Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/11/2024, 14:57

General

  • Target

    tox tweaking/niggers/MicrosoftEdgeSetup.exe

  • Size

    1.6MB

  • MD5

    9008b1f2c99b79594ccba4afd923056a

  • SHA1

    4d88557702696906b44a37b289b4a5716e7c9fbe

  • SHA256

    7531341da720162541747b3142722f9c52d9d5fe57678d8aeefa62532014f672

  • SHA512

    ab9a48a6816c97d3e5988dacd8a2f270bd30b16cc558e0667c77a65121228bb3de90d03bf8cb48a92fe91c737876e260f2d782cb1aae18f1711e5f5679be9cb6

  • SSDEEP

    49152:jiEa3J/lPA552bT8TCKpxVt2sl0TD5yncADYOS0jZ2/vgm9d:jirIOoT9pnt9l45mcADRS0SRb

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 53 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Checks system information in the registry 2 TTPs 12 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 38 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=en&brand=M100"
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1508
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2136
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:3056
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:3564
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:896
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REI1M0QyQ0UtNjRCMy00MjlBLTg5NzgtQTJCRUQ1ODczMkRDfSIgdXNlcmlkPSJ7MTA2MzRBMUUtMDJFMi00NzhFLUFBQUMtNDdGQUVDMDYyNkY4fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0UzMUFBNEZGLUU5MkUtNEZDOC05MUQ2LTg4MTg4MkQxREM0OX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTQzLjU3IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4xNSIgbGFuZz0iZW4iIGJyYW5kPSJNMTAwIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDcxMjYwNTY3MyIgaW5zdGFsbF90aW1lX21zPSI3MTkiLz48L2FwcD48L3JlcXVlc3Q-
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:1152
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=en&brand=M100" /installsource taggedmi /sessionid "{DB53D2CE-64B3-429A-8978-A2BED58732DC}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1524
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REI1M0QyQ0UtNjRCMy00MjlBLTg5NzgtQTJCRUQ1ODczMkRDfSIgdXNlcmlkPSJ7MTA2MzRBMUUtMDJFMi00NzhFLUFBQUMtNDdGQUVDMDYyNkY4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QzVGMzUyMDYtQzA1NC00M0M3LUJENkQtNEVFNDNCMEU4N0YzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjMyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MjgzMDMyNDEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM3Mjc3NTkzNTEwOTA1NjUiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTE0MzI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NzE4NTQzMzQ3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4172
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\MicrosoftEdge_X64_130.0.2849.80.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2316
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff73affd730,0x7ff73affd73c,0x7ff73affd748
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:3336
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1068
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff73affd730,0x7ff73affd73c,0x7ff73affd748
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:5024
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2084
          • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff71891d730,0x7ff71891d73c,0x7ff71891d748
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:1712
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4248
          • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff71891d730,0x7ff71891d73c,0x7ff71891d748
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:2008
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1384
          • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff71891d730,0x7ff71891d73c,0x7ff71891d748
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:3048
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REI1M0QyQ0UtNjRCMy00MjlBLTg5NzgtQTJCRUQ1ODczMkRDfSIgdXNlcmlkPSJ7MTA2MzRBMUUtMDJFMi00NzhFLUFBQUMtNDdGQUVDMDYyNkY4fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezhERkE3ODRDLTE3QjItNDkyMy05QTkxLTdDMzU2M0YwNkRDOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEzMC4wLjI4NDkuODAiIGxhbmc9ImVuIiBicmFuZD0iTTEwMCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNzI3NzkyMzQwNTM4MzQwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ3MzIxMzY5MDUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NzMyMTM2OTA1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTEzOTc5Mzc1NSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMjdjYjcyOWQtZmY5NC00ZDM0LWFhZTQtMzM4NWZhMDljNDRjP1AxPTE3MzE2ODI3MDcmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9RGZURlNkV3V1QjBnbWplaDF0OXc0am5tZ1ZONHh0MzloNkxLdG55JTJmYWtpbnBSYXhrOThvY0hJQ3l1VlRhZGZPUFFKaVl2OTAydlA4ak5JOExseDIlMmZ3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc1MDc2OTIwIiB0b3RhbD0iMTc1MDc2OTIwIiBkb3dubG9hZF90aW1lX21zPSIzMzg3NSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMzk3OTM3NTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTUzNjk5OTE4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzczMzg3MTI4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iOTUzIiBkb3dubG9hZF90aW1lX21zPSI0MDczNSIgZG93bmxvYWRlZD0iMTc1MDc2OTIwIiB0b3RhbD0iMTc1MDc2OTIwIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MTkxNiIvPjwvYXBwPjwvcmVxdWVzdD4
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:2052
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:2080
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-installer
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Checks system information in the registry
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2820
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffbdd054dc0,0x7ffbdd054dcc,0x7ffbdd054dd8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1580
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2200,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4844
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1832,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:456
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2500,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:13
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1404
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3420,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3112
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3428,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2836
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4132,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:9
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1656
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4588,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:9
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2764
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5280,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1040
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5440,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4776
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5476,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2752
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5680,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:536
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5688,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5260
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5604,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5332
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6192,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5696
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\cookie_exporter.exe
          cookie_exporter.exe --cookie-json=1140
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5884
      • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6808,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3080
      • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6808,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2628
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6988,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5320
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7152,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5432
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7052,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5448
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7048,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5668
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6392,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5840
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6380,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5940
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6268,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5756
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7568,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5720
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=564,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5856
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6880,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3372
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4772,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5148
    • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1488

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Installer\setup.exe

            Filesize

            6.5MB

            MD5

            b621cf9d3506d2cd18dc516d9570cd9c

            SHA1

            f90ed12727015e78f07692cbcd9e3c0999a03c3a

            SHA256

            64050839b4a6f27d896e1194e902a2f7a3c1cab0ef864b558ab77f1be25145d6

            SHA512

            167c73cf457689f8ba031015c1e411545550f602919c35aff6fd4d602bd591d34e8c12887a946902b798bf4cf98aadfce3c2de810bf16c7c24a216bfd8abec19

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\EdgeUpdate.dat

            Filesize

            12KB

            MD5

            369bbc37cff290adb8963dc5e518b9b8

            SHA1

            de0ef569f7ef55032e4b18d3a03542cc2bbac191

            SHA256

            3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

            SHA512

            4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeComRegisterShellARM64.exe

            Filesize

            182KB

            MD5

            b69894fc1c3f26c77b1826ef8b5a9fc5

            SHA1

            cff7b4299253beda53fb015408dd840db59901a1

            SHA256

            b91bad4c618eb6049b19364f62827470095e30519d07f4e0f2ccc387ddd5f1bf

            SHA512

            8361e97d84082f8e888262d0657bac47c152bd72f972628f446f58cbeacf37c05f484dce3fb0d38c4f0da2a2dcbb0813639d201d127ec7f072b942d43b216755

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe

            Filesize

            201KB

            MD5

            136e8226d68856da40a4f60e70581b72

            SHA1

            6c1a09e12e3e07740feef7b209f673b06542ab62

            SHA256

            b4b8a2f87ee9c5f731189fe9f622cb9cd18fa3d55b0e8e0ae3c3a44a0833709f

            SHA512

            9a0215830e3f3a97e8b2cdcf1b98053ce266f0c6cb537942aec1f40e22627b60cb5bb499faece768481c41f7d851fcd5e10baa9534df25c419664407c6e5a399

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

            Filesize

            215KB

            MD5

            205590d4fb4b1914d2853ab7a9839ccf

            SHA1

            d9bbf8941df5993f72ffcf46beefcfcd88694ebd

            SHA256

            5f82471d58b6e700248d9602ce4a0a5cda4d2e2863ef1eb9fee4effcc07f3767

            SHA512

            bce1447d5d3210c22d52dec3b846db091b65ed03fd9d7cd11c6c4dbd2aa5a943d881360bc033c29abd61011581ff9354b35cbe421719d92568ed99997bfbbae8

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdateCore.exe

            Filesize

            261KB

            MD5

            b07ab49ee8453853021c7dac2b2131db

            SHA1

            e1d87d6a6e7503d0d2b288ea5f034fe2f346196a

            SHA256

            f8535d5d73ebebed15adc6ae2ced6bb4889aa23e6ffe55faeabd961bf77b05e4

            SHA512

            5eaae533fbe71430ae2a717f7668fd0a26ec37624e198a32f09bfdbee7e3b6e93d64e4fbb78cbdb05c4fe390a864490ea997d11849ecd371f5153bc8bfafccc3

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\NOTICE.TXT

            Filesize

            4KB

            MD5

            6dd5bf0743f2366a0bdd37e302783bcd

            SHA1

            e5ff6e044c40c02b1fc78304804fe1f993fed2e6

            SHA256

            91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

            SHA512

            f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdate.dll

            Filesize

            2.1MB

            MD5

            5d89123f9b96098d8fad74108bdd5f7e

            SHA1

            6309551b9656527563d2b2f3c335fd6805da0501

            SHA256

            03c3c918886e58f096aa8e919b1e9f8dcd5a9f2a4765971049bf8da305476f44

            SHA512

            9d8190e5374cd1b4adbbfb87c27fa40d4de529d7c0a20654e0ce189a4cb9a53d3708c4ce657a7a5469b015df7efbbff495fc844579d9cd363b329b7e007e85c8

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_af.dll

            Filesize

            29KB

            MD5

            4f860d5995ab77e6efa8f589a758c6d2

            SHA1

            07536839ccfd3c654ec5dc2161020f729973196d

            SHA256

            9841d787142dd54fea6b033bd897f05f3e617b48b051de0ee3cf5865b3393150

            SHA512

            0b9a661b76360f1fb2eb3ee25c6bf2cbab7ec74e2363e0af321dc4d0afb3cad301dddd16ea367d588451a40a2c2ed41f21d7afae48307e1e4a4ec5b24165b378

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_am.dll

            Filesize

            24KB

            MD5

            f624de37750fd191eb29d4de36818f8b

            SHA1

            b647dae9b9a3c673980afa651d73ce0a4985aae6

            SHA256

            e284453cd512e446fcbf9440013f8cb2348ffd6b1acec5366f2511cdf88b1794

            SHA512

            d1d65e29ed59e34d4ff66df11a2368f1a724730e32eb245022d4f3d1fadf16d445ba8532460afb0e6e91f8be60a7240d13577403193042d1e912a67e4bf23b1a

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ar.dll

            Filesize

            26KB

            MD5

            5de3f4dabb5f033f24e29033142e7349

            SHA1

            5c446985de443501b545d75f6886a143c748b033

            SHA256

            2533d443b68c5288468b0b20cc3a70dc05f0498369d5321368a97dd5bf3268c8

            SHA512

            c96296e6f67edeff2be5dc03014a8eb65fc287fb899357d4608c36c07b4610827aa18cbec6ccd47b66230a12341af488aca8bd02632fa768f84ca7b1d9c9d065

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_as.dll

            Filesize

            29KB

            MD5

            1fb14c6c4fee7bfabe41badb7c5acff8

            SHA1

            953d94cd73951943db14c08cce37b2d3ac821b02

            SHA256

            cd32339fd7e4a5959e93eb5bfd6e009e4137e15c5e6c2e861d7891487216da49

            SHA512

            a93b081935fbe48fafa8071a9cd593ae7b19205c70eaf48c724397019a04161460c66d6d8c6ffd872f4d52a4a7aa25ba1cba04181b9ebaca04b76d111ea588d2

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_az.dll

            Filesize

            29KB

            MD5

            d3345579310f3bd080b406de47b2305f

            SHA1

            16aefb27ea6d81c684f041aa50ebb49fdd403d83

            SHA256

            b4ea3c63fa0104093a2b2034f950428e66d2cf3d55f0fc5bd688483392d60d69

            SHA512

            65e4aa8587bc579b5109d91e02745f6de96a23b6ac2962cdeb6d9d536b51abab12b2bbaeca72572c3ae1971dac5bd24430eb2ae5ccf44a7068427594e4afdd7a

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_bg.dll

            Filesize

            29KB

            MD5

            ecf3405e9e712d685ef1e8a5377296ea

            SHA1

            9872cdf450adf4257d77282a39b75822ce1c8375

            SHA256

            e400415638a7b7dcc28b14a257a28e93e423c396e89a02cba51623fdfbdc6b0b

            SHA512

            37e5f1b3bdd97a4370718dc2a46d78ab5b66865d3cdb66a20a7dc20a9d423ccde954c08f97e574fbab24e8dfa905351cbfb94bd3e6692a9b6526097ea3dc911d

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_bn-IN.dll

            Filesize

            29KB

            MD5

            051c429fa2beec9c2842c403a86c0e7b

            SHA1

            0a06a45200a1f5c81c48fbd2d03549fc9fac3a58

            SHA256

            1a8465922bbb05a97a24f6c2200fcc7afd8bd0ace245c2eda9d9d335d4fb9353

            SHA512

            bb59b41804328f27ba8861af32824266ca69ddcfdaaa11551b1edd4e129dbba630da8070abedb28e180045f8d0ddc1209cd901919f6b9aa421c457188af795c6

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_bn.dll

            Filesize

            29KB

            MD5

            82711e45d2b0764997abc1e0678a73bb

            SHA1

            47908e8885c86477a6f52eea5fddb005ec5b3fa3

            SHA256

            2bb7455999b8f53a2a0834588ca4da4703f4da362a127d01cc6bd60ca0303799

            SHA512

            4b517796edc954ab7f5a26a5d6605925dc7e84b611bcf59352b3b95f719cedc72c77a465fb1e7bc2d2f422d596c97968dac5b57292c82967d5cfaff980128fc2

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_bs.dll

            Filesize

            28KB

            MD5

            a0a1f791984f1de2f03a36171232d18d

            SHA1

            71f69d8fe47640ba9705725d7d627a05519c8016

            SHA256

            d2c7da8f4745b81874a9666c7d10a779a9956b4de0ebdaa1647bf78d4e17d85a

            SHA512

            a4267911846cd55eb91227b0117ccbfdf8ef6c4ed0b8935b08e5d41a91aeabd9259988c71da8606cfb2876c4d69df6ca5a246687440283f1625105624305eb33

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

            Filesize

            30KB

            MD5

            897712b508931dab76d39b209611740c

            SHA1

            9d80e07c2dc744e2efce3b67aa9876949fb9edfe

            SHA256

            ee64fdefdb3381ce61fc445190cc44b015e7b65a3a16d28f3477f68de6079f1b

            SHA512

            3329e37318dd9b11f282301e453af106168d3d10beff1ed62ffdcda60c6b4edb6b9c69ac6b9bb8abce3c9a9686a0152404524012dbff025e571de2cfcb3b5d56

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ca.dll

            Filesize

            30KB

            MD5

            e90155442b28008992a7d899ca730222

            SHA1

            1d448e9709de0d301ded6d75caaeba4348a4793d

            SHA256

            6ae98b5e2eda22a0236434b7e952d732e3cd5d9cae2e51cd70222f1fd5278563

            SHA512

            a91d8357ca976db2eb5a081077304a50edc1b55b2775c00cfde05e03831f98bd04e43f0dba5b3efd5a6370afcb10b23bbf307412467502e9ef57e0beae636013

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_cs.dll

            Filesize

            28KB

            MD5

            1de961b662a374c3af918c18225f4364

            SHA1

            e8f1c438e57b322f43b4b851698bf38c129eb6ae

            SHA256

            bb1365c5770dacbb918af27b47b02f269504f4d2396cf3f82bf5ecb2551c5021

            SHA512

            c6bf62b684039f62744f1aab07f4751948e0c175f7fb7fe126f20903ce23fcdd2e284f1b794922621dae7eaa15c6dae0177ad102289a18f967721486f21073a1

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_cy.dll

            Filesize

            28KB

            MD5

            29f027d2d5fd486bdc20386ace925603

            SHA1

            66b8605f23871b4a8302bef0aaccb36ee1e72755

            SHA256

            03c8566f749e8fa349d97101849bc3b2cc0b7561b565a2b0928bf8fe901da813

            SHA512

            3348bdf10b2d964b34b791a774e28c97d3caf28d7f90e36b948cc2cb6c21e84cda933b7ddbd51c8fc604a450361cb834322c15ddbe0f4851154d05e5a2a2ea42

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_da.dll

            Filesize

            28KB

            MD5

            b0ae9aa0d5c17ee7abfc57d21cdcbae6

            SHA1

            01019eb6ba9c123be528136e12192b0bb33df407

            SHA256

            d10938919e3d28d71e8e3ba2d8e02e0f9dc2faf148cdedc21c166fd994c603e2

            SHA512

            4cba25c8159df865231b08fe650eedfb92d54c3037d28b2b9af010c8a59fa23669041a6c393622fe69b0194c2532f71f02b740f7e26e0bbf7ef34a421d6747b8

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_de.dll

            Filesize

            30KB

            MD5

            ad5b530eabff0540078c5d17f27b9610

            SHA1

            7e53dbbf64e70e561d37669e69f50eb0da8e37d1

            SHA256

            49f512316a51e51027b4e70de4ffe8c8ecb188e126439a90a5d12d52a0393966

            SHA512

            e1cc853d96589220676d39d91d4108633ce56304640f770e7d22b97a9b3be9452d5fb94e4e7fcd1400b62f0c398da8255c53a31853194a9e7b7784982b5ff40f

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_el.dll

            Filesize

            30KB

            MD5

            a7e64339a5314e3576c0d170171fa52a

            SHA1

            6c12aab6c97c30aff3245b78f7a3afeea604215e

            SHA256

            4e9ccecb8e4383395f2134347fbad00521345ec9c857d8fa102d5257c7bea9bf

            SHA512

            a4ca3fb60a7f4bda50847544dd1289d750f0d4b3565929290a8392b92822ef1856cec15a1f63f2c6fe1ef2e7cc0936a35bdb38ee5d904eb08cd32f05addc6ee4

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_en-GB.dll

            Filesize

            27KB

            MD5

            74d4cf3b8efb6cc3d0acc3eac38bd5b7

            SHA1

            9337803aadad9042c895b6f418b4c733b81221e0

            SHA256

            b83c8981d8835e4c78250bf265faa6d64693204b77764c8e349abc4365ae9871

            SHA512

            e6112ef60d56101aa16327042162d6ef43519bc56668ca8eaa7fd3e1aaadc75c7df75c1e41583a292ff1a9bdc7d9ad9f5c0d97fa84964532dca2d5f3df604c23

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_en.dll

            Filesize

            27KB

            MD5

            19dc1f6d1f309eb7abf1e0c8257f41f8

            SHA1

            e2d3e86fe22c6af6b8ee5b359315dfa6ac4d52ec

            SHA256

            046f6c532fcabd969c6e63bb7ee0d7a83d806fa659006508e1c3a9485190d6ef

            SHA512

            478d6a84452cfadc48547930e336ad459eec188dd3d9e4c778cded4ec3d34e00b2b8c0538366aa644ee67f878b29c5c73444c1406c66e8394761bb0979c6483c

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_es-419.dll

            Filesize

            29KB

            MD5

            8f7f515d78d2df371993fd70f863ab8d

            SHA1

            dfae1b47e80f91abf2d9c2aac009c0a1767bc59d

            SHA256

            ba57fbb9d3a32b84d6a76054b9ad180b6510e53206b9804bb9ea18ff73c2ae3e

            SHA512

            308a62af00a4410551eac967bb9f2cea7adf7c13b471dd28b276bda40b1e4c0b4ebb60aec29b6165069d40180bc45b4f5da5baddc374ce7bc5a5bb223afb4e96

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_es.dll

            Filesize

            29KB

            MD5

            6af05d448c842027f876e93f8ac58b65

            SHA1

            f34c988e3875a1d1b267b082476fcfb8d7505a73

            SHA256

            36876b14a214cf98dda5100a7e7134d7ebb78e895535d6bd7562099574607867

            SHA512

            412031db59de0367a102a026f73072244b33d726adc5bb9fd079db3dd37b5d6a24d7420a9811576d0a356933b5ba15cc9e2a92046d2d6e6d6fef37e9d840aec6

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_et.dll

            Filesize

            28KB

            MD5

            ae9bdf6416c3630c4b0b5b119308a135

            SHA1

            d7218c677b098d2a93cc91ead39c83d3a2c653b6

            SHA256

            62da90c9417a70632aa190fecc17c31ecf433c1f84f82b08d7d7290669cabf32

            SHA512

            4333ac6cd3737f25e6e1d429b195da781ced4340b89808cbd5d5d2aae2e79bcc700419d613123d632252e31ac44d95b7718f23da5b82ab5054407e80106a64a7

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_eu.dll

            Filesize

            28KB

            MD5

            fe73dbc305da6223d1e94e1cf548c000

            SHA1

            b16f2c40d68cd9718eaaa9b6db9c8e5c4b6acb9e

            SHA256

            1ef64088a613a4e10b4cf4206f95f5414ee27872798747234a6574b7e5c70a7d

            SHA512

            d9900720d89defffa52198dbe63515995095c94aa0cbbe4f32a1c09d26809cec480e92926d2240702604b8c13fcdc0032cc46910ade8e4c1d2fc9a4bd1b63858

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fa.dll

            Filesize

            28KB

            MD5

            367ea715e942c81dd3cb734274969a0b

            SHA1

            f92f1ec2a5be9b775e67c4252a07c37ed0ca508b

            SHA256

            082da1c09782c026c9cd73456dc12539a226f0bf5d113e59bc93b29c1e98b37c

            SHA512

            c94e787ba3bdb56d1827a0477461cbba6b7cc68986722275e0d04ea7dc70db83b5d03887eec810bf9b67f70b18bd3c7b7d28f0e554938b81d3501bc11f97830a

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fi.dll

            Filesize

            28KB

            MD5

            5a30bc4216af48a493eeb0f3a9f02607

            SHA1

            2fdf65a4002d91818d56a23fb8bfd08ab715002f

            SHA256

            5131c23915ad6b5b469bcbff31d0ae31ef34ded28ca0ffff9f1eb998bba98aa1

            SHA512

            34b3a4865f31ebdb8665780011b384ada768a0f71bff77f91706b140eb8cc07fff8787f710cdb1ee14a449cae8f22ee5fddadcc501cf1c921eea078e97dc2f89

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fil.dll

            Filesize

            29KB

            MD5

            84c4736cf301b93998028ed7678caec1

            SHA1

            3b6f1f6b9eb3dd7d9a13c11dfd3ac56c93f1b10f

            SHA256

            3c8dcb7e982dac3159298009a86909b1e1000ccf6f4d333341f16d4d6fbd84ad

            SHA512

            5a1b77ef9450c32802e94e473a5b4e43e892c923ef368ee9bbbbb5b0090429320263cc79a4da0b281930c1a60861519211abd0bd67a9d9ee370bdda2230d2e81

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fr-CA.dll

            Filesize

            30KB

            MD5

            8993c0784111fc7cd6a90a82303e5f44

            SHA1

            8d1ff2fed98ebc608604c555ceb46ca628afb285

            SHA256

            3d0ba88267018f592141ea86592757cf1ecaac1a3a18f99203e0fc5c5eacbd62

            SHA512

            124d16d848dc8ea0a93b292b10ce1fbad23b56b13771d904cf14c19d54478614d214441b05f6cd9e1999b8310fdd26d1c6ecae784be00aecee7e80c96ba4ac88

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fr.dll

            Filesize

            30KB

            MD5

            a640aa4ff33662e06a474765df0b2a8d

            SHA1

            c6265225532e389e48c6057bd717b69de2125b61

            SHA256

            078b1943bf7f7955b90abc40f691b27e04376f8c43dd3abc4791614286cd4f23

            SHA512

            59791eef021f94efd9c18737d6c46fbc45add582eec92d5b997cfd66993abc7da872720a037766c3c70862f0654ccf30d122d4a5a6b305151bf8bf1c053a466d

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ga.dll

            Filesize

            29KB

            MD5

            5bcc643a969559317d09a9c87f53d04e

            SHA1

            3602d51cde97de16d8c018225a39d505c803e0fc

            SHA256

            b48f57e90ea9db6d6a296c01e87f8db71e47ab05ab6c2a664cfa9f52cf1d2c18

            SHA512

            4c65772f77e61e64d572df5b1f62733aceb02a5c967c296b303ff17c5d49831e5b7fc3d662724ae3ae1e88cd0fdcb704e838af5d4ae20f2d82b9577f57159159

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_gd.dll

            Filesize

            30KB

            MD5

            aea23f526ef0c5bb3d2f8fdf192a49ea

            SHA1

            4d7695e33ed43c3efb95f304e29675ea885b2939

            SHA256

            3cfe866c151a7e8a208af725c0c6f2a47fc3ada35f9ad3509b16b8d5229318b9

            SHA512

            412e4742ebd46ce38010b4f6a46d8d524025f929ab4658040e271d768e79115d90903403b2f1e51ab910bbdf9677b49439eb3c8afc5959477af198efb0c7c3c9

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_gl.dll

            Filesize

            29KB

            MD5

            295cd30c00f43d9131621baf4859578f

            SHA1

            cab79a6263b7b0a799461f3e6df41f815029cded

            SHA256

            b851c5a60cb6d1e8dd9aa161106cba99ccea047d0b39d007beaa7b9ef4a83397

            SHA512

            5f5c1e62e6c0e11a63fad68928765e3f504f33cdbb1d9a05cd53cbc3ed145bf3528960a10e3d57e8c83b07c030c72257f403b9a57d12975d3ef8bc255418ad6c

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_gu.dll

            Filesize

            28KB

            MD5

            c43c1ab37cd93e54068443bc330fb3d2

            SHA1

            ab51a2cbc51b3c17cf184c6d99ac480c02eb63af

            SHA256

            0c26a367355e766402c31fbab102dd1c35300d4a1301417c75be5fc4b3d54680

            SHA512

            ff0193189fb846eb3c4188bb599dad8e6f415ec9612da567d95c9c513defb148b6013208371798d174569b46f443a744e4e8b83aaf139d68c31f7de0f94e63f9

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_hi.dll

            Filesize

            29KB

            MD5

            a5544f517f7c1bfd1ec6a2e355d5a84c

            SHA1

            34a2a4a576300ad55b6757171bcba0fab005daa5

            SHA256

            8274c64bb778b55d912929625cd849adfe733b2dd674d94895d53af8dfaabeca

            SHA512

            9069bcfb736e13499250844dddef40e2cf64937e33ee1f81fc4968f024f7d7b89c6a778866bf1bff98d770686569e4752a473c0adfad4d4099cceda84da3cac3

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_hr.dll

            Filesize

            29KB

            MD5

            c09876a180731c172fa2532f8be90a3d

            SHA1

            4359c7840ddb23142a40aff85129b9920360e954

            SHA256

            50fd548ea12e2b72fc563bc082b870a89a523e8b3a4a0e9b65fe673384da2b58

            SHA512

            91cee1b10fc12a01a2a285e67dba583d6f1bee0716cc89103fee0c7d0f52fadc0f9ac5b13e833834e7279963726950d3897847e7acac61857257fc031692033e

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_hu.dll

            Filesize

            29KB

            MD5

            ee19156c12d2d7cce9b12e515f9ac6c5

            SHA1

            19ad46e40b3c1cb6195231bfcf45bb68ee1b43bf

            SHA256

            c290883b4b99758792284755efa52c12eb09039f0f8027d8ba3b1d4bb2f3846f

            SHA512

            631364472a450519ad8959971d6c319610570ca37b4486ea12d6af5b46aaecbf336aadddd1f3fefba841534ff82adf905b1e1a008638ed784bf08870a3b86ee1

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_id.dll

            Filesize

            28KB

            MD5

            eacd4638369bf96ccc7c23af37e15b5d

            SHA1

            15c4878b78c06095981abcc589c4a6f265ef96a3

            SHA256

            a53c0fd74995090dbf48bbba4a00560e3cc344ce8120b8b2bfa1f9b953b536ef

            SHA512

            19cc8d25bd8fd84481f77d301f79636208df5807647ddc6cb6beff3882d94672db49daa4ddfff0c334b584742f9d2fea3af73977032d7dfccd0cfd1314af4ae6

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_is.dll

            Filesize

            28KB

            MD5

            19d44de8f930e07f41f9343478ed5c1d

            SHA1

            83ee0c5a86997dd491bd8312d221dde2b2e7d44a

            SHA256

            69d3a21b7723e4df8b7b97e39493081e41231e2d3a3f5a4de462db41339987ec

            SHA512

            4edb82aedfeca743a03815a889eca766fec8083afd0defa098593297a52edaf1780dbd5ad1d3325c614d815d34d8c57ec2283a0db215f94f42819f1890089c4a

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_it.dll

            Filesize

            30KB

            MD5

            26cbb965c6976f59ac385ef9408bf81a

            SHA1

            16bb0530338e600fdfd13a7b03523a715e633bcb

            SHA256

            bed996b25f77c7d4328d96147ed388f1b457abfc0510eb8956be4339d103821a

            SHA512

            1efb1bdf0276de17f8516cde4d435e0be8fd066f52fb5d4c9e2fe2e17a135296ab6b34f523284941beae438e97d7e65de26f0541b7c437bceff229b60da4bb0d

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_iw.dll

            Filesize

            25KB

            MD5

            98f79d77ab05304bba8d60e50914418f

            SHA1

            957590adc0f8a7274e765e2a804c1de7c76e3040

            SHA256

            3764941b873ed59d5bc1097f6b9382ba59c06d443a96ff71ba6b693f161da522

            SHA512

            9ca6af5c14193dce7b50251f1b9205870435e60b5495ab1a9f0d42ca14b98b78fef51bf3cd4165394ca5ba28d0e98bea7642ec67039c0f146383136145c7de59

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ja.dll

            Filesize

            24KB

            MD5

            b89ba9ecc6d4c77abff61b1c75fff16c

            SHA1

            f381408f26be2c77c7b59681ad6280a701ccb472

            SHA256

            bbd2c970f747a6ee8e4735939225f607ae630ddc6e2e39954e0300ca9a7a88b2

            SHA512

            53a3db82f4cf5a300a5eab7692f4084451b987ad72ae24d9118d80f18692ac3604981c0e871c7a7625c5153803aea0e093d91822d33af0c10a07bcb6e766a5b6

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ka.dll

            Filesize

            29KB

            MD5

            d464fd223ba898e6fef4e485a3118394

            SHA1

            59c78983ce859485fea5458ba4e7803c38012b9d

            SHA256

            066c5c4b4c87ffd201d0dbfc43cb7566cfb03a6ed2fbf8698220fb919637294d

            SHA512

            6ac1d5fc59e6b7a10532902b059ac25a2bf58b0a63ab586e89b293e2de732c1d5d580c75ff28e4a2660a6ee3f0389f49e388567bcc07dd6e1cfd5d019db3ea52

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_kk.dll

            Filesize

            28KB

            MD5

            1b1202fc3e46d7b46ce3cb46cdc5ab21

            SHA1

            e76d1065035d86eef011feb3cad3ac38eecd0b7d

            SHA256

            b660a0e1d5161765881e0a7fd9d714abce341403b21f63667ffdedf7d5a254d0

            SHA512

            7f11d5d6995f27bb4f8705ac7310273f070a71adc73cdb70d74766c89437b3e7a10453fc55588ac223fe3b449564758a49380168d779fdb6a4fac3b5cde767ea

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_km.dll

            Filesize

            27KB

            MD5

            126036b98853a9d31937f874484dcb83

            SHA1

            27ffb8f3f6e966c3b79824357e79eac4ec8ce0a7

            SHA256

            90908e9108adcb0b4df84e4fbd9724e5e7a2d2eb54720fe49f37bdce977be635

            SHA512

            b384657e0ca90270b96cb724aa55c52f5c8b569fdb1a7ee7085c18d6822c39fc81a490128bd42d0aec1c0ddac1853e30718710968f5921a5331211bd33e89316

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_kn.dll

            Filesize

            29KB

            MD5

            e20f7a758cc9bab3d458d89d828521cc

            SHA1

            cae0a6d29e5b3f0aed0db2d66fe19d5463c09cfb

            SHA256

            92858a377f1ddc353b51bb44ec04f571ff2b4913d3c8104aa01359b72f91f2eb

            SHA512

            8bf9b8c6765820db6dd95303cb996b97649796e14e67b465fded3c24ef180891d58f9fdcb06243ef1d4c5cdd4148f58f64d74d2ceb2cb214051718d33efc9707

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ko.dll

            Filesize

            23KB

            MD5

            f7dbd944a9126dbe568faf2489ecf053

            SHA1

            16ad534b4fa48d95224c74b8ca4d3d4533c76425

            SHA256

            b1dd9c0fdd11a5f83ed5b7d1fbcd417bfaa94e42035647ca45f20e332b531703

            SHA512

            0b6843fd208ea9448179e63b485c01b5ff824d555cad57cdb6575234bf43d6cf253e9494fa74150b9fa9ace9d1d1ce749e1a77c7b342c10498dd7bd3953d9a27

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_kok.dll

            Filesize

            28KB

            MD5

            c1557eba649fc78356ed198d6754416d

            SHA1

            1ab42e71a88b127c40f8dd6d1b0660f271442a11

            SHA256

            8c5a7b3e9f5a3a64214ca8e9d43ea152f69fc2633f47c0783b90385e00551ef9

            SHA512

            e2f92c8c6ea823e1d716732b4bb5295d34da02d270079f645d9290261728bcf822b7f845f4a37dc2ef844580d6a3650a53c3e80be875eac5dffef651e8607993

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_lb.dll

            Filesize

            30KB

            MD5

            b61c9c9ea8340b6b3a873162a2710cfe

            SHA1

            5017b90dbd61add602681b76542b0bd3974639af

            SHA256

            f3eb2d26173d9ea8e26e234c3c5f91f9eb145fdf8b2b3e5011e0f33394fd8737

            SHA512

            0d32f6a880509472a51ceaa9539e3169505bc6b508664d28c9dfdd1a3a72abec665574dfb89e385c18522166221f1d73741fe62e4ea0860bc132e198614cccf2

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_lo.dll

            Filesize

            27KB

            MD5

            6e6f49c35d2b74090529fc1d8d12eb2e

            SHA1

            5a0fc9397872d7d26803276292962cdb0a5e4739

            SHA256

            6a25fc0ab6e2c73eb938b8e0f38578b9a02feb3a0634a16ac41ebc2a9642d260

            SHA512

            d3838a88908b2ab9bf6018dfa4c6f784371774cc0bcc82e180761673a9e527e126fee17a150a51c6d0a1159575e2060c12f85ae751e7a95f0285e816799540bd

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_lt.dll

            Filesize

            28KB

            MD5

            071ee832762aab532c59b858c7d3a46a

            SHA1

            0a976bd2c76d8db1f831a8912184d43e02ecf293

            SHA256

            a47e46963fbc7020dfc9dd08eb5d7d8c4c2a9f0b0a8f51f1256453058a6a19f2

            SHA512

            50ec7ff32da6f0d022ce067bcc160ccec00c4676ca56b789bc6ba1efc7f34ad485297f4cca6f6ed40be1c59018a7287c7fb490e6adcdd74f3f72b4526332a522

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_lv.dll

            Filesize

            29KB

            MD5

            bf10592aafe1b8446c005ee9e5c305a8

            SHA1

            19b81a238e07c958f1757488440e42ba99b59b53

            SHA256

            5cb166b350b425009080d39efa3b6ff5c0bf78f4276cc1ffce3043d4ef1a687f

            SHA512

            b69d55757047170a7583f3f0525307e09e670adfe05906d30bf208dd78b70b3e18a19adf59aeccc861857c2e37cb08412e4729d597ffb45960d285e12357b4ff

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_mi.dll

            Filesize

            28KB

            MD5

            d8b6019ab0fa35c6e64b08f1453204be

            SHA1

            aea69732af642a0d13bc8feda2b25751196cc1c2

            SHA256

            0672e8b5be2da1042bf6c85611a0a89012496fbcf7d06a7f446b30997cd20eb2

            SHA512

            878dd4db34b1f501c37eacedac8eb0c87143189f7357fbd5bd97faac01ba98cebab56e2e3934af012de37d0f32fb91578b16504b12e34b5f448605a82cb8f054

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_mk.dll

            Filesize

            29KB

            MD5

            f05d3aa1b51abeab311516368dddd8bc

            SHA1

            75ca6ae175a3ccc9f00d82afb4c6b673f396c6ac

            SHA256

            7aa26839a50ebc3ccb20ab5aebab432b695f0024d52529ef262f5eb8ef96d17d

            SHA512

            4ff88ba89823ad0c0ca2782c87bbdbc7fe738a161d5d4f674d7b9c97d491eb5aefc0430f34d3dfa7c2737f3484040894d81ac38135fc4ad3bc6cc0eb24e479f7

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ml.dll

            Filesize

            31KB

            MD5

            dc1bb5db270c494456f49913e26f94b7

            SHA1

            73dd3db577b7bd6bdaf047cd2012c75cc2213bd2

            SHA256

            155abac08c35cb330d20aef6375dbe18421c042a2533da0c63535ec59009cadf

            SHA512

            2cff374df4f8f41961c6e26ce369fc07ad8881c2edbe85173b6982d393402e32a79c73b8c17cc786d27a1f0ee79475e4ef9b3238f8770a099bdb9c422caa1287

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_mr.dll

            Filesize

            28KB

            MD5

            f94262bdadb5903e2e93a6cb6218fbe6

            SHA1

            c066be7fb4a1459cb62288e4799e268fcdb13ab8

            SHA256

            9e000d271d96f02bd0baecae07ef5b9a7f5f17d33733e2c9bb50f13e4c6e84b1

            SHA512

            11543d93e28e5616dd3aadd5e9b20b22b9160fb4117a0cc57971e5e46b52150c600bde161560410322b1db1c8a26e0c61cf9fdc761ca461a22f0c4eac16340b6

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ms.dll

            Filesize

            28KB

            MD5

            47d8bedb506470955c8a1b973e34793b

            SHA1

            d322b0d0d0663bfb9fdd42d3955dede092a0c8ef

            SHA256

            d79365e02f80694a9a2d76becc6a203a758b4006fbb521453f943ace16d24c8c

            SHA512

            6b268a0c8c6b2e0f26657040799c8c1ec523882e4dfff3f8d1e2bdbbe47b800e390de0a6bbac7d6253ab84c60c4103b4687b3fbe84d6e289f25c19639d25bef8

          • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_mt.dll

            Filesize

            29KB

            MD5

            11cfc0a8eeff082d17979d3968d5d110

            SHA1

            c963251af2d22fe7000d1eebe76ea44fb7da6496

            SHA256

            ce19cc60aceaecb34cf496857dd3698a2a5dfe88cb67bd4b7fd0a7ecc51c2ea8

            SHA512

            97c09f6a02e4469ee0a609d9d67e20111e2abf9c8672d0fcf8275d66d20fc92e61d8dcb88b3cc9a32d46391253ffff6157c5a7cff7fc9248af55ab3d3217a2ce

          • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

            Filesize

            16KB

            MD5

            2bda135a2d03cb1dceef4fd105bed99d

            SHA1

            13a6975afb646d091603f15d3b9f9b9f97b20c4a

            SHA256

            134bd8f0dee7197ac97741cf5a8fa03f68b9e9e5ca8ef9c9cd40e9ef472cba8b

            SHA512

            4b4c0a6c3744a6e8b9c07aeaff6d8c8d80066aa885ede94f3362a4d36c60235cbcd095a8fa5b9f1aa3732349825fcfdd6e85be678a333a4ec1385164a975fde6

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

            Filesize

            280B

            MD5

            844fa11c4cfa1f4568ddff373e28dfe7

            SHA1

            71e2897af107f230116a5153829dc43114658cd6

            SHA256

            feb5c2610d67e3f1c1d57596a2656ce3ae3fa33cffd3169fabd27049b3edb2b8

            SHA512

            436ccc316315e989922852f3a241d0d341a89752f70e061995966ed64f15a38565bfc2705a5db1338e6cb0694c4badbf685c21601db45dd235ac1b8fb08bd546

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

            Filesize

            8KB

            MD5

            cf89d16bb9107c631daabf0c0ee58efb

            SHA1

            3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

            SHA256

            d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

            SHA512

            8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

            Filesize

            264KB

            MD5

            d0d388f3865d0523e451d6ba0be34cc4

            SHA1

            8571c6a52aacc2747c048e3419e5657b74612995

            SHA256

            902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

            SHA512

            376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

            Filesize

            8KB

            MD5

            41876349cb12d6db992f1309f22df3f0

            SHA1

            5cf26b3420fc0302cd0a71e8d029739b8765be27

            SHA256

            e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

            SHA512

            e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

            Filesize

            2KB

            MD5

            fd05292edfbb15cf8024234d75cd70ae

            SHA1

            9cc4676b1b29d618d1f60454558b9bf243a8194e

            SHA256

            36567bfb1433f1b37c7a53483a7a33558b558c986ccdd6e8acb4462812f656db

            SHA512

            580176e3b68d622ca711a8823aad8a987bf2069ae91742e9bcbb486a6df2d7900c8232700cb7f420072d2a7e58bba67366aeec9233dec84394bf831af827ecc7

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT

            Filesize

            16B

            MD5

            46295cac801e5d4857d09837238a6394

            SHA1

            44e0fa1b517dbf802b18faf0785eeea6ac51594b

            SHA256

            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

            SHA512

            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

            Filesize

            9KB

            MD5

            3d20584f7f6c8eac79e17cca4207fb79

            SHA1

            3c16dcc27ae52431c8cdd92fbaab0341524d3092

            SHA256

            0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

            SHA512

            315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

            Filesize

            2B

            MD5

            d751713988987e9331980363e24189ce

            SHA1

            97d170e1550eee4afc0af065b78cda302a97674c

            SHA256

            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

            SHA512

            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

            Filesize

            18KB

            MD5

            7edd2b2dca43592f66ca0f1edd021a6a

            SHA1

            225f803b4c2f0634441362d751ad493fe5f5cce4

            SHA256

            b74bccb48f4dd9d1c6e981b0458f053db95fc15e11833c00cd28187e1d4c23ae

            SHA512

            ac0da168a7b0b4cdc3481aa0233313b59b11cc798021d2d3a73a7996b5be51a1c164c5797df680cf8c271f5134affd02a823b96720b62347c9b0b59da9d0298c

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

            Filesize

            37KB

            MD5

            1a661adf68e9b405377c30835ea50310

            SHA1

            f71b6747a165d0b1a6be0fc98ea71e2904816df0

            SHA256

            a1f1e3af06c4c1628c47e3ed5dc8f1b4a9dec1f01aa459f490a21f0a24cb8c9b

            SHA512

            3241e4a4c0f3f25c428fed4f1c0aa4f7eb63f5f3c1f23730834020f85ab2ea4e54949ec096c16b028aa703a52b4bbcbf22199d66e3a6bf59fe7f6a957732e0ce

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b736f4a4-f6cc-4dce-9180-2382405792c3\index

            Filesize

            24B

            MD5

            54cb446f628b2ea4a5bce5769910512e

            SHA1

            c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

            SHA256

            fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

            SHA512

            8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b736f4a4-f6cc-4dce-9180-2382405792c3\index-dir\the-real-index

            Filesize

            72B

            MD5

            05eb62043a0e8872a58de96410f4c0be

            SHA1

            0733e498b9c6a9aae3fad847ef76142406cdc8b2

            SHA256

            08f334a369933e338998bceba0b656a90595dcd3e125dd59d114261bbe96b44d

            SHA512

            c9d67ff3aad36a8b7f609602b12cc3dd7dd9f8fd45770298f87f0acf98657a9721cb59b03821647fd82bca85e97d1de77229388998e3c705d3348663acd78e57

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b736f4a4-f6cc-4dce-9180-2382405792c3\index-dir\the-real-index~RFe59bdd8.TMP

            Filesize

            48B

            MD5

            d24daf2cbee978b6a0d3be4587e78c7a

            SHA1

            4f96ff77db8cba13afa4da037fbcacffd012e748

            SHA256

            b10ac1387a72db8fd25b9592202b1bd9f81a729daad1cd7c5e552f92d30311cb

            SHA512

            f31d0be98d771473550759f9b6277b406c14748e6e258c82b6a67f740ef304e8ad9e108f290b77704fd3a733c9cb4307edda2b327b1bd6ec11e62c26c4b930ba

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e697827f-d687-49f9-9b6f-2873a9e9ec01\index-dir\the-real-index

            Filesize

            2KB

            MD5

            facad29d25739efb0dd73c04ae31c8b6

            SHA1

            d2b44f0fb95870d57447f2cfd25aaaa93c5ac083

            SHA256

            1511de493978472ef65dda25ab96bb39bcb4c41cb5213dc612faf561e77e2731

            SHA512

            fb0b600cf9ca71eb63bcc3e0c255c7625e45f2afbbfbc4544112616d5b38d0785665280dcf433621a57164a7ab9862250d8ebb1336efccecb5b0c704e091ccd7

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e697827f-d687-49f9-9b6f-2873a9e9ec01\index-dir\the-real-index~RFe59d7a9.TMP

            Filesize

            48B

            MD5

            29748d77e6553d735693d55a400299bc

            SHA1

            c3a49d6187a9dd75b5c3a57e563ea85077b81d34

            SHA256

            074d4ce297de739201df13f8e84c3333b17f5b22711344ef455573a21e85e322

            SHA512

            0c16bab719d596baff77d98e31d5e99c71d3f05543f09b08cea220d0ea75cb1c7d815ea49b6745719897642fbdd60c69b8b8fb8f5f6a0061c0aba31afd19d8d0

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

            Filesize

            253B

            MD5

            f7cb32a7c17fe33c6296475f65c14081

            SHA1

            c4352148810fbf94114df9b1287cbfbc6ebb431f

            SHA256

            dc1ff5829e4f7a48c0fc8f2b32e7e3be411a1423088d3c2f73f77d2468b2dc69

            SHA512

            fbab5e4abfad629881bc234a39831b12c7356e59aa196f524afaeb45477e714ac043c0d0f737d6c9193b2a2b929220abeec461e6a47b3bb4fdf0cbe0e44ef921

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

            Filesize

            182B

            MD5

            cce4e9b2141c9367b3e0bc520b219a9f

            SHA1

            b942fda586329493f88e156545e5dfc0872e2351

            SHA256

            678f0ab63070749eb60e6087562d7cf3fac0923cfdea9a134b1f3d5f1c590092

            SHA512

            dc564843fa2932b218d628f7f63a7b8323f8d902b7b53ffa0eb61a94a7ea1e7878e2203d103eff5e3daeef954273de168e37d91e46c7b5221caa31ae2b4c620e

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

            Filesize

            257B

            MD5

            7b7ce0b2c0e39bcba44355cc7399031e

            SHA1

            44f76134e6410851b581474a5c5b08cc052bab26

            SHA256

            8cf2ce383fe973cdb27295dc2e9dda08b071d477953e10babebd630af4128085

            SHA512

            b279366818dd1d0bf9da35b571eefa2ba55e6d9dbe98e017354cc635050c81666e17431c39ae4d9619f535019ee2a3e03fd8d8ec66449a5e47f8019732cd7ddf

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe596d95.TMP

            Filesize

            119B

            MD5

            8b1da12c278c2cb85891dfc5350fc34e

            SHA1

            51e69367b4e510348a273c8d2b1725cd156151d1

            SHA256

            de02a9e0a6a4953460396904399dd9494bbf2d89c9a0cfdfe9caef4873eb7361

            SHA512

            d1a388bc6ff3be67454c2a739a937f0bd88654994014111b7a14edcf4699ddaacc96965ce860f0f03bad72d40c48f9ceb35bcf05f7098b28006f69959cba3303

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

            Filesize

            41B

            MD5

            5af87dfd673ba2115e2fcf5cfdb727ab

            SHA1

            d5b5bbf396dc291274584ef71f444f420b6056f1

            SHA256

            f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

            SHA512

            de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

            Filesize

            72B

            MD5

            994b4dd6becc8021deab964daeab7567

            SHA1

            dd0f1f8adebb234af58daff84fee8676a851da48

            SHA256

            6a661ea18f9656c7d0b661651af0db99d275092e0509ca465278bd6acbe51599

            SHA512

            e302a5510c293cdc1a8b438103073545e6ab692295c2d7f9f27c0552654c6c55f43b184e8b197741bfce0893334fd8a0f5b2fd21e5c518412bef9ef7d734f975

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59bb96.TMP

            Filesize

            48B

            MD5

            c65c3240093a3dc0f82b955a4bea8faa

            SHA1

            11b05e7dcc8bb0f542d0c2e1bc499f8e40644b6c

            SHA256

            8ea1942351ce2f8dc08b1569a30f2ce83365d62a8a8c6ec796bd231fbdb10a81

            SHA512

            e822bdb4d3739a041e18041d2c1766c6142344b40b7f15aed1fb0282b70aef232b41038f5daf0495d5ca3444275338d2a9623989468a336c6f7526bc1904429a

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

            Filesize

            1KB

            MD5

            a98d76efa7022f79cae18f3fcc55340a

            SHA1

            f71fa78a4e0a4d8183906b9d66df68d50309fc66

            SHA256

            5fb2ecd1129df375aab5a930bba5d2c0374e48645817c4e35238110e0d6b15ea

            SHA512

            6207c3cc9b87a0f08a4daa03df5b965c7dd516f86939c0a36f8721945efeed90f19ac4005b56b98aba9e65ee3e18c96ff1ce792aa7541f9ed7c7d1463f1278c9

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

            Filesize

            8KB

            MD5

            0962291d6d367570bee5454721c17e11

            SHA1

            59d10a893ef321a706a9255176761366115bedcb

            SHA256

            ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

            SHA512

            f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

            Filesize

            27KB

            MD5

            2cc8c0b6067817294b30a847e66cecc4

            SHA1

            3740ec36f5c0d383faf15c4989e60014a83a28ef

            SHA256

            6ebc56435717d71f8766dd28288831dd1f7d3f0fb7e57073f22bc27334f7e1fc

            SHA512

            a7dc92fbbd34746bd8c6883cd80da8aab2555732820e3cd3435653b0e6ddc6c81601ed025fd22097283b92f5b8e325cda9432911b01a05589074476afaaa7f5b

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

            Filesize

            5KB

            MD5

            713f4fedb555c4088d933f31d6425967

            SHA1

            970386ea8608678e82a18cc029a519dfffbb1aa5

            SHA256

            bd395a399a4c1e813c675f17eac7b3bd78a6a0cf3b6bf8f4455b8344d24f11b4

            SHA512

            dcd2cd70809187b233ed9f0413a11324a2d20b4c0da65a3f07ed4c840439b7ba3dd1fcc7a16d282795057e14bed6fb4240ccd4eff205439818edd42284f56043

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

            Filesize

            7KB

            MD5

            1748aacc37dd7560c83b03cd55d67989

            SHA1

            a64494dedab5e9d7bd2106e1c84d7ed622d55f8b

            SHA256

            250117b123684edc7478d4495e99d660bbcc8e7f5a9c97c83ba392cdef166d3c

            SHA512

            c4580bdd3742438b82b30af7ca39253b73a44fb83f12e52a9409898d7d6962c95e68821b812159fe17810b9e541be529f099d60826a2a15b1eafce487215e756

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

            Filesize

            7KB

            MD5

            f10a38c2154c655ff96d5c3baa8d0b6e

            SHA1

            ea37510ad4de13a134b245f37b4190c0e3a02cfd

            SHA256

            9b95b0634e7cdb4982db46982f856ba07c78b29e467f54d36e1eacd47513aa57

            SHA512

            3a66a3b70a823c1056c178f21e6894cddcd491565dc4cd0a2f27fa270d0e287f6e973fa06f4c843c77031a616c3c5c382446e8063335ba1bd7082e3d7c7efb9e

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

            Filesize

            5KB

            MD5

            9de46c334178475092c41f68c8f42c52

            SHA1

            c8c231ccbd75eb4662ac85b820eeab2d270c0901

            SHA256

            e374abb4476272d0984c91c50ab032817fc85e12228d73a8c3ff1b5f2c387ba1

            SHA512

            9ac92561b873106700d2b17bf785ef42e7f66eac0725f611f1e48bb66bcba94e0f9f7b8552a9ddef7916687f73ddad41b5a683c600147075dd50460498a96402

          • C:\Users\Admin\AppData\Local\Temp\901c276f-5e85-4acf-8167-b48b48daa9ef.tmp

            Filesize

            10KB

            MD5

            78e47dda17341bed7be45dccfd89ac87

            SHA1

            1afde30e46997452d11e4a2adbbf35cce7a1404f

            SHA256

            67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

            SHA512

            9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

          • C:\Users\Admin\AppData\Local\Temp\d0a0ebab-d2cd-4391-82c8-03a6733cb481.tmp

            Filesize

            1B

            MD5

            5058f1af8388633f609cadb75a75dc9d

            SHA1

            3a52ce780950d4d969792a2559cd519d7ee8c727

            SHA256

            cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

            SHA512

            0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

          • C:\Users\Admin\AppData\Local\Temp\ddf8ee8d-1534-4683-a0b3-bd32fae709c0.tmp

            Filesize

            132KB

            MD5

            da75bb05d10acc967eecaac040d3d733

            SHA1

            95c08e067df713af8992db113f7e9aec84f17181

            SHA256

            33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

            SHA512

            56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

          • C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

            Filesize

            280B

            MD5

            d00c2bf4c7f0e8633f6990caba5d9170

            SHA1

            16611fd692edd93c75b8c1ad374596f2dcc4d3dc

            SHA256

            624023d4d93a969ef0ca70593fee2e000b128db696e070a10daf4524c045eb1c

            SHA512

            7151d8bc01770f125be98e676dad75ba0de31126775e1f1923df193637ffcf6ae9a9e91ed91e191db8dc93a7bffdffaf7b5d4d9125af82e3e3bfbfd2b5b81234

          • memory/1256-285-0x00000000008C0000-0x00000000008F5000-memory.dmp

            Filesize

            212KB

          • memory/1256-201-0x0000000074880000-0x0000000074AA5000-memory.dmp

            Filesize

            2.1MB

          • memory/1256-193-0x0000000074880000-0x0000000074AA5000-memory.dmp

            Filesize

            2.1MB

          • memory/1256-192-0x00000000008C0000-0x00000000008F5000-memory.dmp

            Filesize

            212KB