18b7e51b0f80744208e78cdbdc707e5b8467991af8bdea3c47f3ee25ad864277

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LoaderV6/loaderV6.exe
Size

52.5MB
MD5

4efe5b34754a7b87e7a2fb46664fb245
SHA1

7a2ffeac89d92fb0fb987cb6b284133e41a1e666
SHA256

88f6b132a2f2f4bee053e521ca9a212bca12ed681b223ad615d4263c976e152c
SHA512

a090deac29ae7aa7baf6411d1eef6121f5fdf09eb3d14f57f2b7e1f1f56859a70d12019234055c74df6e339081529c670bdf035c728244435ea8830b2d6f6b14
SSDEEP

393216:3T6KLdGUHM9yCKxECB54r6X9eDQrps7p6Y:3T6edGUs9yLEFy+sY

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 14 IoCs

pid	Process
2880	MicrosoftEdgeWebview2Setup.exe
3540	MicrosoftEdgeUpdate.exe
1480	MicrosoftEdgeUpdate.exe
4056	MicrosoftEdgeUpdate.exe
3804	MicrosoftEdgeUpdateComRegisterShell64.exe
4720	MicrosoftEdgeUpdateComRegisterShell64.exe
4764	MicrosoftEdgeUpdateComRegisterShell64.exe
1408	MicrosoftEdgeUpdate.exe
4268	MicrosoftEdgeUpdate.exe
5016	MicrosoftEdgeUpdate.exe
1984	MicrosoftEdgeUpdate.exe
3628	MicrosoftEdge_X64_126.0.2592.113.exe
1492	setup.exe
5692	setup.exe

Loads dropped DLL 15 IoCs

pid	Process
3540	MicrosoftEdgeUpdate.exe
1480	MicrosoftEdgeUpdate.exe
4056	MicrosoftEdgeUpdate.exe
3804	MicrosoftEdgeUpdateComRegisterShell64.exe
4056	MicrosoftEdgeUpdate.exe
4720	MicrosoftEdgeUpdateComRegisterShell64.exe
4056	MicrosoftEdgeUpdate.exe
4764	MicrosoftEdgeUpdateComRegisterShell64.exe
4056	MicrosoftEdgeUpdate.exe
1408	MicrosoftEdgeUpdate.exe
4268	MicrosoftEdgeUpdate.exe
5016	MicrosoftEdgeUpdate.exe
5016	MicrosoftEdgeUpdate.exe
4268	MicrosoftEdgeUpdate.exe
1984	MicrosoftEdgeUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_fr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_cy.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_lb.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\am.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\fil.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Installer\setup.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_cs.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\hi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\km.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\identity_proxy\win11\identity_helper.Sparse.Dev.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\identity_proxy\win10\identity_helper.Sparse.Internal.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\eu.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\msedge.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\dual_engine_adapter_x64.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Trust Protection Lists\Sigma\Other	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\en-US.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\kok.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\tr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_zh-TW.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_nn.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\prefs_enclave_x64.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_az.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_mt.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\ar.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\lv.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Trust Protection Lists\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Trust Protection Lists\Sigma\Analytics	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\en-GB.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_as.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\te.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\oneds.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\resources.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\VisualElements\SmallLogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\cy.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\mi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\mojo_core.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\hu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\el.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdate.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\km.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\MEIPreload\preloaded_data.pb	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\microsoft_shell_integration.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\identity_proxy\win10\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\mspdf.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\telclient.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\vk_swiftshader.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\lt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Trust Protection Lists\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\gu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\learning_tools.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\BHO\ie_to_edge_bho.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\identity_proxy\win10\identity_helper.Sparse.Internal.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\notification_helper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\msedge_proxy.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\identity_proxy\win11\identity_helper.Sparse.Beta.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\copilot_provider_msix\package_metadata	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_is.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\BHO\ie_to_edge_stub.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\gl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\is.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\ja.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\sv.pak	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{513C065E-085A-40C1-B47D-D2F56F9AA0D1}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ProgID\ = "MicrosoftEdgeUpdate.CoreMachineClass.1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\CurVer\ = "MicrosoftEdgeUpdate.Update3COMClassService.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{513C065E-085A-40C1-B47D-D2F56F9AA0D1}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\CurVer\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ProgID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{513C065E-085A-40C1-B47D-D2F56F9AA0D1}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.193.5\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\LoaderV6.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5580	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3640	loaderV6.exe
3540	MicrosoftEdgeUpdate.exe
3540	MicrosoftEdgeUpdate.exe
5152	loaderV6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2148	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3540	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4820	firefox.exe
Token: SeDebugPrivilege	4820	firefox.exe
Token: SeDebugPrivilege	4820	firefox.exe
Token: SeDebugPrivilege	4820	firefox.exe
Token: SeDebugPrivilege	4820	firefox.exe
Token: SeDebugPrivilege	4820	firefox.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe

Suspicious use of SetWindowsHookEx 46 IoCs

pid	Process
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe
2148	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 2880	3640	loaderV6.exe	94
PID 3640 wrote to memory of 2880	3640	loaderV6.exe	94
PID 3640 wrote to memory of 2880	3640	loaderV6.exe	94
PID 2880 wrote to memory of 3540	2880	MicrosoftEdgeWebview2Setup.exe	97
PID 2880 wrote to memory of 3540	2880	MicrosoftEdgeWebview2Setup.exe	97
PID 2880 wrote to memory of 3540	2880	MicrosoftEdgeWebview2Setup.exe	97
PID 3540 wrote to memory of 1480	3540	MicrosoftEdgeUpdate.exe	98
PID 3540 wrote to memory of 1480	3540	MicrosoftEdgeUpdate.exe	98
PID 3540 wrote to memory of 1480	3540	MicrosoftEdgeUpdate.exe	98
PID 3540 wrote to memory of 4056	3540	MicrosoftEdgeUpdate.exe	99
PID 3540 wrote to memory of 4056	3540	MicrosoftEdgeUpdate.exe	99
PID 3540 wrote to memory of 4056	3540	MicrosoftEdgeUpdate.exe	99
PID 4056 wrote to memory of 3804	4056	MicrosoftEdgeUpdate.exe	100
PID 4056 wrote to memory of 3804	4056	MicrosoftEdgeUpdate.exe	100
PID 4056 wrote to memory of 4720	4056	MicrosoftEdgeUpdate.exe	101
PID 4056 wrote to memory of 4720	4056	MicrosoftEdgeUpdate.exe	101
PID 4056 wrote to memory of 4764	4056	MicrosoftEdgeUpdate.exe	102
PID 4056 wrote to memory of 4764	4056	MicrosoftEdgeUpdate.exe	102
PID 3540 wrote to memory of 1408	3540	MicrosoftEdgeUpdate.exe	103
PID 3540 wrote to memory of 1408	3540	MicrosoftEdgeUpdate.exe	103
PID 3540 wrote to memory of 1408	3540	MicrosoftEdgeUpdate.exe	103
PID 3540 wrote to memory of 4268	3540	MicrosoftEdgeUpdate.exe	104
PID 3540 wrote to memory of 4268	3540	MicrosoftEdgeUpdate.exe	104
PID 3540 wrote to memory of 4268	3540	MicrosoftEdgeUpdate.exe	104
PID 5016 wrote to memory of 1984	5016	MicrosoftEdgeUpdate.exe	106
PID 5016 wrote to memory of 1984	5016	MicrosoftEdgeUpdate.exe	106
PID 5016 wrote to memory of 1984	5016	MicrosoftEdgeUpdate.exe	106
PID 3660 wrote to memory of 4820	3660	firefox.exe	111
PID 3660 wrote to memory of 4820	3660	firefox.exe	111
PID 3660 wrote to memory of 4820	3660	firefox.exe	111
PID 3660 wrote to memory of 4820	3660	firefox.exe	111
PID 3660 wrote to memory of 4820	3660	firefox.exe	111
PID 3660 wrote to memory of 4820	3660	firefox.exe	111
PID 3660 wrote to memory of 4820	3660	firefox.exe	111
PID 3660 wrote to memory of 4820	3660	firefox.exe	111
PID 3660 wrote to memory of 4820	3660	firefox.exe	111
PID 3660 wrote to memory of 4820	3660	firefox.exe	111
PID 3660 wrote to memory of 4820	3660	firefox.exe	111
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112
PID 4820 wrote to memory of 3776	4820	firefox.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\LoaderV6\loaderV6.exe
"C:\Users\Admin\AppData\Local\Temp\LoaderV6\loaderV6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
  C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:1480
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4056
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.193.5\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.193.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3804
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.193.5\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.193.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4720
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.193.5\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.193.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4764
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTMuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE5My41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezk4OUEwODA4LTE4QkMtNEE3Mi1CNDM4LTA5NDAxQ0QyODhBNX0iIHVzZXJpZD0iezAyMEQxMTQwLUQwMUItNDE0MS04QzVBLTBBMDc0QjkzN0Y2Q30iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntBMzFEMThGNS1COTczLTQyQjctOEE0RC1FNTEwRUQzRDQyODF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xOTMuNSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDg5NzY4OTU5MSIgaW5zdGFsbF90aW1lX21zPSI2MjUiLz48L2FwcD48L3JlcXVlc3Q-
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      PID:1408
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{989A0808-18BC-4A72-B438-09401CD288A5}"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4268

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTMuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE5My41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezk4OUEwODA4LTE4QkMtNEE3Mi1CNDM4LTA5NDAxQ0QyODhBNX0iIHVzZXJpZD0iezAyMEQxMTQwLUQwMUItNDE0MS04QzVBLTBBMDc0QjkzN0Y2Q30iIGluc3RhbGxzb3VyY2U9ImxpbWl0ZWQiIHJlcXVlc3RpZD0ie0RDNUU1MDRELUJDRkItNEIxMC1BOTEwLUI1RTU5NUFCM0U3OH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtoVmZEak1kRkc2RmdLczBOejZlbXJZQ1NnNlRRdkRQb21vbFJheVFYQks0PSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEwNiIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTAiIGluc3RhbGxkYXRldGltZT0iMTcyMDUzNTAzNSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzY1MDA3NDA5MjE1OTg4NiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxMTQzMjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5MDMzMTQ3MTIiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:1984
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B3ED7F01-004C-4B8B-95C4-106DAAB84002}\MicrosoftEdge_X64_126.0.2592.113.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B3ED7F01-004C-4B8B-95C4-106DAAB84002}\MicrosoftEdge_X64_126.0.2592.113.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:3628
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B3ED7F01-004C-4B8B-95C4-106DAAB84002}\EDGEMITMP_19657.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B3ED7F01-004C-4B8B-95C4-106DAAB84002}\EDGEMITMP_19657.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B3ED7F01-004C-4B8B-95C4-106DAAB84002}\MicrosoftEdge_X64_126.0.2592.113.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:1492
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B3ED7F01-004C-4B8B-95C4-106DAAB84002}\EDGEMITMP_19657.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B3ED7F01-004C-4B8B-95C4-106DAAB84002}\EDGEMITMP_19657.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.183 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B3ED7F01-004C-4B8B-95C4-106DAAB84002}\EDGEMITMP_19657.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=126.0.2592.113 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff69017aa40,0x7ff69017aa4c,0x7ff69017aa58
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:5692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2036 -parentBuildID 20240401114208 -prefsHandle 1952 -prefMapHandle 1944 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39d067c2-0598-4172-98bb-02794e35b33c} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" gpu
    3⤵
    PID:3776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2456 -parentBuildID 20240401114208 -prefsHandle 2424 -prefMapHandle 2420 -prefsLen 25789 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06d876ec-ff77-4165-8ff2-e76e8e584e17} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" socket
    3⤵
    PID:1976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3096 -childID 1 -isForBrowser -prefsHandle 3108 -prefMapHandle 2960 -prefsLen 25930 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c8a563b-2bf3-4f4b-af87-fc5d45318de7} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" tab
    3⤵
    PID:5096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4212 -childID 2 -isForBrowser -prefsHandle 4124 -prefMapHandle 4120 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e2a8cb5-e572-4195-8ea2-6dbd3dcd8b55} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" tab
    3⤵
    PID:1912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4700 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4724 -prefMapHandle 4716 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8669c919-a43b-4588-ba76-7462d69c7261} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" utility
    3⤵
    - Checks processor information in registry
    PID:4760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5252 -childID 3 -isForBrowser -prefsHandle 5260 -prefMapHandle 5264 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a055fec-b75a-40c7-9510-21b6dc9d9857} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" tab
    3⤵
    PID:3940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5428 -childID 4 -isForBrowser -prefsHandle 5376 -prefMapHandle 4080 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0712e5ed-c87a-4341-9949-10aeff58e602} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" tab
    3⤵
    PID:1324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5588 -childID 5 -isForBrowser -prefsHandle 5596 -prefMapHandle 5600 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b0a531a-9861-4428-be62-e6a26a612eed} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" tab
    3⤵
    PID:2944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6008 -parentBuildID 20240401114208 -prefsHandle 6020 -prefMapHandle 6016 -prefsLen 29357 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {984506e8-b1e2-4eff-becf-c96b936ca419} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" rdd
    3⤵
    PID:6100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5956 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6032 -prefMapHandle 6028 -prefsLen 29357 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40d7cdf4-a968-4b80-bae0-2691f8f8c08a} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" utility
    3⤵
    - Checks processor information in registry
    PID:6112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6360 -childID 6 -isForBrowser -prefsHandle 6352 -prefMapHandle 6312 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {13a66e9a-eafc-45d0-8970-d98443f8f485} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" tab
    3⤵
    PID:5476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4808 -childID 7 -isForBrowser -prefsHandle 3144 -prefMapHandle 6664 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {934b0406-b7c8-4639-9135-688277927487} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" tab
    3⤵
    PID:860

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6012

C:\Users\Admin\Downloads\LoaderV6\LoaderV6\loaderV6.exe
"C:\Users\Admin\Downloads\LoaderV6\LoaderV6\loaderV6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5152

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2148
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\LoaderV6\LoaderV6\mpvis.DLL
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Installer\setup.exe

Filesize
6.5MB

MD5
4dda37fd043902a07a4d46dd8b5bc4aa

SHA1
aeecafae4cca3b4a1e592d93b045de19d09a328e

SHA256
806500bb5e7a3e4a2a84d4d08e97d1872dc7ee8f8c255e3c6c2d39437c9779ac

SHA512
903280cf47888fcd491b5aa70ffc4de60458fe8fce6e164a02118308cbd36ef0d2e6ecd418d19242d605f9c516598fe723908e28baf702c4c65a284fabc60111

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
181KB

MD5
5679308b2e276bd371798ac8d579b1f9

SHA1
eb01158489726d54ff605a884d77931df40098e4

SHA256
c9aef2d24f1c77a366b327b869e4103ed8276ea83b2b40942718cc134a1e122f

SHA512
9eb5ef48b47444909b10bf7d96d55c47c02814524df6a479e448e9ff50b9a462ac03c99f57258d0ed8fe3665fb286dde0d9be5a47019fb4d9c68da2b2589e898

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\MicrosoftEdgeUpdate.exe

Filesize
200KB

MD5
090901ebefc233cc46d016af98be6d53

SHA1
3c78e621f9921642dbbd0502b56538d4b037d0cd

SHA256
7864bb95eb14e0ae1c249759cb44ad746e448007563b7430911755cf17ea5a77

SHA512
5e415dc06689f65155a7ea13c013088808a65afff12fef664178b2ea37e48b4736261564d72e02b898ced58bfb5b3a1fcdd2c7136c0d841868ec7f4f1c32e883

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
214KB

MD5
8428e306e866fe7972f05b6be814c1cf

SHA1
84ea90405d8d797a6deba68fd6a8efae5a461ce1

SHA256
855e2f2fab4968261704cab9bae294fb7ec8b9c26e4d1708e29e26c454c7b0af

SHA512
bd40fc5fb4eeca9e1671d0a99a7ccd1d1ab3f84abf62e996827a60e471adecf655b5ed146cdaefcb82d29c563e4eeba7c1b2da243218cbca55009064dcad1f21

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
260KB

MD5
64f7ff56af334d91a50068271bed5043

SHA1
108209fde87705b03d56759fd41486d22a3e24df

SHA256
a98505367c850b6ef6d2df68d24d83643767a6fab8f0dd22cc60509b3363ce51

SHA512
b70c1d2a26f59e94b31beb3151f69d7eb9de8841399b618730d94263cc5402f391cd5cfc6621c8666e5e073e6f8c340d6fd3511f1cb1cbbf6ee75312598f56d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
d1175f877ab160902113b3a2250d0d78

SHA1
7fc668cd9ed31d093f7c88dc4803ce3f3f833796

SHA256
5ccf3eedf6f1f57d386cef188f070c72583d9a96ff674ce91e8776ced8e989b5

SHA512
ba1fa4f61c3ed3766e6bd0ae95e36d7505774c463ff81b989e64acaf878cfd59fa41109c696ed16a122e68edc2e0c9f96afd9cfbe92bd7351583719b028c1604

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_af.dll

Filesize
29KB

MD5
3cd709bc031a8d68c10aaa086406a385

SHA1
673fbf3172ec1cee21688423ad49ec3848639d02

SHA256
54dc23402365407bff46318ac0c8cb60c165988f4159a654b5d6013e289f888e

SHA512
04e51aeed7c535616f1db7f92841bcda2bc22f85eb06a7ffc5b626f9f69be0219a042e8ae4a486a2f753b7f65901a082b81f5ba72113d9df9ef123b32367d7d6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
15abb596e500038ffdf8a1d7d853d979

SHA1
6f8239859ff806c6ad682639ff43cedb6799e6a6

SHA256
19509364513e1849ddc46824c8b3bbc354bfc4b540158e28e18abb10b8537dda

SHA512
c4642146979700898ad3adeb0160c8e9d7bb56c1e224a778d400764750c9d9cbd7c4ee52bec0853cc0e577884515bd40a1b0fd643cc0b66b56d472e0bbb1c23e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
61c48f913b2502e56168cdf475d4766a

SHA1
2bf4c5ffbfa6d5c5eaf84de074f3ad7555b56d5d

SHA256
8fd703a50d9cb19e9249cf4a4409da71104c6a16475b9725306cd13c260cefd1

SHA512
d8ba17df865bff6e2785986d9a8310ec7b0e530e389bf7baa719e95b7effa84b58c7102d5f9711fbaebdd2bbcb3cd66760f9eeed92c1aeef06b85d3724028d2f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_as.dll

Filesize
29KB

MD5
2ba6aaea03cf5f98f63a400a9ca127ab

SHA1
807c98ab6fe2f45fa43a8817f0adf8abeec75641

SHA256
509cb950d7f5d8f99adff84e6e381001f14571529571419fd5452b48e24c7291

SHA512
d4b91512b586dbc1cd0c63aaa7bf82900ba80de2b3e265b0200f0a4e2bf0c0a3916675fb72f9bc0b4eaa5d9cc07ade94c8210ad2156fea6d3d2416a5cbf98c24

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
d624c5abfca9e775c6d27b636ca460c4

SHA1
8726c57cf5887367c8aa32a1de5298521d5fe273

SHA256
7023866e9644a1edb50f0f388bc3f2aeaab561822e6b7d75ec5c66b151f126c0

SHA512
92d0d5605336c329359f7c4aa7eeaf972f21877ac61f377e7a2f3c6d66f5d6882be649b765e4122043212381034b4131d44ae996dfc1df4a2e248babcb076c30

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
6ff52c5cdc434e4513c4d4b8ec23e02d

SHA1
56b7b73e3cf2cf13fa509593f7c5aebb73639b83

SHA256
414269530f9ecb045e2049266ee0b58df99ac37de75e0e127899eb3218371555

SHA512
adc3b5593a69dcd0a894ed6bc1160fdbb0d0e9e96e83ca4430ef28e9115d6023f54f3e3fac3cba1ff4497e486991dc4e7e40c7b75ce7796a5044f1ccc5411371

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
c52c76a02dbfbadd6d409fcc9df8dd16

SHA1
d406010ac12ed41e6cdc75eaa2daa231a1d6df6a

SHA256
91843e7eb2f1a9e14f51f2b552d8390cf7846b4406b97ca98b105beb40fc461a

SHA512
28b24bbe03f79a7e4ad51e0e15a664cd783b527255ff0952d43086071e494e7e45ae50d8c378f69abb22942eda2e8dcf8421e2922dcff9ff9cb851745750d2ee

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
eea17b09a2a3420ee57db365d5a7afae

SHA1
dc43580f87f67a28c6fa0b056f41c2c0c98a054e

SHA256
b86d6df0b608cbab18ea53c31a9a17c09c86e90e8592f3269af0517c9756c07d

SHA512
53a199b1bd82ddde65fd6c9bb007867bfa3b2c39e07817a7aff39b7596f00a76bc5dc23687c7fb41b75b00b30ddfdb38a76c740c38bfe41dc21e1fa2d698469f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
1a3815be8fc2a375042e271da63aaa8d

SHA1
a831ce72e5fe3c9477dee3defc1e8f1d3a11aaa1

SHA256
e753e2315e26bc7b8334077846dc91a85fd89f1e483b305af8aaac5b596585db

SHA512
9642fdc3cb49c6d0e4b1c4e1d636007234b126f48da1fe77f586cb8f9403bdc786b54d4bcdbc6175214b7d06a1879f2c809d3fb7e1b920ab36b29a12afe92fb4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
30KB

MD5
253afd1816718afa7fd3af5b7ecf430d

SHA1
36e9d69eb57331a676b0cb71492ab35486b68d95

SHA256
53325e46247a616a84442abbc914b8fa08b67800ab55d5625e43a58b19d44767

SHA512
649b292b80dde95c195b968b51dd168f6f5513b179a35832b5e759795f04e6e6f326a34f6f7db37d12b8c322ccae197455565491c2484b8237c82e1bb2e77ad6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_ca.dll

Filesize
29KB

MD5
7653243e1a6fbb6c643dbc5b32701c74

SHA1
fc537eccc1da0775d145b21db9474ef2996e383d

SHA256
9df1383dfa81c5064acd9130555dbaf2e7413b6e2bc72b1d2340a6013387061c

SHA512
d7834c02a3891afbba040c943ed4255041a6c241d76ac138ad0c04baf589aaa355067395c606e910ef6b91d64042bf9f5c39bd01320d9eaf4ef850a24c17d1d8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
a2c7099965d93899ff0373786c8aad20

SHA1
cfb9420e99cc61fb859ccb5d6da9c03332777591

SHA256
1343867f317fe3fc5a2328d427737d41964188aba50a9739fd0ec98319fec192

SHA512
d2d1cd41bc425a1aa4c491d65ba9c4ced9dcb600f1d60af76151216f8eda310049002e5ca360d1df8f59d6334ad87b950c67a20a6d1c7f8a2ea322c9980b6a8f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
8fc86afdc203086ba9be1286e597881c

SHA1
6515d925fbfb655465061d8ee9d8914cc4f50f63

SHA256
e8dfc22e5a028ad5d423634bf4ed96b90841fda6ff69c35469509f9a988a3269

SHA512
cbfcdea1b4cb5f404553ada87de1240a3746306563f5f200582a21be656b43c0a0e5dcf25cd5ac49bbbe72abcf8147e62aa8a5e0a810bd6fbc7a1eab3e6029eb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_da.dll

Filesize
29KB

MD5
414adfaec51543500e86dec02ee0f88c

SHA1
0ad5efb3e8b6213a11e71187023193fafc4c3c26

SHA256
32684d2337a351ba37411962710983538341012e6526a9129161507aea0a72bd

SHA512
fddc2123237a9357667bbe6b91f93b5a9ba276533b9c16d98adfa01045fca375a7aef5cf83e175c55382a387a16062661a4797da81f39881ab379c7863e2b054

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
d263b293ee07e95487f63e7190fb6125

SHA1
48020bb9e9f49408c1ce280711aa8f7aaa600fe2

SHA256
c4a3198c15489ed873dde5f8a6df708cfc4a6d8722f3f1f63793863098509af3

SHA512
69a851e77124e55f3ee4e3fde169f647731a514dfd16a22013a0ea520b9d6eb9f2aacc9c48a2a812eb8285f46db1a27d196c409587f4549f4e122fdb59ffe1b6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_el.dll

Filesize
31KB

MD5
8708b47ba556853c927de474534da5d4

SHA1
a60c932bef60bef01e7015d889e325524666aeff

SHA256
720074fb92fc405dc7a5305e802e2ecb7d948de58c814b0ebb2c02a0052a6894

SHA512
58d7f419b26a95c986009af9e235fbaca67bf6b1883d8c586c802262fd9fbeaff56b051bf8de8e26f2e4ddeb803bbd4f87c84b1e02f5a43b6614231c59ab258a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
511646c2809c41bcea4431e372bc91fb

SHA1
5b83f1c9de6bfa6f18ccfecf3190a80af310d681

SHA256
719a5c47d3452e3dfda300788aafeba963c588cfea31d1fb1021f846bd6742cc

SHA512
0b45cadd82dd534ba9d4556498817c712bd608b645faee74034c8c48cc39c13c0a8530826690a5c5ef42eb36e3f15f3b97e75625eea8902f12c21291df4cd211

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
ec991a4becce773db11c6f4e640abacc

SHA1
298b5289e2712ab77cecfb727c9c8d47740f6fd3

SHA256
800fc7987f7ac32267e84122eb94d8a21b83c481c2a34b03d832d57debc2b930

SHA512
3e6066cb89abafe963337bbdc371b941ac21b69ceaa19f394512c84c0c06ce9d03141a146144d24172ab6e94f5900071b5b3f38c49f3a079c03bec24bd0418ec

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
9309baaa10c227af2773000a793a3540

SHA1
55032c43f7a7eafb19bca097e3de430aad3913a4

SHA256
a35fa7145fd3bfbc0d71cfe1bdefcb506cd02f0939dbeca83644978af8f896ac

SHA512
21a05fe75d6115a7a49e779c9156ec25880393b30f69fdb80dc0dbe1c3bb401790c8e62525c0e6625b141cecb970b8d650527d73d2d86afa5056177957c44c24

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_es.dll

Filesize
29KB

MD5
1c48f6a58fabc2b115dab7dccfae763a

SHA1
c60db12b55074013293dd332d2736d251beaeb8e

SHA256
0f6775450c40baea4e72d1eb45cff7c1daf2ac1210006bf7afcc91975467c086

SHA512
a84a0ffba4f389698941a497ca6e63c6c632d2eeca788bcf970ea35f1083076950b59b9baeecab7ae17d06847f4675f748cc25b904b03f679801dfb3e2755c13

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
d591a3987492132f6ccd7968a8176290

SHA1
78a79e0e3935dee509938c9a3b095ef486283793

SHA256
02380099a6a942004b0b0042f071108f4896884d19ec7c4cc1264200a8e0aa6f

SHA512
7487a0e63a17cca85a127c8880e33c30fb192fb83bd05dad67cb4a3b9ad6ba84b594194f7126acbfb22ead2c00d3bb776557a0fa012ee1b7d43d88de2c7eabb1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
67624d2a8017a9c5fbaa22c02fb6d1b4

SHA1
b39c26cb632d6e9cbdbe6f0490e80c11a94782e4

SHA256
eb0033a91d64a80aaa66bd088692a8d089169524253b6286b5604ea1aaf0bc8f

SHA512
f2fb8edb244d781a77c67ab85c40f0521ee80f0349ce897860542b6f32e134043afdccd50cd17e86c234000493f5c3b1b75950d1eb12e4d088b9fc7e012f06d0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
0b3cbfb6bc674960c6da5c47689e45d0

SHA1
f91aa435a0bb4fefa3f7568d8f7b0e2022fc95f4

SHA256
eca2354e58a321a78bcb21c24beefa050758c08e86218c55c12434c8ce715942

SHA512
3a0e819ec96ec05bf0eb7119687be1a408330703a3c888e49a19fc0bb8ee62f45b1c9a9f24d7593e0355177445e566d6cba62d0b7d437b139eb08b274d3bf13e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
73650ec3b5bf0ac418d06ff2cad961c5

SHA1
5580915cc24402c72c49834cd9bfbd7c845de468

SHA256
6817e994def058448407b6320f325f75dea6e2e561ffc747d0486a716d08384d

SHA512
c08b069993790440f1baed5fbfc07368e9564d9bf0c16007968569b433b0b18ae6e8184f3073d522e92b6a7b4454ac21998b8f4fe80946273710097c659e2639

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
6f2865bdc505a8216aadea20c0a0c6a6

SHA1
a93b8db9aa8f2b2887ad43fa050f98584e3db06b

SHA256
95b158fd84806d0dadb3d9a90f7b8a78040c1ecee5ff4dd266d407848c9f3a77

SHA512
fc9ccad02d6c04e6d2e76b06d5cd60c486b4a2ffcca1cdc638cbeceabfeaf258c8dbcd5ea7fd3f7e2d288577c90565de7005c88638531ff24bfbaf2fba704c69

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
93aa56aa0165d137e497c4b77965a6b5

SHA1
5e1396c24c76dcf8dad5d97e57cfed7372e7b8be

SHA256
aaeaff8fae26262cdb2ccf1faf84bd202ff2a90d9fc95575770bc53bccee2c54

SHA512
adb8e9aaf493a62a930398682522b8e9411a645d85493ba4e601d6f4eebd48fba982c6df8c5d01a78cc135d03bd3aa912fb71c3c8e26d1d99feb898e0a422a42

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
a4aa60f4891441bd2522d577f14164f9

SHA1
19f8a517c449b65967a1ae8b1b6a7f492ad0199e

SHA256
7768c2b03810cdb491986f349992d32717c4c14df6266d5f70fa89aeb01c5a60

SHA512
0a26fc4bddbcb0078f9ad0c5c9417b74f7c30c6a20e1272edbc20a3b0db29ea17dbc3c9224d2f131570444ce4fbf6f20b0b96e720d2b53c882b8735f444091c5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_ga.dll

Filesize
29KB

MD5
302403f155be43251104dadaf07f1c1a

SHA1
2f4a21b1e7aed5792b269ebe7a81dd29c3a6182f

SHA256
3b6dd91cdb5cd4abedff8940c8a9e0f38cb3f8c49084ecbfcd59b788229f3230

SHA512
742c2bd0cd9bc7fb75ee1fea45e434fcb40aed839f2854e17267382278269dcca640b3599823b0e4d04350bef0a0450bfad627586ee49f031d1922d73bc74fd9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
47fcec572a8eea3510596c079c431412

SHA1
732395d8698191610bfb751e1466a868bca9b839

SHA256
4a8c39680f188b75691e80ab5938e34aff83639c06a9722e30555c1cb8a927c7

SHA512
1f18528128b6675f51a91c137e328ea06009636ef5c1970a8a4816437f445bdbf96428a3d310b04cfaf61d0a4adea7a4efd4f9bbd4dadb3f320366f39e40fc7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_gl.dll

Filesize
29KB

MD5
492d2c11ad558129c9c687641bfafb33

SHA1
c713926e13f062106937419975defd7e69228b35

SHA256
0879c36a3c750ac9bdc4d73ed0ffb23d9c67e6d486291d56d3c5bb60073677c4

SHA512
08d0e4664f07f05f3dea2dfa3d64815067b41cd63701b948b43016369a64151ae515f8c877460037b0f5306c8b080756321d2d6195fd392d86d0e9cc61bc1856

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_gu.dll

Filesize
28KB

MD5
fae86d2dc9b09f0d8c0192e2bb53d929

SHA1
e5d0dc95449d533785367d088ef5a357ebb7dc08

SHA256
5d0f9f75e78fa5c0b0bd2406d6c671675492d92d3dc2515314bc79ba3132e540

SHA512
01c7ae01172d98fc6cbc92510b2bafdc56f794f290139e3bf87952bc98b27b338e31899dafcd36f965e7240133183c5dfd6cf6085468fa779813121a27d7cbbe

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_hi.dll

Filesize
28KB

MD5
8d88faed698fbd4895ad6786acdea245

SHA1
88cea6fe82ac4970a2dafd971277d458b5aef61d

SHA256
c1b2203965c8fb10f6faf65d591400a2da7443d0cba36aa8bde147e1ff6aa0a1

SHA512
0a6eacb240a75135a7c651e524888462be350116ec19522c079fccca31a26904266e38add42eec5ef1036dcaa05ccdf9faf9d3b91923018d1aefbe8d63d1a27f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
d9f0084ca7d58e6cbc12b7111b9f4be1

SHA1
e96bd472daffd3569551f15eb602a7ce66da8935

SHA256
2d45ff287b4dfe4db12cf83a88ddca14b560d991ef28dc6f5078b44d2603fd90

SHA512
ba7e017b6cfb11a7e1f4a22c28ac8b4d4dc571a91c32ab6d63a87ef9dec334fee0062c5c764c662b6f8f89b80758a7dc1781858d0455ab3eba455c8d83134418

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
aace1b6afd05113ffe736206e32e8544

SHA1
48fe1f61e565f99ecf6365ddc6c2c24b2f38db5d

SHA256
e395b29108a3a93fcf7411311d4f478f847f0d8337d4a2cefd64ae6bbfd21110

SHA512
be7ae77ce69e6ada5a6169a0efb858723428084f9b7818482f2eaf7d5243d24b9c8131ea01e3f94cc9766d7462e5dae0ce5437247907f764ecff011c866bfd81

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_id.dll

Filesize
28KB

MD5
469423bc5ecca0db996ad9fe789fd58e

SHA1
dc68d62d25ed917f836036911efd5067f9062c18

SHA256
a25d798ed22ad51682aa90f66e5cca638ae095f4141eba6ef7ca45eb1ef217f6

SHA512
360717c97b2f582843de19d819a5dda2cb2f8090c6542c0d87ae1a27cbf154cfd0b845d7f816ca236e65ce17013bb8ca640a5af2c9e5fe4fef05e94405491df7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
5dbbd22cda9cd2e19aae769dc7b083b0

SHA1
53fd1812647e5e413531d8e67e7970d3e22dac03

SHA256
973c96fdecc4a157782414eebb1b17a94b146efe1a97b707043953d0ff1d03aa

SHA512
774a5873117c98096e8826f7b03a8ddfd2cd7a1f815ee855a591f86f68bfd6bdf537ed49c9d4094fe931aa592da3eeefe0ded3625a9b811aa2a55a129dd7d9ec

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
2f7b11cd7db9f173d040519ef0336ac3

SHA1
95e753d8bf61ef56dba6807bf730a42d390da401

SHA256
8f7b44e60f4450655d963cec393fff3fab4f283672a8dbc8109d1ad967671171

SHA512
ea60bff57fd53ab2cad475d753066d108c2108e41e7e4abb6b1bca153d04e07dfbba386ba73efe9b8a84032c9bb4b35b3c655280b43ee93637c5b388d1dd187f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
54519f24fcf06916c6386f642ebaf8a5

SHA1
2a33c7770c49bb3046a2a78a0457d6dcb3a23f02

SHA256
1b0adf22a09097ce9ac5d102e0f102e6d3f2238c21b6d38fbec3c269bbf87c44

SHA512
704684c706c9a40cdae8a68615a8a9782b29d177bb5c58e8c01e37c139296d6f1d48a446ec211d746aaf341b06a9148e246dd79b0a8a9098de0f66c68ae74eef

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
12de274382418dd99d1125101d1d63b6

SHA1
4a9b0be76a7136f3b64c7bc53724dc2acc798c23

SHA256
7e4f333b20f272bd86182fb3fa191e8ac6bc84c301e28886edbcb92e6e5e1eb2

SHA512
9b05f97ca079d30560b09ca22efdb314dc7e36cf601d672a260f4c064d7841776891374a18d8ba1fcb4238fb854187b95c2d5643f428277e076b734ff477267c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
e0eacb57da5404523e0351b0cc24c648

SHA1
49ce11a94c2751b7c44914ceda1627fb63651199

SHA256
1a269d41990cc81b01b77f0981ff4e9ee31fab50cbe9f0ef437044b40ff72c79

SHA512
735c37d267091491f55d80837bc4879a7a2d6dfaec6c3d2873770cd7706a39f29672eefa2f8a27c6038f84069517a8172cf929f48e637a9c65803e5f49525d54

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
f1c5f5604f5c2c0cfdc696866f60c6c3

SHA1
25643fc3eef898f4288205c711b693daaf8e78ee

SHA256
e46eb23160f9e87a0d5aab8fee0e1d1aafe7299964864a2c59e9b9f718105406

SHA512
0b562af8b178af10af225649e6c043bb848cfff81a5fa19cac9614eb8f793a97de25aab302bba69c7c35353dfd62baa0cadcc3635c773be1fc10d180241dab44

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
64ad801a1ae3d24396147603cd5e8b41

SHA1
e9bade01b12321017c450990294b40232c3f7e92

SHA256
43dc5c7067bf4af7e8b67b472ee73143b74f4e65efa51e9049476b5bec568645

SHA512
37c761400fbade30b06cbb036a288fa9585ed2e067834ff62230097151a4c923118811a79b126a775a15f08238fc957582b3ac41c30d2834d2a7d2ca6dd449a1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_kn.dll

Filesize
29KB

MD5
b772db9d925f936765055000bb2a4467

SHA1
3c85a28a6dc67e376cb72e25064a5e775b8fef87

SHA256
df7dc4e535280090722edfea9f3de3197d1e35d3c8913ecc33285aeb00977e5b

SHA512
00c732875c30a4d8dab0582fd9255d9963fdeb0e334f75394b6992c9a0620a7a549ef58076f75bc13b41855b356db08b49959d65695ae859b64f4c3caf6c4b0a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_ko.dll

Filesize
23KB

MD5
149ebf8a4922f050b73f3fb40519d0d3

SHA1
141e3cff4b20cce5e3d667d9b56826a5947b040d

SHA256
6d42d10a0e2f8cdfcc5fedeb52ac351c2a28e80d2e9e4c59b5a68ff5c258f418

SHA512
65b5488070c58b5593ba8415c3d6834a6aa7bd17f39fe8120b509762860a5386a1a2a975b740bbdd9abcd3477e6ca9bc98eb35ea46cb148eed0527f504f1e737

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_kok.dll

Filesize
28KB

MD5
b618d09cdf4473a17d9041fdf3309682

SHA1
7a36cee82849e2beadc82b88640ad25bf6eeb0f6

SHA256
cf5af46c9f3f5103c291b80754703d7c4f90a34b5a178631b6b018ae737608c7

SHA512
788adae6cebf5cbb8502453655f4e09ed22b8176bc071e4af5e82cc52ba34cc11fc6a60e1e5085a6ddeb7d16e4f342c991125c08dc6b1e7b630f65b4a567d346

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_lb.dll

Filesize
30KB

MD5
2098457eb957f51e0a4d01c0f7742483

SHA1
5259907d75441a249d7831739a3e425de7a95fac

SHA256
aa0b46a2131033a170b893e95a2daf4fc66d0d9bf30dca2e6e22a4aabab51b51

SHA512
a014dd1e4d3433c9eba9e98cd3b491a4b9e227cf414d37cae197d5992c57d4583452a1676828b0a44ece02be373dd2a44f6708943c3b6aa1a99dedea9aeb832b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_lo.dll

Filesize
27KB

MD5
f05c5afd8fba163d63a0eadc15ead729

SHA1
37a09e16164761234dbb12a0ff05051d21dee28f

SHA256
8b9e0b55dbbeffb8cfa9b14cc172e8257597aa52414acf6e08392fa5aa1bce70

SHA512
44d469976e09694f12335b5c66f49873c75d5caa181b1bb2e0b2cc174c630143cb3f067c5937e020794cdd2a940d86e45ecd8672fb44e3c4a20193c41aa43f4a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_lt.dll

Filesize
27KB

MD5
14a6bd067536c13b7bd33830584567fa

SHA1
47362233c439cf398c2898bbc0ca1bd0b39db55a

SHA256
28a8fcdf0639f8a456c741a889a994b5b13fc64ae87e294a67afaf28549bf1d0

SHA512
3e03a74b14f3efb9529a2b212f1a2fac5ee5b7f11ae579b1950d1d53e9ac1db7e9424acf58a9a68c9bebec7d2068851a4e9f8f88e5fbfdd16206c159b9301bdf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_lv.dll

Filesize
28KB

MD5
3b20fd47caf6b5b640334ec6d5b6ac20

SHA1
55929aeb391a0fa49daf8c3d281c1a29aee17e47

SHA256
d67844a5bc828804efdcdf9d7049ea1723f683ab62bf131d652da2567866087c

SHA512
788987f4787eb5945b397f331d8b97d58b0b4089086d67acada92fc9b6b5efa63e603403ca9ce092ae296b0991bb981a4ae8f70f80e81afa2a94b80f8a3b4aab

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_mi.dll

Filesize
28KB

MD5
9ca6152e78f814483642cd4fd0a99588

SHA1
fc1fe8f952dcede8d50aa0d69ca6df2caa8c31b7

SHA256
9848ea308d0aa31e282b4e489ede990c15a1e5fbdbea37535b35632275d76aea

SHA512
2fcd2d5d29882d6c331940148246aa927a5e0f22de5c1c4555026ff2d08c4086ee60cf60f9eb811ea6abe81e22170a213057b1d1cb316ca80a5c26bd9ee1ef44

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_mk.dll

Filesize
29KB

MD5
411336e9b6c676712b17ecff37a143cc

SHA1
0b8dfb3b553dbc1a488a45028bb90b9a28c72659

SHA256
05d6e8db8a70207d3c0d59f755b4b58ccd6229c033250ad01c2401c264ddd0c8

SHA512
4e1ab5bd9d71fb6c68f8b5d383a8768da239daabd7dfe33844591e3d321f4ec33d51f3ed30a4403e45aec09760d14e27b0965d4802376a6ad33ce04ece5b6550

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_ml.dll

Filesize
31KB

MD5
f76114d0c6d2a027b3b070d68c9db8a2

SHA1
53e25177cf8ad4fd2eeb91044c02080e833fd241

SHA256
6379b5e3aa4e2052779bf1f18c4530abf990278652f8d74b2098dbba913d4129

SHA512
ff30f5bd0081ff6a6e76dcf907d71f06a08c7a186d700b10523d275f64406654280f4b8a60d8ec86d3fb8285744ecbbc54a22bbeba7a1436c3c0bd408eb90ecb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC37F.tmp\msedgeupdateres_mr.dll

Filesize
28KB

MD5
e642ef3e1a1c30191942ce075dfbb27b

SHA1
3817fbf611e9c33b7c0c8a4b14849237b589ced4

SHA256
2e9f09fdfb84dde494ba09e1e8f40ef34647ebef59065678724f4e8202997cca

SHA512
1dd6a6ca7a3f481e0ff5f89daef308111943367c62b71d455dde291383fe1bcd019081d94dee42071c1b90cf68e48fa7b63cf361f42ea420a8e2580c82b19cea

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
56a660925b1ce4d896c3c49ca76380ad

SHA1
34b7893180cd122b59ff19111066b1aa5c60caf0

SHA256
3ffeadec0c8785652ae66079587ee4e5a3b6289e1cbc408fdbb1d9829faf2dce

SHA512
9840ee929bd1372d98ad27b0134c72cc64b31dde512bb309de2bdf252db199239a4ea5b3ace2c6e2ed740a7d4cce126ab6a2a968e62b0e0b6d0696450a073128

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
60KB

MD5
fff8dda67f1e367d5bb9126570e5cfc5

SHA1
563853442feea1fea97e0b17c078964a4b878178

SHA256
ff859da3fe3088fc99e46379fe8ed7fbb62c785980d31da5e35f948d36293ab1

SHA512
ff2e182c5d1368d3bd92352c9d93231c5a3415cb29ccba0394534d9f5089b3c5c406d56c76341dcb942a177b9aecd10de0aed171297e2028fff8d6affe549d7c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3mrom4gn.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
0f96b422b78324e132a820d3dd057c84

SHA1
d6a8c66df5c9aee678528c6a45e4ade78ddbbebe

SHA256
d195ae033e6f111bc4c738ec99a28bbd51556db600cf2ddff395a86f1696edac

SHA512
f0debfcfbbb4012b15dc686118860b872d500b81f57bb55ca76f4d49e53ad7944c233af82d09f8d35cb1602d1c5d148e59caf0a749537bf1131f3d56e5178b10

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3mrom4gn.default-release\cache2\entries\02E8C6E0B9504E35C8EC759633CA1ED0EFA9B8F4

Filesize
95KB

MD5
b7e714a10f1b1f7ade7ac873598a6d70

SHA1
2d0491b7778c5712d068e0a25b1d56aa7ef15245

SHA256
820cec539e6c8bab7e92a79e9646af0afb3b0cb6f74c99d923345e88a5cae64e

SHA512
a565701c4edaf2e772ac4f618341fba230e51cb375a3e1a346553a6acf1831a21119ff14f0cfdc4493bf7e3c47f86e154fb5bfb6390dc066210bbf43e606a628

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3mrom4gn.default-release\cache2\entries\3B60B52642E87C965983787197F5E13CF39DC4BD

Filesize
97KB

MD5
2b9208d54a5e5247a722448f96372b8c

SHA1
e1713ba49ed5af794898fd828229415102b3668f

SHA256
a8524ac4c70942930fec3d2c29937f4d96b6eafaf4f10b7e72f1a80416502042

SHA512
184d86f4cd6a7a1ba9b4bbc747d6fc010031da39fbb55f0ec9d3b7358f5a83b687b1bc912d178d27db40d817c302f6eb1172736f0029101c6d3c6db982f653bd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3mrom4gn.default-release\cache2\entries\52E1A5F5904D864BC54C4678FE8113AA3A212996

Filesize
86KB

MD5
7842b1477bafc428b405c48cbe34535e

SHA1
59f1bca678bde9175f8d6e503746dfc2ae0b891e

SHA256
510263d6e14f7797c1f2c00ba6e3aa69d17f8fb5bf6c96febecb52122b288718

SHA512
522257e705614f3a41ab016dd949576c42a5a34fb6927c9e51b6f8e61c201bc9145c368be23b14b3e1a3998bef743a32e212e4751a1acd4acd9eef05faa6a9ba

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3mrom4gn.default-release\cache2\entries\8594CCB54834483C16E499AF422E8C42E8746345

Filesize
125KB

MD5
09de8c29db0567f97bdfda733da24528

SHA1
b5077389f6b0378886c1fe92f0d0a5de650edd79

SHA256
06fb9e1ccae966256c6cc36b76e6b61cb13fbd569104b8783cb122881c598c72

SHA512
5ac88aeca8f257356f76a4d820f910a6af6d93ccf962caf756a7691e38a6a535350d1b26586c2fb7fd1367be343f20658665e403827532856aa065cb55fafb4d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3mrom4gn.default-release\cache2\entries\88D2DD145122466A8C6F39785D5A392BF5E86A0D

Filesize
81KB

MD5
9a67841085624405e113cb083945d94d

SHA1
fd76e6539e24a9ee5d063601ec4114efe0454448

SHA256
11ea4912ecdd8ee24b487885b85dc6aef2cae89999e79788f6e20da72dd4654a

SHA512
7f626bb91bab7bdd60420615530d7affa243e4eef40eacfe593005c30a61595582268b49baac53237f03864ee99136f5359fef5bfb274313d350ec5936b7edb5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3mrom4gn.default-release\cache2\entries\92B7809CBCCEC32F8AA6B585CB23104E10E55D53

Filesize
791KB

MD5
ae44fc599a8d380ef6a4eac06849eb1d

SHA1
03ed4dffdd0a52230704911393eefb74c0c168bd

SHA256
aea3380372e80b082908cc9249ae4728d6b93a1dcff0c467052aabb36a7e631e

SHA512
9d3693a677ef243f225349dee4bfaabf7eee7429cf65b115e86803659fd46209d795fd8e81a580cbb823d94aadb141a85f12fde513759d8bc3b8a94698f00230

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3mrom4gn.default-release\cache2\entries\97B10BC4D7847C8AE893CE9BC8685F05EBFA5B05

Filesize
2.0MB

MD5
1d89df9a67643785c7bcaf5e8283ec36

SHA1
9d93b4772eef5b13a637c8c950790ff68ca5eecf

SHA256
3cd02888d0df42086dcf7182156d8c8cc92e28b79b8aaebc74612c73c7bd4578

SHA512
ed5465b493292c5c885e3291d9301e0894583a046eb17be43fcccc476c5029b849243bb90ea095b2fd1debd6ea0741d0048d355b8d6e2de43aa0623c60842908

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

Filesize
1.6MB

MD5
2aeb55b75f68b4ea3f949cae0ceba066

SHA1
daf6fe3b0cb87b4e0ad28d650fc9a190ad192b1c

SHA256
22484fdf3008a593e7ca188863d423b8b2a345391120ed296ce8b156cfa983ab

SHA512
3b6a6d6c87b8d9ab06fac72fa38067df4c7d4385d37d391d7ad58a623215681fc0366621ce3ce5c08af25e11cc468b18844ea5f7c8ccb71473c956c29d20188c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\AlternateServices.bin

Filesize
8KB

MD5
146b3c25e8c58d5dca699ff7f6083126

SHA1
de8513de05a2e926d38bfd24a47a2ce4d2a8f6fa

SHA256
039293ab44dc01f3e550c3eecb4bdb4044d6204e90b1db3ec2f3d23b9b9b8f5b

SHA512
c5fb89a4f186234b3fc157ec6c48fafe0595a8a7237c39dfe1231123cfdb618783ee8f40559c11d0fcd26916632f62680c2cb23e8938274b39223867bf85774f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
dd3e8b0206c62cccc093a9dd11f874a3

SHA1
9e403bc2562ea8818209da6105e3a05bffaff88c

SHA256
6d2572bd6d16bbbefe9ae332a5c07bf82f2cb5c60fba0f4ecb20a3ff2cd08762

SHA512
d0f0074347a74f70619fb4611f3c592cc4c1e34a7a898f51ac5d485fc4280d7e5a2fe60adea9cfcaf8ca0b5f043159da9ef5f942b063f687d91d2ad64a607ded

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\db\data.safe.tmp

Filesize
14KB

MD5
ad3fede26aa9ba24faec0b46d417e749

SHA1
e1695479a1db1138f5c34a2763af119bcc18d3e3

SHA256
d84b6ea40261e8fcc4f294af89867ad1dea93008f39f7a016f6cf4f2adb3353d

SHA512
0e56306f88b883e5858f234fb664c35a6c57b4e13951749c727a64ac869ad70b8362e533867a1badc0a6b15d695efc6472d8b76b066ff13596cee14d10a57518

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\pending_pings\129f07ff-02f6-4266-9a35-951701d2f200

Filesize
671B

MD5
6eeed41aea3b75de4e44905fee43e7c2

SHA1
e3d7f0b37799155d672a13454141b113208f0f87

SHA256
d3d4192eee4c8c0ee0f59392e14f420d006a30e078fb5d4d24062272bce54755

SHA512
8e6c8fc76b89059154e94ff7721dd6a92dc5a49fd0584246537adba15103c2d07071ffc21163e5cdf75f0579c6cc171d473730e80f51220bc3c81dc9c8766bf9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\pending_pings\441dcd12-5076-4616-b455-8f835ca6b21f

Filesize
25KB

MD5
c47a25c865fecee45ac759da9f616c61

SHA1
05e5620fe2b69a343f3dff2d1b3e4f768c6acd75

SHA256
f3de6f7dc4938cbfe550616bffd233226fcd986fe2f7a18e677572dc7e4ff631

SHA512
b55719db46ec41efcd2e5e57ab9c5f0a1b4ca557a32b25735e37f8bef3b0a8628fea391100dd92adf2284ba1cd134f65b10ba58651b4bd80d4af1d6adcf874a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\pending_pings\aa2080b6-2a0e-4573-9744-6601f8d70713

Filesize
982B

MD5
aa7204a0b79db67558ee871f3695e2f0

SHA1
1f29c70d4c7b274fef51018534ffd1d944ded774

SHA256
ed53248949301425f0a4f844f6187ac086e65f1f01364cbe9af5810fefd6d872

SHA512
46643a73fa49cf4a97f633a63c6e75746f5deafcbd90a68ab0edf3b9882fdcb42cc88d974cc3f9dfb6d3947a4eaf23e1dfe7069e7e2d042cd6aae247cab8d5d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs-1.js

Filesize
11KB

MD5
2e7bca09ba3b9af50cfe20ad1d740508

SHA1
009676a2c38717bc7c2812e06ae2c15d8cebfd3a

SHA256
d6e60207ce2e89637ddf87c0d0b62bc8676c407de5a862a817ad3c34044766a5

SHA512
c316d7c0a250e46e508ef746af6d6d1b3ad119568bf095966dda4c7e5fc572934696bfe544eb422825d89ea3bbb52d28607e98533055a0cec0b53404543d1a3d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs-1.js

Filesize
12KB

MD5
25f322bca2b9ee8bfd5057cdc41f7c42

SHA1
b084c345c699d6cb1ac7c56012dd9ade3851b138

SHA256
e04c000a26bad235fbf5e31a5a1e9039ae13d2bf8634a785ebc671e79972e357

SHA512
9c59da570713644b8a5874969b5d50b6f8cc55e89717f0471b41921dedb4dc531fb2715ac29723a41024553685ce112c91fc002e42b7db3fe1be624cf8928a7f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs.js

Filesize
8KB

MD5
d0abcf7ab9eb0cc39dc53d454360d866

SHA1
b8d37158f7d47178718a5755e0b8477d8c5dbf55

SHA256
5b88db93b63ee51a6e305256baf337f4bcae33b75431f5221f701c29f8dd9c31

SHA512
d05d18785d67f74c10ce487fa0ffbede28386baef4540cf11ff2e5c1ddace4ade9c391e90af884fb4657b6ecb2fdcc71da6da2af40954bdb9f13cf2bbe0eb689

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs.js

Filesize
11KB

MD5
ad7a2ce6c8a2facb7255c548d3428d04

SHA1
424129991b34570fc8f2224606f99f499ec2e2ae

SHA256
34c6f862f25944fa3225896a8191a18587bcf2c2a4fd34aa2bcb684e3b6bb7d4

SHA512
697436bfef00808eaeb18a3cadcaf0ca4099c5acf18243e7270efc2098e44467f4e9ec33b0947d5c8e28e6dcec360fe54578452191ecfd997d0569299bc68a3c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
6828f1fa6e181a26e83e16aacb4c1fca

SHA1
0b5a1405e30392380b616a297cce25b88755807e

SHA256
4d6f0d686a50d2c9898352fa22c7c70065ab08219e9eade1429f0f85881983f4

SHA512
292938392df0eafa4cabcba1fced88f9756b10aa7b7b07fae7aeab9888634d8bb8ff7a775c4ec9ffed90a87f9b0d3ae2805f10c8f066007de1ef94480577ef64

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
3e9554cd92a4f601f5ec08c8241bc292

SHA1
d71f8188d773c73b11e8f2c9f3c9ad4b3af3d197

SHA256
a5e94e5d9643987cf17f8501bbbec41556402c233daa72c65513b7eb483a2cc0

SHA512
16440436ee79a20e88247e9d75b8532f4e887bcd2d184e923624738beaa9d9f66d774bd48194274ee9cb45c6b81f8a3f954a2042e957d4b90faeb7470a1d97d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
b0090db4b14311a9d3ad66185e38a2d7

SHA1
435367971688ccc054350f53a95cdbd0b0cb24fe

SHA256
a30095f1d3a054614e645f74b37830d978fd7f531ec8bf1347232e0ae17cc500

SHA512
18c231bd71e3bb25644e0fb57152164f1a8d94ec1f079f6111f3082d61fe650298dba79bc974b1eb28eccc30f4d8c3fc71e2eb6d9b9b954590a7623f2c1c93fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
a638a9542be4f42d5dba746d099f0edd

SHA1
786feea537b95264d0c34c1045977071d2b844ef

SHA256
988d9f7aa3b3a9a86792b00e51d58145e90f8c6289e63b026b8259f50cb4d05b

SHA512
c489ce67ede4d16dd9c362b6835788d863988037531b8932a8e7eca26b62663a8c5e7872c9223b0f333af51a25259b4c0700ea7f745cc37fb81e2b42daa790da

Download Submit
C:\Users\Admin\Downloads\LoaderV6.sqWNk9ZS.zip.part

Filesize
15.2MB

MD5
273e74c7c8e4fefcafca7ab2c634fef7

SHA1
9a01e91e93cef5c77de8c70b8ae80da15a540fff

SHA256
18b7e51b0f80744208e78cdbdc707e5b8467991af8bdea3c47f3ee25ad864277

SHA512
d3f788e51d165b72ebf9c46a3463dd594df308bc199a8f70db25945450ab0c5da3cb1aeffeb6cf9f46f323150bd4d5d660fefd054fed956a5b491dd21e228277

Download Submit
memory/3540-474-0x0000000000BD0000-0x0000000000C04000-memory.dmp

Filesize
208KB

Download
memory/3540-475-0x0000000074360000-0x0000000074585000-memory.dmp

Filesize
2.1MB

Download
memory/3540-758-0x0000000074360000-0x0000000074585000-memory.dmp

Filesize
2.1MB

Download