicrosoftEdge_X64_112.0.1722.34.exe
PID 8 wrote to memory of 436	8	MicrosoftEdgeUpdate.exe	MicrosoftEdge_X64_112.0.1722.34.exe
PID 436 wrote to memory of 4296	436	MicrosoftEdge_X64_112.0.1722.34.exe	setup.exe
PID 436 wrote to memory of 4296	436	MicrosoftEdge_X64_112.0.1722.34.exe	setup.exe
PID 4296 wrote to memory of 2400	4296	setup.exe	setup.exe
PID 4296 wrote to memory of 2400	4296	setup.exe	setup.exe
PID 4296 wrote to memory of 2972	4296	setup.exe	setup.exe
PID 4296 wrote to memory of 2972	4296	setup.exe	setup.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

setup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1"	setup.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://captechu-csm.symplicity.com/track/f5e362lfff37616874ff0f55c7b29a91/2309202309420/realurl=https://dsenet.web.app/bnydaBM2x0gprWO3fi2Ps3Ri2PWO3dy9s3RWO3BM2
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:968

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\MicrosoftEdgeSetup.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\MicrosoftEdgeSetup.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1520

C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&usagestats=0"
3⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3192

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4740

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1276

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:3336

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:312

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTY4RDU4MjctQ0ZGNi00N0Q2LUIzOUEtRjE1RDJBNEY5N0FCfSIgdXNlcmlkPSJ7OTBGRTRBMzgtNDAwQS00NjI0LUExNTUtMDhDNDVBOTE4REFEfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezFEQzc0RDdELTM5MTAtNEMyNi1BQ0QxLTlFQTI5RkVGRjE3Nn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI0IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cVdKU3pXd1BmZGNMUitYR0l2NnhyWmZpWU94aFBVMnMxTldtaldjYUZQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3My40NSIgbmV4dHZlcnNpb249IjEuMy4xNzMuNTUiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ1NTkyMzYwNTIiIGluc3RhbGxfdGltZV9tcz0iMTA2MiIvPjwvYXBwPjwvcmVxdWVzdD4
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4260

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&usagestats=0" /installsource taggedmi /sessionid "{568D5827-CFF6-47D6-B39A-F15D2A4F97AB}"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:8

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTY4RDU4MjctQ0ZGNi00N0Q2LUIzOUEtRjE1RDJBNEY5N0FCfSIgdXNlcmlkPSJ7OTBGRTRBMzgtNDAwQS00NjI0LUExNTUtMDhDNDVBOTE4REFEfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezBGQTc3RTdGLURBNDMtNDAwRi04RjBFLTRCN0UyNjhERTAwQX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI0IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cVdKU3pXd1BmZGNMUitYR0l2NnhyWmZpWU94aFBVMnMxTldtaldjYUZQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ1Njc5ODY0NDIiLz48L2FwcD48L3JlcXVlc3Q-
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:3684

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B613497B-6D49-4525-9435-8A18F74A67B2}\MicrosoftEdge_X64_112.0.1722.34.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B613497B-6D49-4525-9435-8A18F74A67B2}\MicrosoftEdge_X64_112.0.1722.34.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:436

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B613497B-6D49-4525-9435-8A18F74A67B2}\EDGEMITMP_98C91.tmp\setup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B613497B-6D49-4525-9435-8A18F74A67B2}\EDGEMITMP_98C91.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B613497B-6D49-4525-9435-8A18F74A67B2}\MicrosoftEdge_X64_112.0.1722.34.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Registers COM server for autorun
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4296

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B613497B-6D49-4525-9435-8A18F74A67B2}\EDGEMITMP_98C91.tmp\setup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B613497B-6D49-4525-9435-8A18F74A67B2}\EDGEMITMP_98C91.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
4⤵
- Executes dropped EXE
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\112.0.1722.34\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:4408

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3352

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4348

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Installer\setup.exe
Filesize
3.8MB

MD5
c105d65a7ed6572b0681b1b72b924c2b

SHA1
6594d416a722f3e457d0a677931cdd8a886196c1

SHA256
255318a6dc36b5ad26336f39566fc98a2b71e6ab0b3eca923f0f512ec7986430

SHA512
a65bebe056d8ba87374a6a6d4ced039aaa15084a0a10b3a8914f87d973d236de457108cc9bec3171e93752a9a3a9d2ae8a5da6b7c57534678cc9560570a42358

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\112.0.1722.34\MicrosoftEdge_X64_112.0.1722.34.exe
Filesize
135.9MB

MD5
2aec6fd4886456ed6003cd0e3461dd62

SHA1
153fc95e421f469d8a4bba947ad7100a626be648

SHA256
ea4ad67a644d46c8f4587e17a40999dbe4df0342b485478fd6e6c36f505eb2be

SHA512
c1cb89dd34bd38eed473855be30c07daa5b84a11bc2a6d21fa7699d88129508c99d8f899d4fb66b68c283156dc0a5d5322547079261f7271a58878a17bd1e90b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
Filesize
201KB

MD5
d7dec1752172a55a855da132e6b685cb

SHA1
ece34bdfee10b09c62fa52c205a47594e024eafe

SHA256
5dfc43333a2360ad916f67bf783d8260a32d811a738b3d2e58427b1b384ff9a3

SHA512
aff3de4e68f4266389d8ff58186bb2b7deef4cf09c05150fd7bef851685b25bff718c803cf19c32db1bd23e2f6ae5396f4d7611bd06f84c158e43b7600367e44

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\EdgeUpdate.dat
Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\MicrosoftEdgeComRegisterShellARM64.exe
Filesize
179KB

MD5
2ea2a38eeec085cccce81efcf0aaa935

SHA1
e34877d621190761a044dad1a0cb3156aeded718

SHA256
c4392d342e0957aec69ea4cf61ee529ca33184f64682e6dff13908197e47de1d

SHA512
8d79a1a4933401ab9ad1bc39bec808cb95d4295e3755f4696fe0aeec46c6c5fb936a35c3e666d0e0bbe1b2f22a0a521c0c309658bb5563353d0b51065ec18676

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\MicrosoftEdgeUpdate.exe
Filesize
201KB

MD5
d7dec1752172a55a855da132e6b685cb

SHA1
ece34bdfee10b09c62fa52c205a47594e024eafe

SHA256
5dfc43333a2360ad916f67bf783d8260a32d811a738b3d2e58427b1b384ff9a3

SHA512
aff3de4e68f4266389d8ff58186bb2b7deef4cf09c05150fd7bef851685b25bff718c803cf19c32db1bd23e2f6ae5396f4d7611bd06f84c158e43b7600367e44

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\MicrosoftEdgeUpdate.exe
Filesize
201KB

MD5
d7dec1752172a55a855da132e6b685cb

SHA1
ece34bdfee10b09c62fa52c205a47594e024eafe

SHA256
5dfc43333a2360ad916f67bf783d8260a32d811a738b3d2e58427b1b384ff9a3

SHA512
aff3de4e68f4266389d8ff58186bb2b7deef4cf09c05150fd7bef851685b25bff718c803cf19c32db1bd23e2f6ae5396f4d7611bd06f84c158e43b7600367e44

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
Filesize
212KB

MD5
43935be0f50ff815501a998039e29e08

SHA1
01005e0fe4225bd30877f3ad5768b4450e0f6ff8

SHA256
a7081bd1b6f55f357cb75f5174555081dcd4c207ccc954f53fd97776a36bf099

SHA512
6a023a7a2e1405e2bb833adbe28270822258ab4d099f9e732c287c50c412f596241468fbc462a88f62be1927f71944ea7d67e328fb5ce146f6def334b69c10fd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\MicrosoftEdgeUpdateCore.exe
Filesize
257KB

MD5
2c3e39662f0133a970c2766190e4f84a

SHA1
341294810d14e19310907ef8e763bc7b70b256b4

SHA256
1d87553f4872e1dd46856eb492c06b280e57019f06609257cbe18226309d9264

SHA512
c046d10b70175022486a9ee66ced9e41ba0a6a1ccc0983b6cef7a3ddadacf73d158ad351721304f5e164a8a37f27c0a0a6a9d772ebfeb3962be3837864547552

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\NOTICE.TXT
Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdate.dll
Filesize
2.1MB

MD5
fa3ab8067d5ca8429d04c00d2640a654

SHA1
b4425dc963b9852e2633a212166af5c2bfc77083

SHA256
35e5dc8c698a118017ef4fbc81fb78215b940450e1c5090429483e78ed51d8ac

SHA512
70057b38f5e322de634c4e5103e65b38f74947da3aecb12202de155d843863840915a1464a0b269bf6abf02a9f750f2301b3b5c9a4d76581529784ee02d3e90e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdate.dll
Filesize
2.1MB

MD5
fa3ab8067d5ca8429d04c00d2640a654

SHA1
b4425dc963b9852e2633a212166af5c2bfc77083

SHA256
35e5dc8c698a118017ef4fbc81fb78215b940450e1c5090429483e78ed51d8ac

SHA512
70057b38f5e322de634c4e5103e65b38f74947da3aecb12202de155d843863840915a1464a0b269bf6abf02a9f750f2301b3b5c9a4d76581529784ee02d3e90e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_af.dll
Filesize
28KB

MD5
81d6a33130e4fa2c86b2ec316f226841

SHA1
e5cf892441e309eddfc175dc9395fcda53b79621

SHA256
d3b9b0e80a280171fcf098a5107ce3edb115254cb772c35a65a3106d56a50877

SHA512
806ba7d03d5b97c80c0f75a8807f08b7d705514e983a9db1b54b9fbca2b49b093e72c495718b72bb5801dde7ea0d834f4925bfff28d19910b29d608375dea818

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_am.dll
Filesize
24KB

MD5
a18f339faae3bad25394616307c7ce24

SHA1
43e4068c28f7e149d535448fc475685bda1a5edf

SHA256
2f0226e30a3b42a9d95a66a6ee657cf105b54e0c40508ed092b37a3f0a751900

SHA512
ac283d3fe01cb1c543ae0c552eb424f99fba4c38ad3ef05e27b47675e87741feba45b6a1b98d38b4cde07f07543a76edc0d660881bbe10136fb220613684ae33

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_ar.dll
Filesize
26KB

MD5
8bcbb5d977876390837f3b5500bff0f9

SHA1
a00df822029124ec66ea4c9ee9a3c724468060b2

SHA256
d4c0efaa9d3596f0748e6b85e03377fe1e54f58494d61d61e579f6993f168e80

SHA512
ee0a08196643e9af16854895cfd22d4436845af8b50224e0140a5706b793e81b77c52bb78480f882fa2a7dd464b1658f04de4ef72de1ede972b389acb9bfd4bd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_as.dll
Filesize
28KB

MD5
60ea52dd241013ef388242999ba8f73f

SHA1
9b6d9d1119a656ecb24f12a17168626578956f99

SHA256
65cdf58c7aaa4911861b481b59c7b6596ebb6da6d3f23a7576263e73f64974cb

SHA512
206a213f6e2bfe7ff811a154e678928a740122c8ff4ba8a790f55bec6d0f69e360aed5dd814f01262bef34b1eb49d2de437963440a0a6fd63a82ba00490f9159

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_az.dll
Filesize
29KB

MD5
0754270c9c4b32b7bafdb2df30ff6770

SHA1
e7cf7ae4e7db85b266654bf8de356628922f9def

SHA256
3736071c6a94c9d1764db33916ff07a8f825f4ba23f5adaf583c1883dbb4d6e8

SHA512
adb3138f94e3aae97cbfea515c87182d4ce034d9fa63eb95f6e75a2ba5ecacb6886126654400def7eea80261ff5e7dca805149fe3e21d1333d311d9b05f4f2dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_bg.dll
Filesize
29KB

MD5
c494e91e4029ae95107c58699e3a3c51

SHA1
143ab229b4fcd1974f7847621e2dfb6b1e29eb3b

SHA256
0949f07de7c1bc5f5df5f45040457db5a65280439f6d71bd62f38f2c8f4272fe

SHA512
9f7842fe54225a48134ef9568a7edd31402cb6f3f75c50af44f17499a4a0673786c4178f7c6551bba8b014c8e6d98154bb0598fad76acc2fa9ff34566371a247

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_bn-IN.dll
Filesize
29KB

MD5
cd5059c506bf4492a036f36175e549dc

SHA1
6228dc08ec0247d675988d18923a026348f43620

SHA256
f9a5d9590f4a578cabb8e5e64294c1d6eb0df562ae9949dea7920e70c170b60e

SHA512
16b41e15fba70dba375005fbb1bc7bad52cd88dc171519dc45431601207dd8a6087406a58cb875a50d6e530f31446b4f8cf73430dfce5fba1a1f4c89e6e8d6c2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_bn.dll
Filesize
29KB

MD5
5e6febda95cfb0044ce6c7e5e2fc5758

SHA1
128fa8e990b105bb6015e4b8d6af319c1f0c42af

SHA256
f5f5302d1e5be4c91789fc3b546dd43b474ea9ccfd9ab6c40530fc11ecc22fea

SHA512
777734c3acd9369ee89f5eb2c3fa3ee2ade636b5742ddf64545dd801331b5ea08ac6e9b3a59ab1344ccfc0c8cf65a150530680e8668170c60538e88940315dac

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_bs.dll
Filesize
28KB

MD5
8f745e814b45a68742cbe73625040c5b

SHA1
adc05f35f0f0828a8b234ce00db344b889c45582

SHA256
2319ed5cb50ab53e1ae160c79e7374f9d42c6dd39c16d64e5905ed7e2d202f24

SHA512
e3d78a03373d3d66c86e3e190bccb95139d3b71e3b5e647d18a4d0c606b901c16bf9d13135fa97ca2c9f04dc4724c97c2623425fbc121f7b5929681afcb54eec

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
Filesize
29KB

MD5
2b382cab295db6395a544baa607fe9c4

SHA1
a52192873d1ff318603acbcee3f6d33155517885

SHA256
88c3e2b075934f4f0cc1f2c7204a27ac12989756f6cc91146179f33bb5d81f9e

SHA512
14439905ffac71692a150072631d5506e11796c21fad049e851a41d822f3f4a7980cffdb7a28940a365e92321866ab6d00a62c955cf689c29320aff08a11db8c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_ca.dll
Filesize
30KB

MD5
f0f002f841d7d73b660a75bf5103a051

SHA1
226cbe3a412329b65aae13cd7ee7073d4e1e2ba2

SHA256
05b62e8cbca0349981768c06d27a4e0c2af1d6c58b06240afecf294f22df7855

SHA512
346a1b09be2d7840728619125eb78796bd153612db6d5250a1f22929257d04b1c34b9be7a447be056e5e41ecafa98211d0a8a73753c1567dcdda067566942cbd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_cs.dll
Filesize
28KB

MD5
4bbc1b54e60189cd5c48f2cb34e89831

SHA1
b062321f19a04a44a86d68b0e4500fc3dc750509

SHA256
06cafa5a81188e84c05af1f3f20c9d078f3f8211b5cbd7bfd06f6d6f9b352343

SHA512
91a80bca894c542aaa9b8c91225430e74e1c69a50e91ead2d7ceb9d4d54c1fb141a1a4f7d9d2f0f7537cd7162bd476bedcc4ec9669f2ab5213f86286e59dfbcc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_cy.dll
Filesize
28KB

MD5
2669c3688d39fe32aaa1541f0fb41753

SHA1
b0462a961a3ff187f6830b2b00cf8884965f0cd4

SHA256
44a1db59ea7b0bb2b41983b972d8ccfa55eabda00c2f27596dc35e9b1bcc3c9d

SHA512
e4547b4637aec827f59cb024d43746706f4014fd9c7cce6b0c59e4164c5e10bdc5263a5b2d1422fc5c2a40b565da27d317abf77d042b1de2b887dd9885d79d53

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_da.dll
Filesize
28KB

MD5
55e7ed56fdad7015fadacc95f502d696

SHA1
7c92656547f16770de04b4c9f5f32e95f0b0925f

SHA256
a430dffa688ca050b542d35ed190074c0ff9050a89cfbf5b28b6ff8b41edfc6c

SHA512
cf1b0dcc4e201268ebb5443c54811a3837435877ff3764eb46f3f9456f59e93fe5a2d3b92ba94b9d9619eabef6e108fdbee715277a1ff665c95866d6b6a7fe5b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_de.dll
Filesize
30KB

MD5
a5747bb9fd358e3925184bc24ecfe639

SHA1
eed4d1d7581e096d6fe2a5e619b3ca83ba3b644a

SHA256
505596d1070d3f12ccc52fa02ff861d934f021e373d816fe39ae5e81029dd90c

SHA512
aa3da1a3552b92e803025ad422ddf077ff95706b9a04cc6e1bb7f21800e6a94a446d1a19dc477aa56e06bb6cf31fa6f480b5d54e6749dc311fde85f6a25222da

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_el.dll
Filesize
30KB

MD5
d63527a48a9a0a065380183a2b5ccf11

SHA1
fd54c529d09ab469dc92019b2989e89a9eda6450

SHA256
acefebba31f473bf7f1b81616f11072047c85ad732231bb29daa44052a89e58c

SHA512
9a8aa9387c57806a7fb32a1a1e1d22d62b7f735341ddfe8dda5bdc915a18be2d932c55e9dc78cefe53e173e0d0d2a8641e3f223fcbd188646291013f37dcb012

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_en-GB.dll
Filesize
27KB

MD5
2e95efe88a47b3d059b8fdb76afa07eb

SHA1
189972422c8332704f3306a4bc6d957b4566e971

SHA256
7639bf73bbbbd333ba569a02ccf91c6e14fcb70e61d0dc5e0c2dba06d6ac9e44

SHA512
c2f23726752a292bc5a6f7fd54470bda1117bd31f21bfaefae94c8720f2f89ed32df50a5bd1fab93972927fc04f3f1abd3964506942e0413dc5ee9db5def10e5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_en.dll
Filesize
27KB

MD5
6fb527f8b56ae008dc5d26df9861a0c8

SHA1
8e4b97b29a2adb0ca5c43f4f152cb8ea5de8e0c2

SHA256
ffeb20f1ab5fecdfc965d543466a8ef6e5798477d429f01be5bf119aaf88e6ed

SHA512
a9747c5981e7440eb5d232fd1112b7e2f00fab83d02ee27f36125825cf5cf9aeeca7376e79c2a8ad646ff6c8c74d32b15dcc2d3138bfc61a2bbda2e150c2261e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_es-419.dll
Filesize
29KB

MD5
a98aa1c883edca985f7ba5e74e875ceb

SHA1
451a1db9c0910c2d5b582d695282556ac9f6ea41

SHA256
e802d53b03ccf3f98cb138e0015fcd6092ac85837872176edf80cfdad97f61c3

SHA512
bdc2a4512f3e60fd57b4eded935a4b6a64073c7818e25f4f6324420cee9f112d27d53ed9b6a79a8c9c9f2548e091b303a5a4e1a412b2d724d976bfa000ade5c2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_es.dll
Filesize
28KB

MD5
e092380f29d079cd661f4aaf366cc9b6

SHA1
ffc5895ec6474af17cd649ed65a03870e71832fc

SHA256
a88166522bd981a3be76617f444284c74d8631cb767413288947a1fac1c78871

SHA512
2db85ef403005fa9f0a25a369895d7386c6076fcc9fa6994f408824cbed1ad4330d14163aaad26f5a066e21caaf25f6dfde74afd509b51ca44c6ed15bee2baae

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_et.dll
Filesize
28KB

MD5
933f494bb5413d9ad7b45d7f504e34de

SHA1
ea54c003a07119c9a44fcd86c2670a0af7703155

SHA256
6bff7b9527c6e666cacb1a1fc2241c5ad81f813b8733a70b1ceeede21cd4d9d4

SHA512
a31aab226ed0c12ba55c9bf5f00b15970680b8b296820cd76eb54d46d86758a15441518f5b5926c2af05c25dc9171bf8b974808d79483dfb1031836bc34fa002

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_eu.dll
Filesize
28KB

MD5
e2999c0869b92ce59e001c2ac1f6c76e

SHA1
2ebe6a4ffdf72bbb52e59c202d5edeb41fbba149

SHA256
ac2dada274606cb0b8407f8d168451b31ec27176d21cc65f4b359bc1fe410ec8

SHA512
b28fde14c38f8a3accc50e5ee3821aa514988e743a428172aeaa649e9e8ffce85788bd0382199cdcce6002985c2533c1fa5e698725d6412f7b1c0d50e8be170d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_fa.dll
Filesize
27KB

MD5
a23ccfff79196364e7850335d45f8f31

SHA1
f4d144e540050e16118917693438c66061db37ad

SHA256
8967f05d23e744aa5e14780b7d64b483fe6d7559f1a19ee1f38131dac965506b

SHA512
aa68a9132b1e728e471def518632fc9745219a36ccd0cadfa0da9df1327046e45dbd4f5680e49cb36e547ec6a0cfba6643422a2520c1d8bf703a0469c2e638fd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_fi.dll
Filesize
28KB

MD5
7044aec0a70ca261aeeaf523a79b9aef

SHA1
bc25b30b87f04f9b675437776826b61a17465f06

SHA256
db1cad4f42af0bf1b7c204ff8b938352d39c64f796539dedb175f2503701697d

SHA512
3e53d4353f76bd8e16a661e6c111fba03544c1868900831978cafef7c51b8627ecb5862637d8e3332758c1a17d38f33632ce01e4243e638902a322263dfe4d4a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_fil.dll
Filesize
29KB

MD5
e4d75b4ce7e4249b1b90ec1ed3af4bd1

SHA1
1eb88320d7567650baa7f8119d9b18d4fda851ba

SHA256
b42a515f900f9cf9f18043500e4b2f1cfe7e4a2ff1eb3ddc6609d061c0726a41

SHA512
8fb362f3ac9edf063da885462cbd6f62eff541606d4099d68fe4c0d3be8990781433ce7dce767639669006a1ae3e39b9f7331212036f693477fdbafa92e33777

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_fr-CA.dll
Filesize
30KB

MD5
b7d40faa429447578b62996855775252

SHA1
c446eda92827687fa095f3fa7af2fb30d7d80122

SHA256
e50541c6311d7342e4d780b2bd226ad66e76fb7a422eacda0e09aad811896162

SHA512
c2e7df6cbaf98960486d60e7a74037d1224b78b5430fc7ddc31d4e77be8efbbedb34b96b81992c49f5c4834c7a745fe42001c4ac46976be4bb40120fe566f942

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_fr.dll
Filesize
30KB

MD5
b1724ec1b84d12e733b960e6299b5c33

SHA1
51592505168ba39f379f529021c0cf1c4adb6e06

SHA256
79f74730a0d66c31f5fee85db9e306f6644c830040ba6b81f269178f3310c014

SHA512
4d9cc1f2778d1137677752504cf65bb38256c613b0619a09f511911e92b904fcf706a9849149653c2a749ca254b06af8e22eeeb6b779c916d9b7719836e4250c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_ga.dll
Filesize
28KB

MD5
935147c5e318c7ce3459a979853e1f8e

SHA1
e1876f74259337e1f90a45aa030d766f7cd2de40

SHA256
8bd651f282c9079c2c141ea0c3896c86d75d16bcc1e98d071abac522e13e4dbd

SHA512
259fae894b2ab9ab32d5a313cc321f8e9da645763d4a638f1252846889326e1b78ad02df9b8ad1e9ab49b72ea6db806e8dc995f9e9f64b7cbfceefb315b578b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_gd.dll
Filesize
30KB

MD5
9b3532879ae184a6081956b51492d83f

SHA1
a89c76dce262989a41389ac6e6485ecbaaa53d93

SHA256
ac114b5ed44178f63949ff0458487b40a7b61be8e29127fdcc52aceb2da2df32

SHA512
43bf2d543495c164e4b124e653906e7ba8f4d432431fb970c5d302531d1f229ee238fd80b929bf0d07661b22a4f968619bcc573f943e5e30a754b01fdfa38f03

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_gl.dll
Filesize
28KB

MD5
404c1df88f57990945b19dcbd8cd3c26

SHA1
de187f3209d703a95a66ba17ee9fe6b2254feb31

SHA256
80fc8941044fc46907c481235470077cfc49ad5b331cde193da7c68a1e83c4d2

SHA512
d0f40c7db9888543a4a24635d8ada603ab73c6f818719ad22ae7357cfc4af4f73731febf329efb69148d4c06547054b8028afe2e1771f318d5c7ba5b0bd72460

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_gu.dll
Filesize
28KB

MD5
3610daa3d09ea7d57c80c425555b1a37

SHA1
400ed7c58fc33b3b29431840fe9a25cee3e09bc9

SHA256
cc27a1d1d7d95044bd66716a473ddd0aec3e7894d582dd87eaab650f17e096ad

SHA512
1c2713ac698e00907c633ba71f890af73e3320cf8ce675a29d385fd5c59d2084b5d5b0acaf5566cd57a3b917d62d739d5b65ddc3375f32087334e414719b1118

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_hi.dll
Filesize
28KB

MD5
d45546a5b6f4c34004c134c155a10630

SHA1
1d81c2e7d7a9517ad0aa87ad1f3c91fa4916c4b3

SHA256
be190f32658d003797912437e9e0a5ca33a866dad76ba355b184786e8a895810

SHA512
aa9830f5cd7eb28c0c35bfc112129237fa0ee38a2d244833fb30be638ba9f555005b6e757ddb8187751a3d9531218411393b9061ff801506fa1ce532e8823b4f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_hr.dll
Filesize
29KB

MD5
d66ae10cdb163d742b68951715a3c1d0

SHA1
10d11768d44ea3ab1a487624700acf4ea9a004e6

SHA256
a3ffd4440f988c77e3946f5fabd2bb042c8d9453843bb8cfe9cceb49993a86dc

SHA512
a2383bdf9c95320f91c3a5d2fd18977160ec0412ad2849aa996981c190e6d215c2bfb5c04b1283d0ff043f4c8b1a5a8bc3c3894bc3f6042145f69b4aebf4a186

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_hu.dll
Filesize
29KB

MD5
1d5faceb0528b1db843d434f09a84c7d

SHA1
face290bbed2b1c87fe550e0b92e5199c6a2c3db

SHA256
b9b38d08d8f8deac80160861c7a791b15fc3c896a3faacd9cc6dad90e6f54f3d

SHA512
eeb117098ddf1004e5d3946ebd46a6d4ba56ae64750bacb1ca8c3d4a46119d51a8c19282089c500763f3bd3960a04ce520ea2386da8b21fbb1ba6e9ab4b8ec32

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_id.dll
Filesize
27KB

MD5
929dacb042451c666412573020cdef32

SHA1
40d439470e3406c75ef66d79bf67fa2d79363343

SHA256
d4a2729198562158253bc987abc189fac03dc1a53c60c903318f21eac4892ba6

SHA512
53f14b8f9237a618ddaad920e019e923b64795fb359dad3a8d63bdf61fca84d23aa07e0f02bc559c277838daddaccd5e10483decb0a6800cbafcf69ed8659529

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_is.dll
Filesize
28KB

MD5
ffe4d317e7af1a63d82f4ef956f09430

SHA1
f3460f60ac91b2a17a330283e244bb258ebb9472

SHA256
14ad84c1b224bddb0f27a836ad3a6bf08bb6418ed8c886c3270e7d5f15e0ebb9

SHA512
f2713169ae552f395526c6a7b164ca94916b6b5a55b9a78ce31cee224d16ee6a332abe8fcfcf181057158f0e868c73f0ae34af050068052ec32b650bba5a5f53

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_it.dll
Filesize
30KB

MD5
19712c70834e8ae1714980f9a8d023bb

SHA1
4b5501e91e18176bfddc58d112f854a5d592a02c

SHA256
9ab32fbc6230afae8a403817634198f5311f42c55734e0e3e37d728e179090dd

SHA512
1d7f9c961f047c00e73d1d29e12e60135c393876c52f4e08d052b71977ea54ee8fbe82939d9bc4bdeec68318d1d5b4a7611c87a41aae591721862609de301503

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_iw.dll
Filesize
25KB

MD5
8ef584e67c9c6fa8323f2f3ba7671ef8

SHA1
962814cf434780a66be65afd1e7e598ffef5dc30

SHA256
37b6ab76a005b73c7e45866aab38b615e496e28cb685066d0c424012580c475f

SHA512
189a1125606ab5b40dfbbd98e1796a18b541caa6e2f48582c196adae518fdd21f918a3c82d7f4503d3e340eef56ca8461497e2c923bc6b583753b00896b39f91

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_ja.dll
Filesize
24KB

MD5
03a2240625a4e08bcd76dc1dcd279aee

SHA1
f3cd257fdeb920504a405363731bd57006d15853

SHA256
801abe8ac7a89939df5c61d06b489e715d61303f01330daafcc5f461cbe81858

SHA512
355d6968c862a633fb6c820b5ddbfb42d8974b28b3afc48be3e2198c96d05c1f3f35d4a6fc57a3db3b3035d031250bfcb960c357dc8e52e8b2ad280c52c1f2b0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_ka.dll
Filesize
29KB

MD5
ebf1d2c3cdbb4af1ba54c6fcf1cad0d2

SHA1
04bc0339b5626231dbd88c7d48ff183b0e824bac

SHA256
ba0949d350d20b597e005463b37e7fd35c16775bdd14e098bc118b3f939d2566

SHA512
a3e9543421ba238a8f59bfada248aa8cd222eee03f15ddde5c1bce9231ded44710bf7d77c6ebcae23d404f4ae265d1584db34486feb7e0c11518998a5d2ea44a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_kk.dll
Filesize
28KB

MD5
a624c4cc5d63666a0140ed799317c6da

SHA1
f2a244374a12183be3c39816698bfea921cbb549

SHA256
3b531c74c3aab880f75e05f5c41c97e6cb680b4ee7d8eb25e4f732307265efe1

SHA512
df09bd953d8a05025657f407b160b4336c068c49dabb86f1ace3b3c4410943f0505af5973d2cc63b2b61dea91a69b082eed871a2b7f3b7d0f92806b227b3a033

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_km.dll
Filesize
27KB

MD5
1b10f804af3b3a929a4c425d30a0e237

SHA1
c9b9bdb361f5f1ec1c9f22503ccd442a5807c678

SHA256
b3f80704a723c952e8a7f729617e8c037dabac7f012762e43843f92aefa73fa3

SHA512
5c81bed1f44f9ff9d56d336ec4762c47fbeb9215d71c3d992c0fb28690894541cbc7eacdcfd685ae40c6cc12e7070a309283f57e5007a62fb0885c5f58dafd23

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_kn.dll
Filesize
29KB

MD5
c020f0ed0051d87c1a2834e08faf726b

SHA1
8c95342539a8ab521f42e916db56387f4ec09c13

SHA256
c7b7e5a005d7f136453b6deb7835e0a10bca432eeabb6041d8f83c08dfac7115

SHA512
dde0952b327d4e9d5d8f46fd1864be21706b24201b3eeff74a08cc8d504335c93fc5756ddb228e2c48b3a72b9d503a18a3d0125e9247d7de90fe219c2d073cc9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_ko.dll
Filesize
23KB

MD5
437c8f54209c532ee9a27b61da989a57

SHA1
b2ec1c2ffdc31f55dc1385904cc3895dbc784b6a

SHA256
37803be34ca3dc367062e26f1d8be83f9638795f98566b9bc951ce3727993292

SHA512
d94413e861c6e7eef8e6074a88eec0b63690e2a362ef3966fd30b6e8d736d3c4e0d06bff4593908381572a530e3108fa61ef02650945919f3c22600dc9092d65

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_kok.dll
Filesize
28KB

MD5
37cc3fef64c4810b7987c93b1995754c

SHA1
2fd33ee7932b5d25c329b540beda16777fe231dd

SHA256
a7f763c4e5bb45cf28775df2a613085d8d6056e2fa08232b49d38470c2ef7af2

SHA512
7040b94ab901f1afce1ec094309101aa4ab4367974330faa325c0ad2c9c873148683c091460eaea1dfbf1cc8d42139017611b19a04be52502b56519c7803f877

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_lb.dll
Filesize
30KB

MD5
38064b818562fcc9c38f596b9fa3d97f

SHA1
48dc9db3ba59c362fb057440d955c67a7f7f6109

SHA256
55cb68efde9f4f79f28c7c224e60032b2143ced785cc7f5b162e0f12bf20a1f2

SHA512
da92718162cdb9b41a5b1a5dd63fa4e95ae9b311373dd756f4d062717be8aca3ca1cd6ec85065fc9797d72132f9dd70120060d662ff5e4e1fa30f678461fe362

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_lo.dll
Filesize
27KB

MD5
85b1e636a379401c8342de61009d8948

SHA1
87cd18a539add1d9906b172d078f073f7902f70b

SHA256
5c78d6fd0b17d8ed5bcc3c584c38b84099ab6fb175b04f33dc6ff60434f52494

SHA512
1551ac0441e433bb8471c434c1ccf23238fd187fb6d0db71453d4ec598b5b75f293a03f2306cb1ca50786d7922e7069da9560e7ddd3409ab50d4a55284181210

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_lt.dll
Filesize
27KB

MD5
e47f91ee590ade5521fafb4eae665939

SHA1
db13eaac675bc9fccc9af1aae9007558cc121865

SHA256
88028b34efc36d2d1e0122cd5e4903f63245f0a3802a7c9fc06df7163dc42cba

SHA512
dfc9b4a448c16ab6a1ad3f12116d849d9735ade11ae20175accbd472f79b8c793734254c8f3aef445f207f9a51051ae2d647f2170184d6aa63855620d8b7fa07

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU2D98.tmp\msedgeupdateres_lv.dll
Filesize
28KB

MD5
762b76df4d76f6b2e6baf75ecefd64a0

SHA1
47e6a3792e3a4c0fe58e45cf252a0a60e21e7995

SHA256
c90c0138308c87e3c892079a6868862ad90d315c7404ba7dd0f9bb9a250b5d49

SHA512
30b93077dfa5399de8eb115172477cd45ce723c0c54f425206b23aef6b979d27a7089c174d311bec051d58cc77df44b8514286bac48f91e69c1315411a886fb4

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
Filesize
116KB

MD5
1fe2ee5c127b8c9273e134706743abe0

SHA1
6a0ee52c463e1f52df0076cb37d93aa42fb9487c

SHA256
b0f25c67005f686d5ff62aceeeeee182d947dcf5dc59d4d5eb686bbc595135a5

SHA512
d80689991d0cdf9f7c61b6120815b2a445944c3711abcae12f3e717a3d11539118b2dd9a2a493a456bae03db97abe9ea98a0320aad4d1666dcaf10a3f9d36f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
ad32aa47616da408c11598c338c55c28

SHA1
fa8d673203cd0f60297e8d79d3c0e8fbdd7bf5f7

SHA256
df8c7c79de024eda85d6154d61dd305c6a7ff5c9736c32e5ebee9a8aecff3cf2

SHA512
f01c954f1c42edf6c74e9f71bfa2baf4cc79d1ce9bce50425667f565734dc79632436821de49e3cf40e4551733a1332b54d0110b9a930de8926c94b244148353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
c2dce11cdaa8c9b6574f5c7a9648e913

SHA1
103b9314564ef51ecbad47ed5ef5181a97cdc14a

SHA256
9499c2cd01d37d3a991dacf046373bc3d6ddcb29ff46c26a78a4537e233d6623

SHA512
dd635a1d3d76bb8b586feb0cade83745c04cf9cf4ea15d855d38256a3588e81719cff79d9765c4fc5275c25ffa8acc52426adc8d7b9acb3a8520d58482ab1237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver148.tmp
Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\feo4h2u\imagestore.dat
Filesize
7KB

MD5
f6fbbeba55d6b7ed1801d77eca35709f

SHA1
12fe5a70544b6abc475b659b7ca35239778d5f2b

SHA256
84e8a551c575a413a87762414bf67ec8dce06ccbf582ce64c46173cf763e5064

SHA512
92af3c2421f901f08c4aa52f7d35b2cd66990798c3b799c30c8f026fab5cdac3c8eae8602dcb8f40ffd9e19f32341f422aee31752993cbeb74b7da5c5d085516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\feo4h2u\imagestore.dat
Filesize
15KB

MD5
3579ba2804518f2e6af93db0a284fd14

SHA1
b94f9bab0c3c63aa20cbb7a1f1fb7e566dfbfa92

SHA256
192594fa38adb517a239a4f291dc55c9843d12611ea84566e84294d39465a989

SHA512
adb6270b7d6252ea884c01e32f2f4209562b9cde752aaa83bd61b8e15098baab9cd3b6deb327d3f927594dd98afa9705daf602d5a7adbfb0eb2300f635ad4d27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\MicrosoftEdgeSetup.exe
Filesize
1.5MB

MD5
41fa100c32b1980c5329ae0637390a4d

SHA1
1fdea9038ecb1858b8101b9d91b89476c5c667ac

SHA256
02ebce345a8d49f4797da3dd54b7c9968a3834a189566852b48d9a2dbb233a8c

SHA512
7d65b07fe3f33fe0fc573e1bddc6fe8094deb5ab94dfe91fd4c652c9de686a960c556d34f0a1646fff7a53f980f392068b9165e7d633bf9ea5defa6a29e1474a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\MicrosoftEdgeSetup.exe.fpfdbpw.partial
Filesize
1.5MB

MD5
41fa100c32b1980c5329ae0637390a4d

SHA1
1fdea9038ecb1858b8101b9d91b89476c5c667ac

SHA256
02ebce345a8d49f4797da3dd54b7c9968a3834a189566852b48d9a2dbb233a8c

SHA512
7d65b07fe3f33fe0fc573e1bddc6fe8094deb5ab94dfe91fd4c652c9de686a960c556d34f0a1646fff7a53f980f392068b9165e7d633bf9ea5defa6a29e1474a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\browser_upgrade[1].htm
Filesize
15KB

MD5
e0563e253f5519ab412be12b9ea5ad8d

SHA1
5ff3f4253947fb2b8e850c37fd80ec62df14ac5b

SHA256
8944d30562ddcaf9c76450bc30bcb1a342edb396886ec7358607178705435724

SHA512
bb7592b3581159aa5fd33b31f65365f4e1a2231c114d40cea0867b7146d1433b5494bc179ebc84e219da27e4902d55a21a128bcfe941ede1718540a8dbc9a0fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\css2[1].css
Filesize
900B

MD5
a1b913a8a6a6665c6a07bcf02a6189d4

SHA1
54c212e90016fe09371d666bd4a074d0e39c5216

SHA256
90528517024561b7f82c773934f3a3a0ddd9cf239a1a1b0f82fa5b6684ec4dcd

SHA512
f39d4cbb03d21fb2c7208cb35f5179db24e35730b6cebdededc23c2fa11e5c6e1117b2f20e06b3eb216235605f7449f2d5443b1d95767884fabb00aaee1e1012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\css[2].css
Filesize
194B

MD5
09065625c6933684ed9c38132da15f4c

SHA1
c97d884f7a430de2ca0a1945db897e5dcd011270

SHA256
12970c48a25901abffc13712b356384c99f8b78a53a01b027c0c22f8ae8523fc

SHA512
835f76dce0a3aa6bd252ac66eae7c2a41b898321292a909f35b79f08c8d1adaf67b8aa8e1077b62404eda69d57f8c9e955e659765b625e3c47d34a7ea6daa051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\favicon[1].png
Filesize
7KB

MD5
9e3fe8db4c9f34d785a3064c7123a480

SHA1
0f77f9aa982c19665c642fa9b56b9b20c44983b6

SHA256
4d755ac02a070a1b4bb1b6f1c88ab493440109a8ac1e314aaced92f94cdc98e9

SHA512
20d8b416bd34f3d80a77305c6fcd597e9c2d92ab1db3f46ec5ac84f5cc6fb55dfcdccd03ffdc5d5de146d0add6d19064662ac3c83a852f3be8b8f650998828d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\project[1].js
Filesize
1KB

MD5
61ca66de658cab9587e4636894680d5d

SHA1
047e17b37c12cbb9dc8ad2b5cd0201a7c65e9f53

SHA256
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02

SHA512
f178001d53c5e86d30e224fecf99b17ed1aa4ac704bf0b6bfc4e4b79f0184a4285c179eab7602bdfa4f701be9cd837ad4be56dc560f7b174b8fc82082e9c6b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8OI4IV75\2867373[1].js
Filesize
61KB

MD5
1ca054b15cda2ff74fc2f984111bd7f1

SHA1
13d847b18d5c4c9aa2c263affccb50ea78d0ae62

SHA256
f496b5d653799b630b4d560d77e71ae18fb8d7ccefb1cadf4cdd7cb3288eaab2

SHA512
4031f95e5c3173bddb29d7488fd403f1918e404f0f131bdcbc4d9a39adaba8b68e9766aa4a8fa97ebca6758d2ff75884a057f2dfd4aeebeecce9b0f32cbac682

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8OI4IV75\JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Ew9[1].woff
Filesize
49KB

MD5
88b2997a5b9096e13024d571ed055bd2

SHA1
b83d74a6f4fa095cac3ac83b5ba1d8eaedf2bf2b

SHA256
805f620fb54c4de80c7eea23351d9066766112f6101a32e995fd36aa59be8c5d

SHA512
7075f9987d8a25e01e5585989e28818f279f89439c8868c44f9537cbc151d9c329ddd8a156d0aa4ae12c751eb252a609caf1d6acace8acd0c9c4713366f72be9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8OI4IV75\JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCu170w9[1].woff
Filesize
49KB

MD5
bc9c939554bcaf256c08ed93f8980f1f

SHA1
65aadc9c8d29c1d670e23343c51d55fff2e8cf58

SHA256
7ae6660deba32013bcabefe36c7eee441bbc1c9cd448503dd72c35838d2e69da

SHA512
eaaa2c951021715f5e3de312ba5487dfab2be4542d2e325379a5771c5a1d6e72c0134da59eabe9d8340129e09180059e0cf71463d27fbc4c4a5f5927a72457d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8OI4IV75\Simplicity_style_2020.min[1].css
Filesize
144KB

MD5
d6975814339961b08d70a55b22549a7c

SHA1
b8b09f36b20cb8088c0162fbd504c13715c89fd1

SHA256
61d89253990395c320e1c84ba260c169acf832832bbca5190b7bdd5055fd356e

SHA512
64cad4c1f91194a7007e1c146bcb3439ca36017fc29447bbf05835b2798506f8d789d2148c28f1fad8135e063d8f126a4157ce204ed16ada74a2aafa53c54a9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8OI4IV75\index[1].js
Filesize
10KB

MD5
d57b3d84e0be8dd0aef0781d100c0d14

SHA1
d41df671ad3bd81a73d50897e15f1a134eca665d

SHA256
49c050c7a4775b5b84a5ceabf44f33074c79c051306286a8be611e9794704894

SHA512
a93ecb20013db9c9c696363850ba9af56d9ef61f62f3d5ce8e10e2da7519670ee74206f119079f05799ac9c3386163da39277950b61174be4e2bd7a40d404bdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\2867373[1].js
Filesize
65KB

MD5
3abbb9430c697f17097be34e4bd96f59

SHA1
4222f40f630e5ebbd1318f3d8a81803838a794b5

SHA256
f09b6227d002b5126abd76d966dbe9020d3262d517323c997df69797e32cd8e8

SHA512
3845c545281ffc92f6bf0d689ceb57765661f1d4ec7c0cec1ae2bfdaa5ab613107a6cee9443a78c9581500d4ae464d5adf85b5ed4c138bff8c6a638689ebed9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\MicrosoftEdgeSetup[1].exe
Filesize
1.5MB

MD5
41fa100c32b1980c5329ae0637390a4d

SHA1
1fdea9038ecb1858b8101b9d91b89476c5c667ac

SHA256
02ebce345a8d49f4797da3dd54b7c9968a3834a189566852b48d9a2dbb233a8c

SHA512
7d65b07fe3f33fe0fc573e1bddc6fe8094deb5ab94dfe91fd4c652c9de686a960c556d34f0a1646fff7a53f980f392068b9165e7d633bf9ea5defa6a29e1474a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\favicon[1].ico
Filesize
7KB

MD5
34ec4b155297c6b674a78c1cd73c4634

SHA1
590a0f2b5257c47edda0f7b4fe261a7dc468b8a0

SHA256
88dbe6338b322e44348db8deeca00c03f6786fb58dcd338e3e477d6f398da447

SHA512
ff8fae0d4ab54ff274e212b126ff8d22ea817fca495875f857f368f88631977848bc1a8be330ffe04568984564e75f6e98ee97399413145b59230662760c935a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\fb[1].js
Filesize
6KB

MD5
9689d5215e8f3b207014437e87340a2a

SHA1
76bea86c1b93b3c3ad768be69ea150634564d735

SHA256
bec1a4113a74059e0b37693855f5208308d8668787744e43ab5b212cf1aabf24

SHA512
7b9c1c000ac769a9c412c4725f9c9ea96acfca2ee1aa406e8cf97cf7f6abcc044daa460d4311222d62a7c146ba53c5a0b4a6ec30b5f0e45ccd5b5ff4d1fb8c4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\font-awesome[1].css
Filesize
36KB

MD5
c495654869785bc3df60216616814ad1

SHA1
0140952c64e3f2b74ef64e050f2fe86eab6624c8

SHA256
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

SHA512
e40f27c1d30e5ab4b3db47c3b2373381489d50147c9623d853e5b299364fd65998f46e8e73b1e566fd79e97aa7b20354cd3c8c79f15372c147fed9c913ffb106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\jquery-1.7.1[1].js
Filesize
91KB

MD5
ddb84c1587287b2df08966081ef063bf

SHA1
9eb9ac595e9b5544e2dc79fff7cd2d0b4b5ef71f

SHA256
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd

SHA512
0640605a22f437f10521b2d96064e06e4b0a1b96d2e8fb709d6bd593781c72ff8a86d2bfe3090bc4244687e91e94a897c7b132e237d369b2e0dc01083c2ec434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\layout.min[1].css
Filesize
4KB

MD5
94daf62e7e6df83595c6251fb0c7c055

SHA1
2547ae415df41bbfb446afa45a76462bcfb2fdd0

SHA256
257855f4e23a1e3d382077b15bfc30971c9c261fc23512c88abfdcda05f28bc4

SHA512
613b5b4cbf716cb4a69eaebe4df6002ec96cb71b0042efc1cfe8eef4ed7313b9b77c268d6d92685e674da771993208119d4a99bdedc93a528e5eeae3dee804cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCuM70w9[1].woff
Filesize
49KB

MD5
8c11c1bdfbe79ab8d354bc9295f617bc

SHA1
35444d06cf1af13da73bf42566397b3ce67bbe6d

SHA256
46a8b2d46c50135f8627a9e0f0e9c64d8b943c42d819caac49db8d799c5df6a3

SHA512
df57a6b60875020939cee684499dc598d7ca30156cd0e9db6e6b29e9cf66b3df403bccd0562124bf8e8ec570c991480960b97463728ccf5cb18e27bfc1acedef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvr70w9[1].woff
Filesize
49KB

MD5
7e62f035488c204b8c4132650fdb51e3

SHA1
77f9adf90b2241ba4a5acdaeb8531b982ff8a2f1

SHA256
6c9aadcccf72e7f54b34bdfb7cc5a637b8e5593242c54bc8e1acf3a34318923a

SHA512
cf42598e811bec671832193a780a6c70547d18d80450bfba6296df915f1ec5eff33ea76fcba992f39b91145f2e7122b0fbbdc2130dde92b2dd99e12b8bf19001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\Simplicity_script_2020.min[1].js
Filesize
6KB

MD5
375b4b1d89fae6c3a141f9dbdc163025

SHA1
2853222f66a9ab69824e1605b93c8a2da925bba3

SHA256
3cb34fcf9a56edc89b9b48817c78387abfdee78efa727075601c1e9c720c152c

SHA512
0605210f33fa28a8ea4e22e5428d60068b1d7dd9af5a8841d412755abca04521990866577901c87480f601f2bad97448eb67e8b482da9282c23c36b0e0799a1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\css[1].css
Filesize
776B

MD5
7aaffa764d4d840007ad85eec0016914

SHA1
55b35845cbab804a5e699404d93af7e8e17fbdb1

SHA256
854eb5d53fa39e719bcb5b61ea19424bc726ad1fd757eda3473566aec8f1cce6

SHA512
c03ea41f3ccb6d0c36d64c5b9ab06dba75483eb88229be786abc772c61d987dd8e93ae8daf1b20a247d576b364d838c083520513e45c982c1c72d74cde996d5e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.~tmp
Filesize
104KB

MD5
effecce1b6868c8bd7950ef7b772038b

SHA1
695d5a07f59b4b72c5eca7be77d5b15ae7ae59b0

SHA256
003e619884dbc527e20f0aa8487daf5d7eed91d53ef6366a58c5493aaf1ce046

SHA512
2f129689181ffe6fff751a22d4130bb643c5868fa0e1a852c434fe6f7514e3f1e5e4048179679dec742ec505139439d98e6dcc74793c18008db36c800d728be2

Download Submit
memory/3352-618-0x0000018D80E30000-0x0000018D80E3E000-memory.dmp

Filesize
56KB

Download
memory/3352-619-0x0000018D9AFB0000-0x0000018D9AFBA000-memory.dmp

Filesize
40KB

Download
memory/3352-620-0x0000018D9AFE0000-0x0000018D9AFE8000-memory.dmp

Filesize
32KB

Download