Overview

overview

9

Static

static

9

tox tweaki...or.exe

windows10-ltsc 2021-x64

1

tox tweaki...or.exe

windows10-ltsc 2021-x64

1

tox tweaki...CK.exe

windows10-ltsc 2021-x64

9

tox tweaki...ew.exe

windows10-ltsc 2021-x64

6

tox tweaki...up.exe

windows10-ltsc 2021-x64

1

tox tweaki...8.appx

windows10-ltsc 2021-x64

1

Microsoft.UI.Xaml.dll

windows10-ltsc 2021-x64

1

Microsoft.UI.Xaml.dll

windows10-ltsc 2021-x64

1

tox tweaki...up.exe

windows10-ltsc 2021-x64

8

tox tweaki...LG.exe

windows10-ltsc 2021-x64

1

tox tweaki...el.exe

windows10-ltsc 2021-x64

1

tox tweaki...un.exe

windows10-ltsc 2021-x64

3

Export.bat

windows10-ltsc 2021-x64

1

Import.bat

windows10-ltsc 2021-x64

1

SCEWIN_64.exe

windows10-ltsc 2021-x64

1

amifldrv64.sys

windows10-ltsc 2021-x64

1

amigendrv64.sys

windows10-ltsc 2021-x64

1

tox tweaki...64.exe

windows10-ltsc 2021-x64

1

tox tweaki...CL.exe

windows10-ltsc 2021-x64

1

tox tweaki...64.exe

windows10-ltsc 2021-x64

7

tox tweaki...64.sys

windows10-ltsc 2021-x64

1

tox tweaki...64.sys

windows10-ltsc 2021-x64

1

tox tweaki...vc.exe

windows10-ltsc 2021-x64

1

CRU/CRU.exe

windows10-ltsc 2021-x64

3

CRU/reset-all.exe

windows10-ltsc 2021-x64

3

CRU/restart.exe

windows10-ltsc 2021-x64

5

CRU/restart64.exe

windows10-ltsc 2021-x64

5

tox tweaki...on.exe

windows10-ltsc 2021-x64

1

Export.bat

windows10-ltsc 2021-x64

3

tox tweaki...ll.exe

windows10-ltsc 2021-x64

7

tox tweaki...xp.exe

windows10-ltsc 2021-x64

8

tox tweaki...tr.exe

windows10-ltsc 2021-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    08-11-2024 15:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tox tweaking/niggers/MicrosoftEdgeSetup.exe

  • Size

    1.6MB

  • MD5

    9008b1f2c99b79594ccba4afd923056a

  • SHA1

    4d88557702696906b44a37b289b4a5716e7c9fbe

  • SHA256

    7531341da720162541747b3142722f9c52d9d5fe57678d8aeefa62532014f672

  • SHA512

    ab9a48a6816c97d3e5988dacd8a2f270bd30b16cc558e0667c77a65121228bb3de90d03bf8cb48a92fe91c737876e260f2d782cb1aae18f1711e5f5679be9cb6

  • SSDEEP

    49152:jiEa3J/lPA552bT8TCKpxVt2sl0TD5yncADYOS0jZ2/vgm9d:jirIOoT9pnt9l45mcADRS0SRb

Score
8/10
adwarediscoveryevasionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 54 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Checks system information in the registry 2 TTPs 12 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 52 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 5 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=en&brand=M100"
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4260
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2632
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:416
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:3276
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:2260
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:1584
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDhFNDQyRDAtRjI5Ny00QkE4LUEwMzktMEY2M0Q3QzM2MjFFfSIgdXNlcmlkPSJ7M0Y5N0Y4Q0ItQkMyNS00QkYzLUE1MzUtODA4RURBNUJBNUMzfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezQ1RjFFQkM5LTcxQjgtNDIyRC1BNDRBLUVFQTREMjE2RjEwNn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDQuNDUyOSIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjEyNSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjE1IiBsYW5nPSJlbiIgYnJhbmQ9Ik0xMDAiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODQ0NTIyNjc3IiBpbnN0YWxsX3RpbWVfbXM9IjY3MiIvPjwvYXBwPjwvcmVxdWVzdD4
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:1476
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=en&brand=M100" /installsource taggedmi /sessionid "{48E442D0-F297-4BA8-A039-0F63D7C3621E}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2764
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:3628
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDhFNDQyRDAtRjI5Ny00QkE4LUEwMzktMEY2M0Q3QzM2MjFFfSIgdXNlcmlkPSJ7M0Y5N0Y4Q0ItQkMyNS00QkYzLUE1MzUtODA4RURBNUJBNUMzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NUNBNkRFMEYtMkEyMC00NTQ0LUJFNjktODZCRkM0NkVENDQ4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTYiIGluc3RhbGxkYXRldGltZT0iMTcyOTY5NjE1NiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzc0MTY4NzY5NTUxOTkxOCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxMTQzMjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4NTIzMzU0MjkiLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4012
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC04AE58-90F7-4F4A-A56B-FE7A14F256F1}\MicrosoftEdge_X64_130.0.2849.80.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC04AE58-90F7-4F4A-A56B-FE7A14F256F1}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC04AE58-90F7-4F4A-A56B-FE7A14F256F1}\EDGEMITMP_EC5E1.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC04AE58-90F7-4F4A-A56B-FE7A14F256F1}\EDGEMITMP_EC5E1.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC04AE58-90F7-4F4A-A56B-FE7A14F256F1}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Checks computer location settings
        • Executes dropped EXE
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:756
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC04AE58-90F7-4F4A-A56B-FE7A14F256F1}\EDGEMITMP_EC5E1.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC04AE58-90F7-4F4A-A56B-FE7A14F256F1}\EDGEMITMP_EC5E1.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC04AE58-90F7-4F4A-A56B-FE7A14F256F1}\EDGEMITMP_EC5E1.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff777e6d730,0x7ff777e6d73c,0x7ff777e6d748
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:2132
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC04AE58-90F7-4F4A-A56B-FE7A14F256F1}\EDGEMITMP_EC5E1.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC04AE58-90F7-4F4A-A56B-FE7A14F256F1}\EDGEMITMP_EC5E1.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1856
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC04AE58-90F7-4F4A-A56B-FE7A14F256F1}\EDGEMITMP_EC5E1.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC04AE58-90F7-4F4A-A56B-FE7A14F256F1}\EDGEMITMP_EC5E1.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC04AE58-90F7-4F4A-A56B-FE7A14F256F1}\EDGEMITMP_EC5E1.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x240,0x244,0x248,0x220,0x24c,0x7ff777e6d730,0x7ff777e6d73c,0x7ff777e6d748
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:1256
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3276
          • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff76ee7d730,0x7ff76ee7d73c,0x7ff76ee7d748
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:2260
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4388
          • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x240,0x244,0x248,0x128,0x24c,0x7ff76ee7d730,0x7ff76ee7d73c,0x7ff76ee7d748
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:4584
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1492
          • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff76ee7d730,0x7ff76ee7d73c,0x7ff76ee7d748
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:2088
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDhFNDQyRDAtRjI5Ny00QkE4LUEwMzktMEY2M0Q3QzM2MjFFfSIgdXNlcmlkPSJ7M0Y5N0Y4Q0ItQkMyNS00QkYzLUE1MzUtODA4RURBNUJBNUMzfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezIyNDBCNUZELTIxMzEtNDM2RS1CNzJBLUM1RTgxRkZGMzNGNH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDQuNDUyOSIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjEyNSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMwLjAuMjg0OS44MCIgbGFuZz0iZW4iIGJyYW5kPSJNMTAwIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDg1ODI3MjcxOCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4NTgyNzI3MTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzM2MjQxNzIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8yN2NiNzI5ZC1mZjk0LTRkMzQtYWFlNC0zMzg1ZmEwOWM0NGM_UDE9MTczMTY4MzU4MSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1BYjFlMFRIRzFqdkhma1NUaFkwWUVoa2ZpSUJQSGJnbkxEWTh5OVpYZ2NlJTJiUlhIekdhJTJiaXZVMjliM0ZYRndudEtCcWZBZGpmVkF5c0U3UnFLSVl6UkElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzUwNzY5MjAiIHRvdGFsPSIxNzUwNzY5MjAiIGRvd25sb2FkX3RpbWVfbXM9IjQxMTQwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTMzNjM5NzY4MCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzNDk5OTE1ODgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU5NjI5NjAyNzciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIyNTAiIGRvd25sb2FkX3RpbWVfbXM9IjQ3Nzk2IiBkb3dubG9hZGVkPSIxNzUwNzY5MjAiIHRvdGFsPSIxNzUwNzY5MjAiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjYxMjY2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:1768
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:1088
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-installer
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Checks system information in the registry
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1844
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x278,0x27c,0x280,0x274,0x288,0x7ffa355f4dc0,0x7ffa355f4dcc,0x7ffa355f4dd8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2092
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2060,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1772
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1972,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3732
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2560,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4956
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3448,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2176
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3464,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1716
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=4252,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:780
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=4316,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3628
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4620,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:2
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3924
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5440,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1700
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5640,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5184
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5176,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5596
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5976,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:6032
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5984,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:6040
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6392,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4880
      • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5736,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
        2⤵
        • Executes dropped EXE
        PID:5340
      • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5736,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5636
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6760,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:780
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6752,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5996
      • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable --force-configure-user-settings
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:5968
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff76ee7d730,0x7ff76ee7d73c,0x7ff76ee7d748
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:5124
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:5392
          • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff76ee7d730,0x7ff76ee7d73c,0x7ff76ee7d748
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:6092
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7096,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:8
        2⤵
        • Executes dropped EXE
        PID:5416
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6844,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
        2⤵
        • Executes dropped EXE
        PID:5344
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6784,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
        2⤵
        • Executes dropped EXE
        PID:3216
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7384,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:8
        2⤵
        • Executes dropped EXE
        PID:5908
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7200,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:8
        2⤵
        • Executes dropped EXE
        PID:4344
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7140,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:8
        2⤵
        • Executes dropped EXE
        PID:1700
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7488,i,6122275521130349709,8124643340806033484,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:8
        2⤵
        • Executes dropped EXE
        PID:5580
    • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2984

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Active Setup

    1
    T1547.014

    Browser Extensions

    1
    T1176

    Event Triggered Execution

    2
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Image File Execution Options Injection

    1
    T1546.012

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Active Setup

    1
    T1547.014

    Event Triggered Execution

    2
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Image File Execution Options Injection

    1
    T1546.012

    Defense Evasion

    Modify Registry

    4
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Browser Information Discovery

    1
    T1217

    Query Registry

    5
    T1012

    System Information Discovery

    5
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    System Network Configuration Discovery

    1
    T1016

    Internet Connection Discovery

    1
    T1016.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\b81fa3d8-047f-4009-b30d-a9b59a76167b.tmp
      Filesize

      344B

      MD5

      1b7cdddfb06152ae01f12d9f253237d6

      SHA1

      1ef358781a086a0727f4fa95cd53510eb328bc52

      SHA256

      fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e

      SHA512

      4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\EdgeUpdate.dat
      Filesize

      12KB

      MD5

      369bbc37cff290adb8963dc5e518b9b8

      SHA1

      de0ef569f7ef55032e4b18d3a03542cc2bbac191

      SHA256

      3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

      SHA512

      4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\MicrosoftEdgeComRegisterShellARM64.exe
      Filesize

      182KB

      MD5

      b69894fc1c3f26c77b1826ef8b5a9fc5

      SHA1

      cff7b4299253beda53fb015408dd840db59901a1

      SHA256

      b91bad4c618eb6049b19364f62827470095e30519d07f4e0f2ccc387ddd5f1bf

      SHA512

      8361e97d84082f8e888262d0657bac47c152bd72f972628f446f58cbeacf37c05f484dce3fb0d38c4f0da2a2dcbb0813639d201d127ec7f072b942d43b216755

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\MicrosoftEdgeUpdate.exe
      Filesize

      201KB

      MD5

      136e8226d68856da40a4f60e70581b72

      SHA1

      6c1a09e12e3e07740feef7b209f673b06542ab62

      SHA256

      b4b8a2f87ee9c5f731189fe9f622cb9cd18fa3d55b0e8e0ae3c3a44a0833709f

      SHA512

      9a0215830e3f3a97e8b2cdcf1b98053ce266f0c6cb537942aec1f40e22627b60cb5bb499faece768481c41f7d851fcd5e10baa9534df25c419664407c6e5a399

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
      Filesize

      215KB

      MD5

      205590d4fb4b1914d2853ab7a9839ccf

      SHA1

      d9bbf8941df5993f72ffcf46beefcfcd88694ebd

      SHA256

      5f82471d58b6e700248d9602ce4a0a5cda4d2e2863ef1eb9fee4effcc07f3767

      SHA512

      bce1447d5d3210c22d52dec3b846db091b65ed03fd9d7cd11c6c4dbd2aa5a943d881360bc033c29abd61011581ff9354b35cbe421719d92568ed99997bfbbae8

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\MicrosoftEdgeUpdateCore.exe
      Filesize

      261KB

      MD5

      b07ab49ee8453853021c7dac2b2131db

      SHA1

      e1d87d6a6e7503d0d2b288ea5f034fe2f346196a

      SHA256

      f8535d5d73ebebed15adc6ae2ced6bb4889aa23e6ffe55faeabd961bf77b05e4

      SHA512

      5eaae533fbe71430ae2a717f7668fd0a26ec37624e198a32f09bfdbee7e3b6e93d64e4fbb78cbdb05c4fe390a864490ea997d11849ecd371f5153bc8bfafccc3

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\NOTICE.TXT
      Filesize

      4KB

      MD5

      6dd5bf0743f2366a0bdd37e302783bcd

      SHA1

      e5ff6e044c40c02b1fc78304804fe1f993fed2e6

      SHA256

      91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

      SHA512

      f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdate.dll
      Filesize

      2.1MB

      MD5

      5d89123f9b96098d8fad74108bdd5f7e

      SHA1

      6309551b9656527563d2b2f3c335fd6805da0501

      SHA256

      03c3c918886e58f096aa8e919b1e9f8dcd5a9f2a4765971049bf8da305476f44

      SHA512

      9d8190e5374cd1b4adbbfb87c27fa40d4de529d7c0a20654e0ce189a4cb9a53d3708c4ce657a7a5469b015df7efbbff495fc844579d9cd363b329b7e007e85c8

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_af.dll
      Filesize

      29KB

      MD5

      4f860d5995ab77e6efa8f589a758c6d2

      SHA1

      07536839ccfd3c654ec5dc2161020f729973196d

      SHA256

      9841d787142dd54fea6b033bd897f05f3e617b48b051de0ee3cf5865b3393150

      SHA512

      0b9a661b76360f1fb2eb3ee25c6bf2cbab7ec74e2363e0af321dc4d0afb3cad301dddd16ea367d588451a40a2c2ed41f21d7afae48307e1e4a4ec5b24165b378

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_am.dll
      Filesize

      24KB

      MD5

      f624de37750fd191eb29d4de36818f8b

      SHA1

      b647dae9b9a3c673980afa651d73ce0a4985aae6

      SHA256

      e284453cd512e446fcbf9440013f8cb2348ffd6b1acec5366f2511cdf88b1794

      SHA512

      d1d65e29ed59e34d4ff66df11a2368f1a724730e32eb245022d4f3d1fadf16d445ba8532460afb0e6e91f8be60a7240d13577403193042d1e912a67e4bf23b1a

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_ar.dll
      Filesize

      26KB

      MD5

      5de3f4dabb5f033f24e29033142e7349

      SHA1

      5c446985de443501b545d75f6886a143c748b033

      SHA256

      2533d443b68c5288468b0b20cc3a70dc05f0498369d5321368a97dd5bf3268c8

      SHA512

      c96296e6f67edeff2be5dc03014a8eb65fc287fb899357d4608c36c07b4610827aa18cbec6ccd47b66230a12341af488aca8bd02632fa768f84ca7b1d9c9d065

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_as.dll
      Filesize

      29KB

      MD5

      1fb14c6c4fee7bfabe41badb7c5acff8

      SHA1

      953d94cd73951943db14c08cce37b2d3ac821b02

      SHA256

      cd32339fd7e4a5959e93eb5bfd6e009e4137e15c5e6c2e861d7891487216da49

      SHA512

      a93b081935fbe48fafa8071a9cd593ae7b19205c70eaf48c724397019a04161460c66d6d8c6ffd872f4d52a4a7aa25ba1cba04181b9ebaca04b76d111ea588d2

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_az.dll
      Filesize

      29KB

      MD5

      d3345579310f3bd080b406de47b2305f

      SHA1

      16aefb27ea6d81c684f041aa50ebb49fdd403d83

      SHA256

      b4ea3c63fa0104093a2b2034f950428e66d2cf3d55f0fc5bd688483392d60d69

      SHA512

      65e4aa8587bc579b5109d91e02745f6de96a23b6ac2962cdeb6d9d536b51abab12b2bbaeca72572c3ae1971dac5bd24430eb2ae5ccf44a7068427594e4afdd7a

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_bg.dll
      Filesize

      29KB

      MD5

      ecf3405e9e712d685ef1e8a5377296ea

      SHA1

      9872cdf450adf4257d77282a39b75822ce1c8375

      SHA256

      e400415638a7b7dcc28b14a257a28e93e423c396e89a02cba51623fdfbdc6b0b

      SHA512

      37e5f1b3bdd97a4370718dc2a46d78ab5b66865d3cdb66a20a7dc20a9d423ccde954c08f97e574fbab24e8dfa905351cbfb94bd3e6692a9b6526097ea3dc911d

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_bn-IN.dll
      Filesize

      29KB

      MD5

      051c429fa2beec9c2842c403a86c0e7b

      SHA1

      0a06a45200a1f5c81c48fbd2d03549fc9fac3a58

      SHA256

      1a8465922bbb05a97a24f6c2200fcc7afd8bd0ace245c2eda9d9d335d4fb9353

      SHA512

      bb59b41804328f27ba8861af32824266ca69ddcfdaaa11551b1edd4e129dbba630da8070abedb28e180045f8d0ddc1209cd901919f6b9aa421c457188af795c6

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_bn.dll
      Filesize

      29KB

      MD5

      82711e45d2b0764997abc1e0678a73bb

      SHA1

      47908e8885c86477a6f52eea5fddb005ec5b3fa3

      SHA256

      2bb7455999b8f53a2a0834588ca4da4703f4da362a127d01cc6bd60ca0303799

      SHA512

      4b517796edc954ab7f5a26a5d6605925dc7e84b611bcf59352b3b95f719cedc72c77a465fb1e7bc2d2f422d596c97968dac5b57292c82967d5cfaff980128fc2

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_bs.dll
      Filesize

      28KB

      MD5

      a0a1f791984f1de2f03a36171232d18d

      SHA1

      71f69d8fe47640ba9705725d7d627a05519c8016

      SHA256

      d2c7da8f4745b81874a9666c7d10a779a9956b4de0ebdaa1647bf78d4e17d85a

      SHA512

      a4267911846cd55eb91227b0117ccbfdf8ef6c4ed0b8935b08e5d41a91aeabd9259988c71da8606cfb2876c4d69df6ca5a246687440283f1625105624305eb33

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
      Filesize

      30KB

      MD5

      897712b508931dab76d39b209611740c

      SHA1

      9d80e07c2dc744e2efce3b67aa9876949fb9edfe

      SHA256

      ee64fdefdb3381ce61fc445190cc44b015e7b65a3a16d28f3477f68de6079f1b

      SHA512

      3329e37318dd9b11f282301e453af106168d3d10beff1ed62ffdcda60c6b4edb6b9c69ac6b9bb8abce3c9a9686a0152404524012dbff025e571de2cfcb3b5d56

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_ca.dll
      Filesize

      30KB

      MD5

      e90155442b28008992a7d899ca730222

      SHA1

      1d448e9709de0d301ded6d75caaeba4348a4793d

      SHA256

      6ae98b5e2eda22a0236434b7e952d732e3cd5d9cae2e51cd70222f1fd5278563

      SHA512

      a91d8357ca976db2eb5a081077304a50edc1b55b2775c00cfde05e03831f98bd04e43f0dba5b3efd5a6370afcb10b23bbf307412467502e9ef57e0beae636013

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_cs.dll
      Filesize

      28KB

      MD5

      1de961b662a374c3af918c18225f4364

      SHA1

      e8f1c438e57b322f43b4b851698bf38c129eb6ae

      SHA256

      bb1365c5770dacbb918af27b47b02f269504f4d2396cf3f82bf5ecb2551c5021

      SHA512

      c6bf62b684039f62744f1aab07f4751948e0c175f7fb7fe126f20903ce23fcdd2e284f1b794922621dae7eaa15c6dae0177ad102289a18f967721486f21073a1

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_cy.dll
      Filesize

      28KB

      MD5

      29f027d2d5fd486bdc20386ace925603

      SHA1

      66b8605f23871b4a8302bef0aaccb36ee1e72755

      SHA256

      03c8566f749e8fa349d97101849bc3b2cc0b7561b565a2b0928bf8fe901da813

      SHA512

      3348bdf10b2d964b34b791a774e28c97d3caf28d7f90e36b948cc2cb6c21e84cda933b7ddbd51c8fc604a450361cb834322c15ddbe0f4851154d05e5a2a2ea42

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_da.dll
      Filesize

      28KB

      MD5

      b0ae9aa0d5c17ee7abfc57d21cdcbae6

      SHA1

      01019eb6ba9c123be528136e12192b0bb33df407

      SHA256

      d10938919e3d28d71e8e3ba2d8e02e0f9dc2faf148cdedc21c166fd994c603e2

      SHA512

      4cba25c8159df865231b08fe650eedfb92d54c3037d28b2b9af010c8a59fa23669041a6c393622fe69b0194c2532f71f02b740f7e26e0bbf7ef34a421d6747b8

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_de.dll
      Filesize

      30KB

      MD5

      ad5b530eabff0540078c5d17f27b9610

      SHA1

      7e53dbbf64e70e561d37669e69f50eb0da8e37d1

      SHA256

      49f512316a51e51027b4e70de4ffe8c8ecb188e126439a90a5d12d52a0393966

      SHA512

      e1cc853d96589220676d39d91d4108633ce56304640f770e7d22b97a9b3be9452d5fb94e4e7fcd1400b62f0c398da8255c53a31853194a9e7b7784982b5ff40f

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_el.dll
      Filesize

      30KB

      MD5

      a7e64339a5314e3576c0d170171fa52a

      SHA1

      6c12aab6c97c30aff3245b78f7a3afeea604215e

      SHA256

      4e9ccecb8e4383395f2134347fbad00521345ec9c857d8fa102d5257c7bea9bf

      SHA512

      a4ca3fb60a7f4bda50847544dd1289d750f0d4b3565929290a8392b92822ef1856cec15a1f63f2c6fe1ef2e7cc0936a35bdb38ee5d904eb08cd32f05addc6ee4

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_en-GB.dll
      Filesize

      27KB

      MD5

      74d4cf3b8efb6cc3d0acc3eac38bd5b7

      SHA1

      9337803aadad9042c895b6f418b4c733b81221e0

      SHA256

      b83c8981d8835e4c78250bf265faa6d64693204b77764c8e349abc4365ae9871

      SHA512

      e6112ef60d56101aa16327042162d6ef43519bc56668ca8eaa7fd3e1aaadc75c7df75c1e41583a292ff1a9bdc7d9ad9f5c0d97fa84964532dca2d5f3df604c23

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_en.dll
      Filesize

      27KB

      MD5

      19dc1f6d1f309eb7abf1e0c8257f41f8

      SHA1

      e2d3e86fe22c6af6b8ee5b359315dfa6ac4d52ec

      SHA256

      046f6c532fcabd969c6e63bb7ee0d7a83d806fa659006508e1c3a9485190d6ef

      SHA512

      478d6a84452cfadc48547930e336ad459eec188dd3d9e4c778cded4ec3d34e00b2b8c0538366aa644ee67f878b29c5c73444c1406c66e8394761bb0979c6483c

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_es-419.dll
      Filesize

      29KB

      MD5

      8f7f515d78d2df371993fd70f863ab8d

      SHA1

      dfae1b47e80f91abf2d9c2aac009c0a1767bc59d

      SHA256

      ba57fbb9d3a32b84d6a76054b9ad180b6510e53206b9804bb9ea18ff73c2ae3e

      SHA512

      308a62af00a4410551eac967bb9f2cea7adf7c13b471dd28b276bda40b1e4c0b4ebb60aec29b6165069d40180bc45b4f5da5baddc374ce7bc5a5bb223afb4e96

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_es.dll
      Filesize

      29KB

      MD5

      6af05d448c842027f876e93f8ac58b65

      SHA1

      f34c988e3875a1d1b267b082476fcfb8d7505a73

      SHA256

      36876b14a214cf98dda5100a7e7134d7ebb78e895535d6bd7562099574607867

      SHA512

      412031db59de0367a102a026f73072244b33d726adc5bb9fd079db3dd37b5d6a24d7420a9811576d0a356933b5ba15cc9e2a92046d2d6e6d6fef37e9d840aec6

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_et.dll
      Filesize

      28KB

      MD5

      ae9bdf6416c3630c4b0b5b119308a135

      SHA1

      d7218c677b098d2a93cc91ead39c83d3a2c653b6

      SHA256

      62da90c9417a70632aa190fecc17c31ecf433c1f84f82b08d7d7290669cabf32

      SHA512

      4333ac6cd3737f25e6e1d429b195da781ced4340b89808cbd5d5d2aae2e79bcc700419d613123d632252e31ac44d95b7718f23da5b82ab5054407e80106a64a7

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_eu.dll
      Filesize

      28KB

      MD5

      fe73dbc305da6223d1e94e1cf548c000

      SHA1

      b16f2c40d68cd9718eaaa9b6db9c8e5c4b6acb9e

      SHA256

      1ef64088a613a4e10b4cf4206f95f5414ee27872798747234a6574b7e5c70a7d

      SHA512

      d9900720d89defffa52198dbe63515995095c94aa0cbbe4f32a1c09d26809cec480e92926d2240702604b8c13fcdc0032cc46910ade8e4c1d2fc9a4bd1b63858

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_fa.dll
      Filesize

      28KB

      MD5

      367ea715e942c81dd3cb734274969a0b

      SHA1

      f92f1ec2a5be9b775e67c4252a07c37ed0ca508b

      SHA256

      082da1c09782c026c9cd73456dc12539a226f0bf5d113e59bc93b29c1e98b37c

      SHA512

      c94e787ba3bdb56d1827a0477461cbba6b7cc68986722275e0d04ea7dc70db83b5d03887eec810bf9b67f70b18bd3c7b7d28f0e554938b81d3501bc11f97830a

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_fi.dll
      Filesize

      28KB

      MD5

      5a30bc4216af48a493eeb0f3a9f02607

      SHA1

      2fdf65a4002d91818d56a23fb8bfd08ab715002f

      SHA256

      5131c23915ad6b5b469bcbff31d0ae31ef34ded28ca0ffff9f1eb998bba98aa1

      SHA512

      34b3a4865f31ebdb8665780011b384ada768a0f71bff77f91706b140eb8cc07fff8787f710cdb1ee14a449cae8f22ee5fddadcc501cf1c921eea078e97dc2f89

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_fil.dll
      Filesize

      29KB

      MD5

      84c4736cf301b93998028ed7678caec1

      SHA1

      3b6f1f6b9eb3dd7d9a13c11dfd3ac56c93f1b10f

      SHA256

      3c8dcb7e982dac3159298009a86909b1e1000ccf6f4d333341f16d4d6fbd84ad

      SHA512

      5a1b77ef9450c32802e94e473a5b4e43e892c923ef368ee9bbbbb5b0090429320263cc79a4da0b281930c1a60861519211abd0bd67a9d9ee370bdda2230d2e81

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_fr-CA.dll
      Filesize

      30KB

      MD5

      8993c0784111fc7cd6a90a82303e5f44

      SHA1

      8d1ff2fed98ebc608604c555ceb46ca628afb285

      SHA256

      3d0ba88267018f592141ea86592757cf1ecaac1a3a18f99203e0fc5c5eacbd62

      SHA512

      124d16d848dc8ea0a93b292b10ce1fbad23b56b13771d904cf14c19d54478614d214441b05f6cd9e1999b8310fdd26d1c6ecae784be00aecee7e80c96ba4ac88

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_fr.dll
      Filesize

      30KB

      MD5

      a640aa4ff33662e06a474765df0b2a8d

      SHA1

      c6265225532e389e48c6057bd717b69de2125b61

      SHA256

      078b1943bf7f7955b90abc40f691b27e04376f8c43dd3abc4791614286cd4f23

      SHA512

      59791eef021f94efd9c18737d6c46fbc45add582eec92d5b997cfd66993abc7da872720a037766c3c70862f0654ccf30d122d4a5a6b305151bf8bf1c053a466d

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_ga.dll
      Filesize

      29KB

      MD5

      5bcc643a969559317d09a9c87f53d04e

      SHA1

      3602d51cde97de16d8c018225a39d505c803e0fc

      SHA256

      b48f57e90ea9db6d6a296c01e87f8db71e47ab05ab6c2a664cfa9f52cf1d2c18

      SHA512

      4c65772f77e61e64d572df5b1f62733aceb02a5c967c296b303ff17c5d49831e5b7fc3d662724ae3ae1e88cd0fdcb704e838af5d4ae20f2d82b9577f57159159

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_gd.dll
      Filesize

      30KB

      MD5

      aea23f526ef0c5bb3d2f8fdf192a49ea

      SHA1

      4d7695e33ed43c3efb95f304e29675ea885b2939

      SHA256

      3cfe866c151a7e8a208af725c0c6f2a47fc3ada35f9ad3509b16b8d5229318b9

      SHA512

      412e4742ebd46ce38010b4f6a46d8d524025f929ab4658040e271d768e79115d90903403b2f1e51ab910bbdf9677b49439eb3c8afc5959477af198efb0c7c3c9

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_gl.dll
      Filesize

      29KB

      MD5

      295cd30c00f43d9131621baf4859578f

      SHA1

      cab79a6263b7b0a799461f3e6df41f815029cded

      SHA256

      b851c5a60cb6d1e8dd9aa161106cba99ccea047d0b39d007beaa7b9ef4a83397

      SHA512

      5f5c1e62e6c0e11a63fad68928765e3f504f33cdbb1d9a05cd53cbc3ed145bf3528960a10e3d57e8c83b07c030c72257f403b9a57d12975d3ef8bc255418ad6c

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_gu.dll
      Filesize

      28KB

      MD5

      c43c1ab37cd93e54068443bc330fb3d2

      SHA1

      ab51a2cbc51b3c17cf184c6d99ac480c02eb63af

      SHA256

      0c26a367355e766402c31fbab102dd1c35300d4a1301417c75be5fc4b3d54680

      SHA512

      ff0193189fb846eb3c4188bb599dad8e6f415ec9612da567d95c9c513defb148b6013208371798d174569b46f443a744e4e8b83aaf139d68c31f7de0f94e63f9

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_hi.dll
      Filesize

      29KB

      MD5

      a5544f517f7c1bfd1ec6a2e355d5a84c

      SHA1

      34a2a4a576300ad55b6757171bcba0fab005daa5

      SHA256

      8274c64bb778b55d912929625cd849adfe733b2dd674d94895d53af8dfaabeca

      SHA512

      9069bcfb736e13499250844dddef40e2cf64937e33ee1f81fc4968f024f7d7b89c6a778866bf1bff98d770686569e4752a473c0adfad4d4099cceda84da3cac3

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_hr.dll
      Filesize

      29KB

      MD5

      c09876a180731c172fa2532f8be90a3d

      SHA1

      4359c7840ddb23142a40aff85129b9920360e954

      SHA256

      50fd548ea12e2b72fc563bc082b870a89a523e8b3a4a0e9b65fe673384da2b58

      SHA512

      91cee1b10fc12a01a2a285e67dba583d6f1bee0716cc89103fee0c7d0f52fadc0f9ac5b13e833834e7279963726950d3897847e7acac61857257fc031692033e

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_hu.dll
      Filesize

      29KB

      MD5

      ee19156c12d2d7cce9b12e515f9ac6c5

      SHA1

      19ad46e40b3c1cb6195231bfcf45bb68ee1b43bf

      SHA256

      c290883b4b99758792284755efa52c12eb09039f0f8027d8ba3b1d4bb2f3846f

      SHA512

      631364472a450519ad8959971d6c319610570ca37b4486ea12d6af5b46aaecbf336aadddd1f3fefba841534ff82adf905b1e1a008638ed784bf08870a3b86ee1

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_id.dll
      Filesize

      28KB

      MD5

      eacd4638369bf96ccc7c23af37e15b5d

      SHA1

      15c4878b78c06095981abcc589c4a6f265ef96a3

      SHA256

      a53c0fd74995090dbf48bbba4a00560e3cc344ce8120b8b2bfa1f9b953b536ef

      SHA512

      19cc8d25bd8fd84481f77d301f79636208df5807647ddc6cb6beff3882d94672db49daa4ddfff0c334b584742f9d2fea3af73977032d7dfccd0cfd1314af4ae6

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_is.dll
      Filesize

      28KB

      MD5

      19d44de8f930e07f41f9343478ed5c1d

      SHA1

      83ee0c5a86997dd491bd8312d221dde2b2e7d44a

      SHA256

      69d3a21b7723e4df8b7b97e39493081e41231e2d3a3f5a4de462db41339987ec

      SHA512

      4edb82aedfeca743a03815a889eca766fec8083afd0defa098593297a52edaf1780dbd5ad1d3325c614d815d34d8c57ec2283a0db215f94f42819f1890089c4a

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_it.dll
      Filesize

      30KB

      MD5

      26cbb965c6976f59ac385ef9408bf81a

      SHA1

      16bb0530338e600fdfd13a7b03523a715e633bcb

      SHA256

      bed996b25f77c7d4328d96147ed388f1b457abfc0510eb8956be4339d103821a

      SHA512

      1efb1bdf0276de17f8516cde4d435e0be8fd066f52fb5d4c9e2fe2e17a135296ab6b34f523284941beae438e97d7e65de26f0541b7c437bceff229b60da4bb0d

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_iw.dll
      Filesize

      25KB

      MD5

      98f79d77ab05304bba8d60e50914418f

      SHA1

      957590adc0f8a7274e765e2a804c1de7c76e3040

      SHA256

      3764941b873ed59d5bc1097f6b9382ba59c06d443a96ff71ba6b693f161da522

      SHA512

      9ca6af5c14193dce7b50251f1b9205870435e60b5495ab1a9f0d42ca14b98b78fef51bf3cd4165394ca5ba28d0e98bea7642ec67039c0f146383136145c7de59

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_ja.dll
      Filesize

      24KB

      MD5

      b89ba9ecc6d4c77abff61b1c75fff16c

      SHA1

      f381408f26be2c77c7b59681ad6280a701ccb472

      SHA256

      bbd2c970f747a6ee8e4735939225f607ae630ddc6e2e39954e0300ca9a7a88b2

      SHA512

      53a3db82f4cf5a300a5eab7692f4084451b987ad72ae24d9118d80f18692ac3604981c0e871c7a7625c5153803aea0e093d91822d33af0c10a07bcb6e766a5b6

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_ka.dll
      Filesize

      29KB

      MD5

      d464fd223ba898e6fef4e485a3118394

      SHA1

      59c78983ce859485fea5458ba4e7803c38012b9d

      SHA256

      066c5c4b4c87ffd201d0dbfc43cb7566cfb03a6ed2fbf8698220fb919637294d

      SHA512

      6ac1d5fc59e6b7a10532902b059ac25a2bf58b0a63ab586e89b293e2de732c1d5d580c75ff28e4a2660a6ee3f0389f49e388567bcc07dd6e1cfd5d019db3ea52

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_kk.dll
      Filesize

      28KB

      MD5

      1b1202fc3e46d7b46ce3cb46cdc5ab21

      SHA1

      e76d1065035d86eef011feb3cad3ac38eecd0b7d

      SHA256

      b660a0e1d5161765881e0a7fd9d714abce341403b21f63667ffdedf7d5a254d0

      SHA512

      7f11d5d6995f27bb4f8705ac7310273f070a71adc73cdb70d74766c89437b3e7a10453fc55588ac223fe3b449564758a49380168d779fdb6a4fac3b5cde767ea

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_km.dll
      Filesize

      27KB

      MD5

      126036b98853a9d31937f874484dcb83

      SHA1

      27ffb8f3f6e966c3b79824357e79eac4ec8ce0a7

      SHA256

      90908e9108adcb0b4df84e4fbd9724e5e7a2d2eb54720fe49f37bdce977be635

      SHA512

      b384657e0ca90270b96cb724aa55c52f5c8b569fdb1a7ee7085c18d6822c39fc81a490128bd42d0aec1c0ddac1853e30718710968f5921a5331211bd33e89316

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_kn.dll
      Filesize

      29KB

      MD5

      e20f7a758cc9bab3d458d89d828521cc

      SHA1

      cae0a6d29e5b3f0aed0db2d66fe19d5463c09cfb

      SHA256

      92858a377f1ddc353b51bb44ec04f571ff2b4913d3c8104aa01359b72f91f2eb

      SHA512

      8bf9b8c6765820db6dd95303cb996b97649796e14e67b465fded3c24ef180891d58f9fdcb06243ef1d4c5cdd4148f58f64d74d2ceb2cb214051718d33efc9707

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_ko.dll
      Filesize

      23KB

      MD5

      f7dbd944a9126dbe568faf2489ecf053

      SHA1

      16ad534b4fa48d95224c74b8ca4d3d4533c76425

      SHA256

      b1dd9c0fdd11a5f83ed5b7d1fbcd417bfaa94e42035647ca45f20e332b531703

      SHA512

      0b6843fd208ea9448179e63b485c01b5ff824d555cad57cdb6575234bf43d6cf253e9494fa74150b9fa9ace9d1d1ce749e1a77c7b342c10498dd7bd3953d9a27

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_kok.dll
      Filesize

      28KB

      MD5

      c1557eba649fc78356ed198d6754416d

      SHA1

      1ab42e71a88b127c40f8dd6d1b0660f271442a11

      SHA256

      8c5a7b3e9f5a3a64214ca8e9d43ea152f69fc2633f47c0783b90385e00551ef9

      SHA512

      e2f92c8c6ea823e1d716732b4bb5295d34da02d270079f645d9290261728bcf822b7f845f4a37dc2ef844580d6a3650a53c3e80be875eac5dffef651e8607993

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_lb.dll
      Filesize

      30KB

      MD5

      b61c9c9ea8340b6b3a873162a2710cfe

      SHA1

      5017b90dbd61add602681b76542b0bd3974639af

      SHA256

      f3eb2d26173d9ea8e26e234c3c5f91f9eb145fdf8b2b3e5011e0f33394fd8737

      SHA512

      0d32f6a880509472a51ceaa9539e3169505bc6b508664d28c9dfdd1a3a72abec665574dfb89e385c18522166221f1d73741fe62e4ea0860bc132e198614cccf2

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_lo.dll
      Filesize

      27KB

      MD5

      6e6f49c35d2b74090529fc1d8d12eb2e

      SHA1

      5a0fc9397872d7d26803276292962cdb0a5e4739

      SHA256

      6a25fc0ab6e2c73eb938b8e0f38578b9a02feb3a0634a16ac41ebc2a9642d260

      SHA512

      d3838a88908b2ab9bf6018dfa4c6f784371774cc0bcc82e180761673a9e527e126fee17a150a51c6d0a1159575e2060c12f85ae751e7a95f0285e816799540bd

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_lt.dll
      Filesize

      28KB

      MD5

      071ee832762aab532c59b858c7d3a46a

      SHA1

      0a976bd2c76d8db1f831a8912184d43e02ecf293

      SHA256

      a47e46963fbc7020dfc9dd08eb5d7d8c4c2a9f0b0a8f51f1256453058a6a19f2

      SHA512

      50ec7ff32da6f0d022ce067bcc160ccec00c4676ca56b789bc6ba1efc7f34ad485297f4cca6f6ed40be1c59018a7287c7fb490e6adcdd74f3f72b4526332a522

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_lv.dll
      Filesize

      29KB

      MD5

      bf10592aafe1b8446c005ee9e5c305a8

      SHA1

      19b81a238e07c958f1757488440e42ba99b59b53

      SHA256

      5cb166b350b425009080d39efa3b6ff5c0bf78f4276cc1ffce3043d4ef1a687f

      SHA512

      b69d55757047170a7583f3f0525307e09e670adfe05906d30bf208dd78b70b3e18a19adf59aeccc861857c2e37cb08412e4729d597ffb45960d285e12357b4ff

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_mi.dll
      Filesize

      28KB

      MD5

      d8b6019ab0fa35c6e64b08f1453204be

      SHA1

      aea69732af642a0d13bc8feda2b25751196cc1c2

      SHA256

      0672e8b5be2da1042bf6c85611a0a89012496fbcf7d06a7f446b30997cd20eb2

      SHA512

      878dd4db34b1f501c37eacedac8eb0c87143189f7357fbd5bd97faac01ba98cebab56e2e3934af012de37d0f32fb91578b16504b12e34b5f448605a82cb8f054

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_mk.dll
      Filesize

      29KB

      MD5

      f05d3aa1b51abeab311516368dddd8bc

      SHA1

      75ca6ae175a3ccc9f00d82afb4c6b673f396c6ac

      SHA256

      7aa26839a50ebc3ccb20ab5aebab432b695f0024d52529ef262f5eb8ef96d17d

      SHA512

      4ff88ba89823ad0c0ca2782c87bbdbc7fe738a161d5d4f674d7b9c97d491eb5aefc0430f34d3dfa7c2737f3484040894d81ac38135fc4ad3bc6cc0eb24e479f7

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_ml.dll
      Filesize

      31KB

      MD5

      dc1bb5db270c494456f49913e26f94b7

      SHA1

      73dd3db577b7bd6bdaf047cd2012c75cc2213bd2

      SHA256

      155abac08c35cb330d20aef6375dbe18421c042a2533da0c63535ec59009cadf

      SHA512

      2cff374df4f8f41961c6e26ce369fc07ad8881c2edbe85173b6982d393402e32a79c73b8c17cc786d27a1f0ee79475e4ef9b3238f8770a099bdb9c422caa1287

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_mr.dll
      Filesize

      28KB

      MD5

      f94262bdadb5903e2e93a6cb6218fbe6

      SHA1

      c066be7fb4a1459cb62288e4799e268fcdb13ab8

      SHA256

      9e000d271d96f02bd0baecae07ef5b9a7f5f17d33733e2c9bb50f13e4c6e84b1

      SHA512

      11543d93e28e5616dd3aadd5e9b20b22b9160fb4117a0cc57971e5e46b52150c600bde161560410322b1db1c8a26e0c61cf9fdc761ca461a22f0c4eac16340b6

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_ms.dll
      Filesize

      28KB

      MD5

      47d8bedb506470955c8a1b973e34793b

      SHA1

      d322b0d0d0663bfb9fdd42d3955dede092a0c8ef

      SHA256

      d79365e02f80694a9a2d76becc6a203a758b4006fbb521453f943ace16d24c8c

      SHA512

      6b268a0c8c6b2e0f26657040799c8c1ec523882e4dfff3f8d1e2bdbbe47b800e390de0a6bbac7d6253ab84c60c4103b4687b3fbe84d6e289f25c19639d25bef8

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EUAE41.tmp\msedgeupdateres_mt.dll
      Filesize

      29KB

      MD5

      11cfc0a8eeff082d17979d3968d5d110

      SHA1

      c963251af2d22fe7000d1eebe76ea44fb7da6496

      SHA256

      ce19cc60aceaecb34cf496857dd3698a2a5dfe88cb67bd4b7fd0a7ecc51c2ea8

      SHA512

      97c09f6a02e4469ee0a609d9d67e20111e2abf9c8672d0fcf8275d66d20fc92e61d8dcb88b3cc9a32d46391253ffff6157c5a7cff7fc9248af55ab3d3217a2ce

      Download Submit

    • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
      Filesize

      102KB

      MD5

      d5a7cf0508012cf23e82de822c3e8033

      SHA1

      aa75fe3b384ec7d8e164aa7a721a5b1338cdbc80

      SHA256

      81c9d74bc3aeb704f058a706e34463a2b86ed4cdcf1e38e662b5f087f7edfcb2

      SHA512

      c5fe0bb5aa6e6ce9f26674f7336682d2844fe7f113c0954e13b5c683efe54e1500acfddb8979b3ff294b5ebae6638ea834ec68adfc6888160eb86ee4e611daf5

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
      Filesize

      280B

      MD5

      8ddaa470821b347a1c7753c12a6388d0

      SHA1

      e848e7eb720ef32d1fe550f1090bb10451736c6e

      SHA256

      b5978aa5aebd916b045eae099ed3a6e1bb0d1e579eb02fe08bd4ce02cbff10fa

      SHA512

      6a54c521e55b26ab3e5759316670906adb1fd8490aeecf293b39017440bae8f357fdb335721466a393d3e4fd9efc8dd7e8e9768765462615084f14b8a10cebff

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
      Filesize

      48B

      MD5

      a1abd3846b4015d799a17a37b9bb522c

      SHA1

      55069171edd5c6892f588210adae0c90a7fc2e3e

      SHA256

      70cccff586169a2b9d69973a09480951006e59476447355821c146995cfcbc26

      SHA512

      4a92a4fe3989946c81ff53988edb27e3e48eef7fc4c2756c5b01f10d1eaa55cd60861481f2494c6d46a3fc221f363c9288e83403db4c389a1fccef1298591dd2

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
      Filesize

      2KB

      MD5

      be0a4bde84e0d50cba4d565b5e1c56b0

      SHA1

      f321649e8549aedb92717fa49fe94029059b6c62

      SHA256

      dc44d4de141ece79a4bca1af14c86d4829b3484928c2c89d668eb583ab15cfd9

      SHA512

      461de54a5866b2bb98c9a732424b469054ea83efc7ece3026e3c10929f2d5a25e791a4b3fbbaee95e75c8a2517c8f0f5b58da8f5e6fcaf1923ebff612b192fdb

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
      Filesize

      69KB

      MD5

      164a788f50529fc93a6077e50675c617

      SHA1

      c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

      SHA256

      b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

      SHA512

      ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT
      Filesize

      16B

      MD5

      46295cac801e5d4857d09837238a6394

      SHA1

      44e0fa1b517dbf802b18faf0785eeea6ac51594b

      SHA256

      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

      SHA512

      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001
      Filesize

      41B

      MD5

      5af87dfd673ba2115e2fcf5cfdb727ab

      SHA1

      d5b5bbf396dc291274584ef71f444f420b6056f1

      SHA256

      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

      SHA512

      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
      Filesize

      9KB

      MD5

      3d20584f7f6c8eac79e17cca4207fb79

      SHA1

      3c16dcc27ae52431c8cdd92fbaab0341524d3092

      SHA256

      0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

      SHA512

      315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
      Filesize

      2B

      MD5

      d751713988987e9331980363e24189ce

      SHA1

      97d170e1550eee4afc0af065b78cda302a97674c

      SHA256

      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

      SHA512

      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
      Filesize

      857B

      MD5

      5c2ad2421236c8477e9b141ebcb54ee8

      SHA1

      c5053425db590a5026f84c56931f4ebff7ed4337

      SHA256

      3f166ef3110009dfcdc592359d339c19432dff3881a38d19a94f0b5273e00d50

      SHA512

      bc9d3b81a76769194703b44316d8066205b2f43a4a5ac996e392cad9ed88703ab411bc12f0dbfa5e5d6176d0fcd41ad6f9a818afd1bdd0900fd84e5a788704d5

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
      Filesize

      857B

      MD5

      8d2fd5259a03bec7402333c0d5fe88a0

      SHA1

      0423b5ab11d2be1a387f5a86714b32f8f88fd892

      SHA256

      e81d73aeecbf1802c8a94f82ec42d79b3c131caf6574de93a3efbeb30902d0d3

      SHA512

      321f68005df798bf225f4739188b12dcb7c91688383defde3e1fc8208e4740525eaef8655503d8cdb1fcde8baab9e9409d15f8bfd00883f6723aa86f53808fac

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RFe59c654.TMP
      Filesize

      857B

      MD5

      a1bc402d865d173baf62acc8a95637f4

      SHA1

      3fec0333d9f4e38d5c3b95efe9f8b89f25b14848

      SHA256

      8d04ca7febadc4d7276154664e10a429ebadc3716b544ba99d5b2223b97c0c71

      SHA512

      dfda8335609451db87e0406238581429063f402e740340dc533635297a289baa07eabb382c26ec6d7a770991ba62b8b8c26cc63943fae7e9cacb59e166cb768b

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
      Filesize

      16KB

      MD5

      ab7f42c031ea0a0513f464e50f8a63cb

      SHA1

      43900f004b5d5ce7d0045566b6a60ec047c25f79

      SHA256

      781652313c93c176f9b171f48790dd46e24c47725884648df234446d1dced927

      SHA512

      4de7408f36508bf68d07fa91c1b8724bf5035b1d336c165e011ea0ff31aa194b6ef9236d13d82658ba6b460c61036efeca85ce7317bf16abed86889f42b5d2ee

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
      Filesize

      36KB

      MD5

      7e11efb70084538a7c9f15025a751775

      SHA1

      1e1c7c2ed59ee00a6fbe230705df422a0505c095

      SHA256

      77bf8b8e7d6aea85f903a8f862fc2489e544b0caf06f5c605d3f9a13f55fd3d5

      SHA512

      8c26a66f99753138acb70ad23833a34811f6ade0cf483de7f5bc174dce7ed58efcea131a8a4e3718ce3b4d48aa641192d4eaf2b4528441d7a49cfcfb7668b6a9

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a29f96d0-9409-4fc3-9c1b-0669164c98d2\index
      Filesize

      24B

      MD5

      54cb446f628b2ea4a5bce5769910512e

      SHA1

      c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

      SHA256

      fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

      SHA512

      8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a29f96d0-9409-4fc3-9c1b-0669164c98d2\index-dir\the-real-index
      Filesize

      2KB

      MD5

      8794fb9ed6e06de73f4b603137a8729b

      SHA1

      8a7b6b55d938ed7ffafbc1bee96647ebe268ae1c

      SHA256

      4da6c7ec4c0fb542357bb0f4df583f0ef48b71e9c30ddc8232c27c8c00f0e238

      SHA512

      77a313b8a2774e8145d3a61aa83dd832c564ae52c7b3e190d3d8b8625e038505cef7a6db591f505e00f392b7ba6320ac81972d8dcb430665a170cc6bed1cc23a

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a29f96d0-9409-4fc3-9c1b-0669164c98d2\index-dir\the-real-index~RFe59debe.TMP
      Filesize

      48B

      MD5

      491491f2ce51dc3c720509d70fb359f6

      SHA1

      40b28dc638a00917e9f8e669d03446d96e641a61

      SHA256

      73f63c3ac8bb83bbb49f08a664a6a2c39ded424743ea7c41f175b5412ee3f9f2

      SHA512

      e505d1285c899a7c3ac004fdd50e174d174f2ad10fbe7d96aaad6cafac3005d5aee4473feb1bed2bdd5dea0744f5c5d133184379a37228a37f630105edbd26c4

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fc85d1d3-a488-4cd2-80e0-6375ccc878b6\index-dir\the-real-index
      Filesize

      72B

      MD5

      0af917db16d3e106dd6ba881b972cdea

      SHA1

      15867738b9e09726e578d01a27e20d29c372ff49

      SHA256

      03e171a5b467412d20f24ee6dae1b05ce5747a5e6ecf449eb6930e80b78222b7

      SHA512

      5ba92ed72628fff8a5ba31326e9251919b43a5d31cacfdcda91ce405857497a53f442e291350821c4ba961afe7b29d3aa098e1a842b4038bc0e7cd59fec86ef0

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fc85d1d3-a488-4cd2-80e0-6375ccc878b6\index-dir\the-real-index~RFe59cac8.TMP
      Filesize

      48B

      MD5

      f018988a0112adeac71c299699138cf9

      SHA1

      f17ae99d554c3161e674afdd0138d261e794e3b7

      SHA256

      55d9800f8f5375cb081bc4428dbb8a61f86ee4f41687ea6dd7c8e634502be826

      SHA512

      53e1bbb5c2191fddd726e68ce9d55f4863b6556885bfedd359b3f0fb3cd26a8709efa1a5f7f2f01bc1116457939bbcdcc124f956744210c582963b20eb2a854e

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
      Filesize

      192B

      MD5

      0ccb5b5bdf68fcf3aa7a4b124e17fd8f

      SHA1

      15c0f248c7d6d9da568a8d9d58ce58559f7ad909

      SHA256

      34e6c869588585a0abc1780fcfb1f212ec1c2c85d99f017e57f33fe56ebe105e

      SHA512

      747d01b6d7175cffa0a90d45bfbee3d0fb5218595467d5a9d3d33630f62e26f34844cad57dd8c5d38bdc1876ad1fb321929d96351b5f09bd8b13d540c3803105

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
      Filesize

      255B

      MD5

      885ac825ea9ded75736552546b502196

      SHA1

      8314153064a097def9c5eb8657e1f4430d4ca6e6

      SHA256

      a7aea99862ab88970f3a79a7d9a5c1db2d5c0a10b2a571c8bcccb5ee04d351d7

      SHA512

      ea91f8dc0c3004a5b20fbaed62e2c780094e9be5b74682de485a516ef34b1f43228f76da5d1c42a0cab25f4e0f47e095ad5cb2b5408ec515bb46ae3e196e331f

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
      Filesize

      253B

      MD5

      fe16cf8074ef8d41ece6ec4fba93c284

      SHA1

      d989fcb39dcf9cb072e96d38ca2eb72c32c69d49

      SHA256

      d60fb2a05c84fd322dc03ed1ea0616f24f3b81e5668936c37304525c3859c40c

      SHA512

      4884a8907a061a4022bd87bdcf3dad121a9086845862c85aa0ec146bb7d0e4687ce833536c868afd2803f56253895631a83b9fcae1051846dd36aa647e77b764

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe597bdd.TMP
      Filesize

      119B

      MD5

      29d856c4df8051ab5a3615ea85501984

      SHA1

      9eb9bafd28db77d6e400cfdbd67526f4a0ab1362

      SHA256

      b2335ac7b9c31e3315d8c524e3c92af1e73cc5225326667818bbd5ee2ee095c0

      SHA512

      ee9bbef1c34fd8c07f75cafe4839c15957f1a67249837210f7e565776013fd4006a04b818f839ffe8b545e91d514c14894c75b931a80dea7fcd6d1902d776a2a

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
      Filesize

      72B

      MD5

      8b39748938951381dd9a13c089dd59b6

      SHA1

      b3373f58309aa241b73a486f3b78158b413bdbf3

      SHA256

      9d3e4525d6ed5ec3eeb089d440bfec6a1f6e6330b8dcd31e3165dd9297930a1f

      SHA512

      cb6d66dcdc82cbbd285f9a3cbf692ecb42776dba8cdbfa4206451e113ce92f93106475faa28bf1452faee1106dd57c522558e416dba149143edf95834777d14a

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59ca0d.TMP
      Filesize

      48B

      MD5

      c95ac9aadc69d19f1ec914deab1a35fe

      SHA1

      c170b7e7f3d900e4ad406379ec8757f09278ce03

      SHA256

      69ed022af12d3ccb62ae17b47e3cc523ca394db74ab55bf972db1aa8968ede38

      SHA512

      b1ad7600b146bb5f85245c0d56f85d3563d4623c086439a20c227bd442e05b5d7e708bac5ad070e7fa33177b541b89782eacad6fb16b0ddab2828b23b9b8d439

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0
      Filesize

      44KB

      MD5

      b278480cdaf5e1e64775cc5a9e9e4a3a

      SHA1

      280dad6ccd33a14013f6ee4f974881b4e4061a9d

      SHA256

      ad855d2ef9c9e2b109425723b6e4793090be064cdd571eb567819a65fc422f16

      SHA512

      d0d65e174fe86db46265f0bee18306ac698b05d9f2aa9f18f254409399623ea06d830fe59910e4fe1fd8595eace54d8867a47fab45c99b6b69dca15c6de78686

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2
      Filesize

      8KB

      MD5

      0962291d6d367570bee5454721c17e11

      SHA1

      59d10a893ef321a706a9255176761366115bedcb

      SHA256

      ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

      SHA512

      f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3
      Filesize

      8KB

      MD5

      41876349cb12d6db992f1309f22df3f0

      SHA1

      5cf26b3420fc0302cd0a71e8d029739b8765be27

      SHA256

      e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

      SHA512

      e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
      Filesize

      264KB

      MD5

      d0d388f3865d0523e451d6ba0be34cc4

      SHA1

      8571c6a52aacc2747c048e3419e5657b74612995

      SHA256

      902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

      SHA512

      376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
      Filesize

      3KB

      MD5

      2ff0ed0328ed6d74560a5ca3df2c603b

      SHA1

      b892cdbd0457e0c5eb6a42775f4093a49372dea8

      SHA256

      5ef77abf7ad016678e3c9fdf9a40bb42590b2a91653fd6016b7a4daae3ee8ffa

      SHA512

      bf092e3c19d4d2b64c147605bf2c270ef17bdf54061788cdead846b545dbd795a7cf7255ea8eec311cc3b0bfd61bf111116216ff84f831ba7eb08c1425b667bd

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
      Filesize

      5KB

      MD5

      2b221346eaf4714e1683a37271f106bf

      SHA1

      c437eeb1a94110b87da9e51fdc277e0e2c5410c3

      SHA256

      b95f6459e65c00b88a36305937691fc14384bae5ffcb8fad7a5c672a31eab32d

      SHA512

      efae2b883749bc7a068b09cff74f535c27ecfabcd8bfe2d36fee90110af9ebfcade7334f68a3e1cf88302a868f7f18bd60e95f16fc07e609b4b37b17d1a6d72f

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
      Filesize

      3KB

      MD5

      127b2b29d343292a19fe63e135075695

      SHA1

      8b138c5395530fce134d190e30c9714d72cb6f54

      SHA256

      5bc0f8118603af7c3479909639e57fa4d643cb5477e42745dc990a421113f06f

      SHA512

      267aca4f039587be2a5d15074f25c5d0aeb940692b6296ad6afb3488aa827a8349f4228bf8c2284cde24fa60cef26e5624ba5a0d7b015ee266f5c228522ef565

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
      Filesize

      5KB

      MD5

      9e2731c1665a1751b9c8beaf943efe21

      SHA1

      feeccd36e4c5ed10144f3111320ac74522cee867

      SHA256

      aaad38f3f6794214285de1fdf38ea1488bb291de66fdbf855cd7baec5f415e6e

      SHA512

      2116bd5e8b3c35ea06901dc0c0e8b110c58a9d26eb97e5db77a2555ceb8ed42d11294e7a2fbec475d79444aa8c33c0e4a3af72a921e68c57659e67f73c0f637d

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
      Filesize

      27KB

      MD5

      4237568c80671ecbcc8f95a82cc3184e

      SHA1

      0e7e8c039daa7b39d3e88a9d3dc54a4fae578cbb

      SHA256

      7e51db3c67f5c04bacf6360129198776ba4779399cce4f2a6c3d27bfbfce350e

      SHA512

      c1f4ffed6255ab49c8b292963cd3f1c9aae9abb1de8e59f98307011ee6306c0fff001f92b37b6ae318d472b379fe8c2dd7d8bf9a3a8a2eb13c33a4203c88cbbb

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
      Filesize

      2KB

      MD5

      468751780386df2b249f629ed20727a8

      SHA1

      68b7f106e4e8370d823099d278d6774004c813f5

      SHA256

      16840d6849ce0b63eed8f3b81adf08dca41f7a1d25b02332574f29657fc8d632

      SHA512

      573a15a80af8dfdbfba62881cdccc41f46c146531d466e7d16c081f08c49577c4a33b7841f6e6fb26bad678f4809ef028700f601a38c8b7225330257f4d47b84

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres
      Filesize

      2KB

      MD5

      0c690242745a8657f4a4b1ae1a87a3b4

      SHA1

      3e9a9119675dba05111ceaa9addd2e068bb76eba

      SHA256

      66fdad1c840ff1cb40c8f77d6d636a8775d806dab114f7e3a06bdc5799c7f2f1

      SHA512

      de1fa1dfb8832cee6f6cf559ab4e64d5fd4be79f6fdeef61adf33854235e83aad35aae163558a3e2ab61eaa98757f62c986ad393b3e77a8f4710a9765657dc5e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\ad800629-938e-4b0e-b9fa-e80fdc45908e.tmp
      Filesize

      1B

      MD5

      5058f1af8388633f609cadb75a75dc9d

      SHA1

      3a52ce780950d4d969792a2559cd519d7ee8c727

      SHA256

      cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

      SHA512

      0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\scoped_dir1844_1671416315\CRX_INSTALL\_locales\en_CA\messages.json
      Filesize

      711B

      MD5

      558659936250e03cc14b60ebf648aa09

      SHA1

      32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

      SHA256

      2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

      SHA512

      1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
      Filesize

      3KB

      MD5

      5ea1057e6d9a0de9ec649c5e4c931069

      SHA1

      f777b15a30c5a7ad14b475f66429429d00212bf1

      SHA256

      5e14e3b11af67d76d8dbfbfe785673cff9c4d3bfcd574252bc9fb50312dba897

      SHA512

      8a51838a6ba0204887b5c8a60e6c0c2d107033f3a2257c15d916a5b99cc07ebb5399fd842338c78f25f3141b1234e1b41c41a897bbc04b84a0ade44a7ddc1db7

      Download Submit

    • C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat
      Filesize

      280B

      MD5

      0821e880c046fffc8b576fe4bccc5396

      SHA1

      189c486b9cf81dff5c0df77c418f75bcf8a73564

      SHA256

      50a65a28d652fe735a2970a1874af055dfdac9fdb440de8f06fe452671391211

      SHA512

      d059481fe9bdd1c6e73680298f380a63a22f99026c7344ebedee8f3ef0765b295cc3f0bf9fcf244ec975065ac0092a56b08c53f9d1294d9a4f264b949aab1474

      Download Submit

    • memory/4260-253-0x00000000002C0000-0x00000000002F5000-memory.dmp

      Filesize

      212KB

      Download

    • memory/4260-184-0x00000000749D0000-0x0000000074BF5000-memory.dmp

      Filesize

      2.1MB

      Download

    • memory/4260-177-0x00000000749D0000-0x0000000074BF5000-memory.dmp

      Filesize

      2.1MB

      Download

    • memory/4260-176-0x00000000002C0000-0x00000000002F5000-memory.dmp

      Filesize

      212KB

      Download