Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241023-en
  • resource tags

    arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17/11/2024, 15:02

General

  • Target

    Bootstrapper.exe

  • Size

    9.4MB

  • MD5

    f2a6133b7f38fc49f792ae799d1b4750

  • SHA1

    6bef46ddde325f45a0e9ff123112c96bbd47c795

  • SHA256

    37bde6655e1272e159b9c2e3a7eee3f4e9a837c0f04240645d3991d112287f8d

  • SHA512

    f9611bed83b4bce1841868880a42dacb6b8f7e8859be1d85b3c8d3a365a0244566cbfb12294c7b2c82b15d6c0e47095d8246a95d522c3a064a0d8511b2411254

  • SSDEEP

    98304:UHuETr54/xXEPmZM8l2EKSxOyFOiC0YYWtS7tkk6Q9SFxVLUeRF:2pIxXoSTlzdFfCtlIZ/9iZX

Malware Config

Signatures

  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 37 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Checks system information in the registry 2 TTPs 12 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Users\Admin\AppData\Local\Temp\luna\Luna.exe
      luna\Luna.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
        C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:984
        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
          4⤵
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks system information in the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5020
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:4400
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2316
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:4308
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:1780
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:2768
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDY4Mzc4NUYtMDVEOC00MjI1LTkwMTgtNzRFQ0E0OTM1MDJCfSIgdXNlcmlkPSJ7OUNERkFEOUYtRUExQy00NDM5LThEMzktMkRBQzBEQTNGN0Q2fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezdGRTY0NzA1LTFGQzgtNEIxMi04MTQ3LUU4Rjk4MkVEQjQzNX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTQzLjU3IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4zMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDkxODE0NzUxNSIgaW5zdGFsbF90aW1lX21zPSI5MzciLz48L2FwcD48L3JlcXVlc3Q-
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks system information in the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:4836
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{4683785F-05D8-4225-9018-74ECA493502B}"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:5012
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Luna.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=2356.1348.18206129166474917145
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:3084
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=131.0.2903.51 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff878926070,0x7ff87892607c,0x7ff878926088
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3372
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView" --webview-exe-name=Luna.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1792,i,79437147025622852,12817467696579869891,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1788 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1156
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView" --webview-exe-name=Luna.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2040,i,79437147025622852,12817467696579869891,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3740
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView" --webview-exe-name=Luna.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2092,i,79437147025622852,12817467696579869891,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3032
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView" --webview-exe-name=Luna.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3664,i,79437147025622852,12817467696579869891,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4912
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:3628
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDY4Mzc4NUYtMDVEOC00MjI1LTkwMTgtNzRFQ0E0OTM1MDJCfSIgdXNlcmlkPSJ7OUNERkFEOUYtRUExQy00NDM5LThEMzktMkRBQzBEQTNGN0Q2fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QjZBODZBNzAtQkE3OS00QTg1LUJEOTYtMzUzMENBOTIwRUQ0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7bGhWaTEyUWNrNlNsMHVVMU9CNlkxNTI5YlI2YnNleTQrY3U3ZEh4czZjaz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjI1IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mjk2OTM3NzkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM3NDE2NjU0NDM3OTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTI0Mzk3NzU2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:3424
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CE76BD0-456B-461B-AC6A-7CBA6E291A1C}\MicrosoftEdge_X64_131.0.2903.51.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CE76BD0-456B-461B-AC6A-7CBA6E291A1C}\MicrosoftEdge_X64_131.0.2903.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CE76BD0-456B-461B-AC6A-7CBA6E291A1C}\EDGEMITMP_94893.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CE76BD0-456B-461B-AC6A-7CBA6E291A1C}\EDGEMITMP_94893.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CE76BD0-456B-461B-AC6A-7CBA6E291A1C}\MicrosoftEdge_X64_131.0.2903.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2268
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CE76BD0-456B-461B-AC6A-7CBA6E291A1C}\EDGEMITMP_94893.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CE76BD0-456B-461B-AC6A-7CBA6E291A1C}\EDGEMITMP_94893.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0CE76BD0-456B-461B-AC6A-7CBA6E291A1C}\EDGEMITMP_94893.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.51 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff6d18c2918,0x7ff6d18c2924,0x7ff6d18c2930
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1376
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDY4Mzc4NUYtMDVEOC00MjI1LTkwMTgtNzRFQ0E0OTM1MDJCfSIgdXNlcmlkPSJ7OUNERkFEOUYtRUExQy00NDM5LThEMzktMkRBQzBEQTNGN0Q2fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezc3NTNFMkZDLUU3MzctNEIxMi1CMTNFLTdCMUVBQ0Q3N0I1M30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEzMS4wLjI5MDMuNTEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5NDE1ODQ3NDMiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTQxNzQxMTcxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIyOTc0MTI2MiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMjZkMzlmOWItMDJlMS00ZTI3LTg0ZTItYjU0YjI0ZGM2ODNlP1AxPTE3MzI0NjA2MTUmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9V3dPS1REcSUyZjRaVkc1ZVU2d1IyYkNPaTZINDJjeEpLMkJFb2tpOW1lMnd5aHM0NE52T2kzRThIZUpqczZteHlyUDVrS21NJTJmbEhjbiUyZnUlMmZXSm4lMmJZJTJiZnclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzY2MDc4MjQiIHRvdGFsPSIxNzY2MDc4MjQiIGRvd25sb2FkX3RpbWVfbXM9IjIwNzUzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIzMDA0OTg4NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyNDcwODE1NTIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU5MDk3ODM2MzAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI4NTkiIGRvd25sb2FkX3RpbWVfbXM9IjI4ODE1IiBkb3dubG9hZGVkPSIxNzY2MDc4MjQiIHRvdGFsPSIxNzY2MDc4MjQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjY2MjU0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4908

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Installer\setup.exe

          Filesize

          6.6MB

          MD5

          e8ecc691b6b345c25ea749591911d934

          SHA1

          b54f8b8ece5c4221c4180edfdef39df38a36ba21

          SHA256

          e226aafcb47b85afe8962b885921dd982bbeb356ddd1c66e5a6f42be80dd052a

          SHA512

          9364268b3e7333a6d52e3ab1eedb15c9cee98d5139be0708790275ef05abba12f32c2a39546b4c81f799d7ee662d5f705af9de28b0fca12a64c72ebcccd4f066

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\EdgeUpdate.dat

          Filesize

          12KB

          MD5

          369bbc37cff290adb8963dc5e518b9b8

          SHA1

          de0ef569f7ef55032e4b18d3a03542cc2bbac191

          SHA256

          3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

          SHA512

          4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\MicrosoftEdgeComRegisterShellARM64.exe

          Filesize

          182KB

          MD5

          1723c5e707061e59d769c492a95d5083

          SHA1

          3b535b7a0df2f7a4ab5e531956dad9892adfb5e9

          SHA256

          e97ab6dc0ed865aa8606f5c113fd62170341d1a3d63d5618f233aea969ec49ab

          SHA512

          a4e3bd9ec331a27338c123a9a3ae23619fc5a5b80fc9aea38d23d3b82ca015f47669e0f3e1a6f98e7f464e6bc21e92723a04f72805e45e0dfc81540a2d299a8a

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\MicrosoftEdgeUpdate.exe

          Filesize

          201KB

          MD5

          35a79bd6de650d2c0988674344bf698b

          SHA1

          a0635c38472f8cc0641ceb39c148383619d221dd

          SHA256

          a79a81da2b8dcbe39609a9e1b4e8c81ae0bc54195c0c854b77bebe7bfa7f10c1

          SHA512

          afe33d38785afe489845654ba1c3ed6648b36b1ebe5f98b3d5d4bf24eba3af9bb6676af5a79d2ec570bf2b4b6ae40d14fc3d4b872c5d4577aea40f6d1a26c0cf

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

          Filesize

          215KB

          MD5

          c55b37823a672c86bc19099633640eab

          SHA1

          da5e15d773c794f8b21195e7ad012e0ed1bceb72

          SHA256

          3df9cd2fecf10e65be13d4b61ca0a9185845f2cb04b872adeaf41ca46af39aa0

          SHA512

          1252c3fde4aa4ce239103e8df7224afce093a2cbe539bd40347601980a314ea3326ea6ce4c1ebc845c125845969ad65ebca319b9df35a809ef871bad14aaf33d

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\MicrosoftEdgeUpdateCore.exe

          Filesize

          262KB

          MD5

          dd30f3ff486b830211df62d20348f86f

          SHA1

          08c7d7407dee7ed20b50e8f1a2cb1b08a9282dbf

          SHA256

          9d57bdc8b97e75f8a04b93a1657dfd18d4e2f68607783c9bca42140233978fa7

          SHA512

          af3b48ced7018c7edeabdfa998e51356d57c2d7a846c76629fed0ff2e5db8db79041184c58a5a67a10ec627f53af8e3c80bbffacaecf5dae6d989cecb82e72e4

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\NOTICE.TXT

          Filesize

          4KB

          MD5

          6dd5bf0743f2366a0bdd37e302783bcd

          SHA1

          e5ff6e044c40c02b1fc78304804fe1f993fed2e6

          SHA256

          91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

          SHA512

          f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdate.dll

          Filesize

          2.1MB

          MD5

          39ac5a029f87748e964491b97936d890

          SHA1

          24777aad794a13d0e7381fc6f32f0e1bcdb1ba80

          SHA256

          ba861524fe648ccb47b7ac57421bb07a6231a7aab5eaea332548511cce6185bc

          SHA512

          2ecb9b208846f84cd37f37d2100f26358d6c37128efc4010b2e7efc10202dc37b621d0c0138a8b76b23d968da324c685a41b44f4ae30cbbe243581f1904e14c6

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_af.dll

          Filesize

          29KB

          MD5

          2a9524cf8afae49394379d9d9be69206

          SHA1

          e43d4146f8abebbb30831fbd39a39846bfb7eeef

          SHA256

          e5a08731963e681b6386c4e85c16bc98452ebc13c4a7de3ff6979125c609d5f0

          SHA512

          a0111589960cbdcb10b55c17aa82555e44f0f0f173ebad09de6364881138cb35280596f1de6d86b31044427445575630c22079c3585e34729ce461599b8979b1

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_am.dll

          Filesize

          24KB

          MD5

          1903bc250fc269e79c9f7aada2979aff

          SHA1

          efbf76b1259217c02c138078c56f36b2cb8543ab

          SHA256

          228fa3e2fcacc78111a8152d6862de2302c024e81cc8b5e3f16e31caf96cfd04

          SHA512

          9db527c2e26ef691c089f5d1d010298e0f47e2e0420fba03ed18c7c2793b92c5860240b214b5233dddbc150413a2649e9cf4823239b9831930c2804b143ab538

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_ar.dll

          Filesize

          26KB

          MD5

          b4c28669b9d4e56b094af6062f4db065

          SHA1

          4c492c03138c8a796cf0673866892b9e0c2073ec

          SHA256

          7fe494dd265f99f330b153ef69c51c0541016755ca1876788f7f0ede78f9cedb

          SHA512

          35941ab6f2dcf5f60824d172f75f9f7b8b93e65c7bd8bc441fc32e49cbb414a68d65a02e3479b096f728b2a34d3e85dfd868e8bf95ff9b1a57d10adc3da0022a

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_as.dll

          Filesize

          29KB

          MD5

          16b0c8a664626da016a95fb46fdc9c0e

          SHA1

          c674b635cd8927511825847f3d86a5562b4155d7

          SHA256

          b059fc9713d3a41e9a83f0d61f8cce29546d3759def0a7b8e162a13915e51255

          SHA512

          ec39269fbd9e510d10d665c86b8a8161208b74f919e4fd128e365144d71f2b59d3c48c50b8f017b1d30c711ee4f63668f843539957b4643d2a488c9e17290e75

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_az.dll

          Filesize

          29KB

          MD5

          bf510bb9b7639af7da969f77620b480f

          SHA1

          17a6693a5d6aea1f3fa6f34abc46daf558cac645

          SHA256

          2507da222cf6c6dd608da9b569f89f8e11c47b6e16134c767cdc23b7c1f56bd3

          SHA512

          6cebe80005cb7759ee4fd8dd9ca41bdd073c01e969e1ebe03cb07616921e50516974019faacc2f9dcaaccdc0044eaae57a6a94f3a4a4ce044a781cd8091478a7

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_bg.dll

          Filesize

          29KB

          MD5

          4b23c7229eb43740744cfbf48c4242ca

          SHA1

          4938dcf6239e14db53c8f085d3c477905a9986af

          SHA256

          a7527b867ebc222114b679b2ac542cdc46a75f8bc24e5ca8b7ebc17b7a2963c2

          SHA512

          4bd8ed0ecacd3f2c69dcd0789ab8ee10dcfd6144b019dd8858c2234bebddfe42c83037fb8e2f934f3320f58796683bed5ab050ba897ba1fa409b6df60f02ec53

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_bn-IN.dll

          Filesize

          29KB

          MD5

          1e038b27661b303e15a39a55305e86bb

          SHA1

          35b48fe72d50406063f9145fea64c57f205f0084

          SHA256

          385665137d0dfee16ed8ef2da5ce28d826d210eb2bde1fa4ef13dac50e4b5364

          SHA512

          13fcfde6923b38acc2cfa530087d13725a2cabdd2e771d503f4d2f5cff93e8744f142e235dd484244d920d80cb3e7cecbbd731b473f6e509edb39159c51e9465

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_bn.dll

          Filesize

          29KB

          MD5

          9afe531b6472cf9eb66028e9638584bb

          SHA1

          6212292867bd59fe376e79988c07f4db8ad26cdc

          SHA256

          383754fc147dc6ef5f1edd14b60bab6bebf32639dfea718aaa64b2b65ac98812

          SHA512

          352bec509ccd3ad15a274ddd3ccea43b76eaed885b0e7722235abd95aab8fec1c645722765d76865c1b32ed422a10e6666f220e3abcc5a24268ba94c5cc6b8d8

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_bs.dll

          Filesize

          29KB

          MD5

          5e06d311c2e24b94f378c4d3b3deb260

          SHA1

          ef7df63f63746eb197c21694ebb21cfb86c0b2b8

          SHA256

          d2052450e3a3272b302d80af9f2c46b766153267100bc902dcf03a78ec609b65

          SHA512

          8d73b5265735aa19116cf41bb8d2bdacde5b22b286a56af58068f9579b631b044c155e625f6e1fda12e505f621f245faebe126c2557dd2ec873d7d980f8ba552

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

          Filesize

          30KB

          MD5

          afdafc9f56401b662f42cef830d92b38

          SHA1

          b56966370ec07cd676e35d93fad001e0f6b3fb8a

          SHA256

          03d7a1c0d8810df4b908fcc40c8491df0e3ce19db8ee22e6be79d02fd9df8f72

          SHA512

          884f9cd99785ea91c5c8e26200bbf0b010ff278b52c5ac590cb73712321a9cdb645e5448bf4cf62622cdb06543b8de4a8e6956a2f6b6677c0b9befb35589d8b0

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_ca.dll

          Filesize

          30KB

          MD5

          15ee7526536790bf77317975896542f9

          SHA1

          365bc54203b490daa0e24a1c9813d5d99c9de720

          SHA256

          5e2349af6e02da1c5d18f1b3235fc5099229d2d99e1c5cf2713c21472c151f8e

          SHA512

          475fd9c0879c8cbc418a66441e3dc026fca983327a95763eddd1537c1f44fdf272d212c69e1b06aad55d91c68379a2beafb2908659d58a61c740731a7d047406

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_cs.dll

          Filesize

          28KB

          MD5

          8eff4531519a4b768005b9411d4a5f9c

          SHA1

          59b354e3f32f0a0da8755c27b903803994f4aa31

          SHA256

          2e9a230a8b8a7fa437a28e2115ebf01178f3209fc0d61eb90160f49c11a16cb0

          SHA512

          4426ae1e2937e1f6c7364d2f437aeb83d834f9997d28cb1ffb07fe1c448dd954083aa822ff439c886249a387823a23245640a0425dd8c42b75b73912733f11ee

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_cy.dll

          Filesize

          28KB

          MD5

          11b92ae8fe94c784480d465a37935766

          SHA1

          f4ead29d4b20c57bb0e4d16a7488784f61a25972

          SHA256

          571b0cf8b0383e33393b8b8fa79d1632688ffc2bdde794fff62c85f5e1a3f161

          SHA512

          b636dec2e1d48916d0c83d2fe45eb24d826c027455cf22ec78e013166e59fbdb4780ebe69de3ab4b5730dae03652d253890917f53fc835aa73f9f75b01dc4f23

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_da.dll

          Filesize

          29KB

          MD5

          19a7aee0daf68fdc1a24e3228a8bf439

          SHA1

          1fc6ce227a11245787c80f3932e2c311de2d44bb

          SHA256

          409cce12be8b7a86313bd1d9e3c6d9154cf0c5735db61d94852a128a746dab99

          SHA512

          0051119311316d29dbc13ace84c24283aa2eaf1d46459c81ba7b31cc6178b43165618fd7bec17de698b1431ef2b33be179c2c8b1537c1000aadf849e2c888c84

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_de.dll

          Filesize

          31KB

          MD5

          ce66ef1a806c21949b75055f81cac760

          SHA1

          3719e4af114a3c0baceb133d152a02bc6a1fb9f8

          SHA256

          23f5414d554b96db0b93c7dbe27939d294b8061e56c19ab74d59fe9135e81c8f

          SHA512

          04d9575c866ac28db490a291be3da41f884d3ceadbc9b7077776ea7deb1819277aadcf9c9e1b5afede3e90bafbcb00e6ef0840166228d153be7e8d8d53975593

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_el.dll

          Filesize

          31KB

          MD5

          09cf47260852ff7b2c91c65d127b9314

          SHA1

          b3d362f3d08f81bd1b719a1c94b54f5f9c9610da

          SHA256

          eb4344676280f83e6023ddc604ffa42e96eb46e765a216fbc5ecbe49ddb3c920

          SHA512

          114a21296d8e7e054906139102617e6cd6008337a0877053721553cfed10183f54f890c8071b1cea17bd0b2535589af7aafe5bd1d161886ad7363f89919d7300

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_en-GB.dll

          Filesize

          27KB

          MD5

          39dc20ae50a0e2ba9c55dda91256b3cc

          SHA1

          464139f11db3fd6ae77502b183c4b59f581d6c7a

          SHA256

          e1891a155be133e6dd82cab3f9437bb7f047f0f80689ca724ca4d1d90d1fef14

          SHA512

          08b8e19528ff007b904f55872935e0de9e06e7cbcb3f3ed751264e3e20a740b477b55c818bf2b0ed213c4ed9cbaba0c8953c19f427be3e8ab8f50c9c86a74bf4

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_en.dll

          Filesize

          27KB

          MD5

          894b6ea4b49fa390bd70167a75f3ff7b

          SHA1

          4f834ef6567d02f28390d63c8ca9fd3c735b2140

          SHA256

          a8dc2b1e32d8d3d2c321c469eed3329f7661f4fc71d14696f97106b5aa6c532a

          SHA512

          9b4fcbd07dc7f65c34575aaabb7a517198739f7268133f084b101edf99f0b96387f3f0248de1be5252b2466db0bc59036d40e3990d4264bfab89aa01aace7ea6

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_es-419.dll

          Filesize

          29KB

          MD5

          bcafbabbfc8f810220b2ebdbb8a76d19

          SHA1

          58703c8355f996f2ce8ae5fd1ce4dc29318fd414

          SHA256

          7fef9c85b5d7dadf344ff39d82794ed252066cceb2b6531be2a45ee3d84844b7

          SHA512

          b02820c3088ceae9ebf19ede77e3a406483a3dc13c030860d3818e6e8a163e9f54293fd058ec9575c196d12f1465211ab7feff145faf684be6a8cc251d1c0d71

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_es.dll

          Filesize

          29KB

          MD5

          3ccb8eab53a0b4c93507bf2adff6ced5

          SHA1

          25fa2435e97bd0e1cf986a882ce33e68f961c139

          SHA256

          8bcbd325374a8cc5c1c7ea774382515316473c200baec86a65ae21073fae33b0

          SHA512

          4f443ded84d74e150a0be3c32edc734ca01298817933a7b1f0e5c5cd93f26987f051c4c306848301e688b9334d134a12bcdcc0ceabe1fcaaca5c4d307c697bfd

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_et.dll

          Filesize

          28KB

          MD5

          6b03eb5b302e72727977f2431ea7f30d

          SHA1

          ac5cab93d3c28e46f92d2719638c739c680cc452

          SHA256

          b5b51fe000e0e0ce42e8dbaf4b8343a5411e2e99440726c747196a02ed736137

          SHA512

          362e94f79b7726b277cc90c5158d3cc5a0a890bf32e11707f9901233414b3ff22816df78276afa67f0122fc7d6fc2d09dbb1fd8602e3a01f807f93b9423bb463

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_eu.dll

          Filesize

          29KB

          MD5

          ed883bbd9e4b3de4db68e356707f3e67

          SHA1

          e03dde660c15a614442552f8c4d2cc5dd8425fc1

          SHA256

          168eb27052a559561af3ed650bc170eb471e53f05b9065f0e229672d040ae1c7

          SHA512

          ae48fe344b2644380e56a95d98aeb0ffeff7ddf0c914f5d14ef518a4d40bb090fee9a7fd30f7178524bcdec1a2d8fc870b4b40d5d8437e3f2577320262236126

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_fa.dll

          Filesize

          28KB

          MD5

          ba417f44f7564f1aca70cca9166f3f44

          SHA1

          d8f064e25038e0076bffcd1a694b58063b7268d7

          SHA256

          56632098f623cbb58fadddc5c7a889fbc91954f661078501e62517709b8ba703

          SHA512

          c35ba956e92a2298268bb6ee7a753d6b7f94bdec96118c834f028a0fa45f18b67302b0e20a26d948d1720b04461d3074ae30003bb9028790d9d2d63cb80f4467

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_fi.dll

          Filesize

          28KB

          MD5

          7f47c9b9bc9488754579935209291c55

          SHA1

          470e590c6f5263a44b95abbd6d0c158fae326d21

          SHA256

          f0d8c44d909aed479b3e770b556eb3792c0d3ce247defff953a4dd9f7ce4cc75

          SHA512

          6f81ddd06f6a1c796bbf21143737bfeed8f9ca0ace82a4de00ccf79d7288586376439e0564f1cb128e5e585eaba122d406af8c3a6e3969efdadfe0cf65c3ed4b

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_fil.dll

          Filesize

          29KB

          MD5

          20134024ed75deda002dc0839b352f84

          SHA1

          e67bbd13a320d2b4413b283e165385c44a65ea0d

          SHA256

          425e0834cb73365cf78a233a5b139e1897961e5225e9cc92ab365b3efbe30d76

          SHA512

          7dbab9a85d852546ab8c30b3452ab8b200874eb3aac0c862bdaf5c90cc882cec11de536851693f8f115706448e3323c66affbdd7e65257395baf24a0208dc537

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_fr-CA.dll

          Filesize

          30KB

          MD5

          08b6c8f26644370c6dcbee63e4abf884

          SHA1

          e4981733831c4d31715cad1749545d21dc29acf2

          SHA256

          916b52a362fddae79461d1d07ff01fd3bb4f7b8916b263d62572a8ad420946d8

          SHA512

          31f074e494a372a1b961fa9c053b561bae9e52182866a538a734b7589cad550a42b1d88649262a7d265226288084e5ba65e9e1d6d32ffd9292258a9f65e236a5

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_fr.dll

          Filesize

          30KB

          MD5

          cf3ff14718b5e6125b956d6d9e897196

          SHA1

          041de2587e03f6c52dba60e9d2459ce33b263eb9

          SHA256

          d75ece04e40e34beaaf50cce0fef63e52918b5939c9c267fbfd1e6cdcb2a82fa

          SHA512

          551ed975b1afdc75f464bb742c30f239f9d18aa99bf9140ec0620c938629868b38a952041288244b6e2387748c16546a8fe55a664a9903577b8e484856583ac4

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_ga.dll

          Filesize

          29KB

          MD5

          3ca8dfe9af49bdde95188002ebd5f227

          SHA1

          d18d7af889c4d03ea417c09bc56069f3f697c547

          SHA256

          6577e1a60f0fa340dcb70dcf625c877fc9502d122744782708ede0c53ceb56a5

          SHA512

          a61ba9baa6d0116b769c4add55aefc99a360bf85be7986ab099a424ff7a39ccee18d946128e74e39283629b52aa14821f36fe338c0e17de29694fff5138590be

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_gd.dll

          Filesize

          30KB

          MD5

          d64f47e1971f1e9faba211ca984e550c

          SHA1

          6f4de57c6f174dd778788b138a9b25cf4725258b

          SHA256

          75fd1c674a460dcdafbbc1429a4c30c9ac28e58527c6f0797c3706012ec19e00

          SHA512

          722c9f1e5d27d6ac678ca13aa648aa22aaf1121b835fad5209ce3e482471724cf4920390f51c8df2d31c66898def51ad76b0c119f4de831011b56afead2fef7e

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_gl.dll

          Filesize

          29KB

          MD5

          31276d0895baff6976c94c549efbb47d

          SHA1

          4f0fe790cecc28823e6359fb3b78dde13cc17681

          SHA256

          d3bf99db747f3e6a2d541ecab380244c0a33ceef8655383d54e2daff37dc9a88

          SHA512

          413958104046b85772d4a32550ae3a7a3a50eb66dc35966554123bd9dd15fc7a76fa7511f6d2ac666d8a205a9b58042f68e2322189c2b34d372db6b180b70da8

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_gu.dll

          Filesize

          29KB

          MD5

          bb4a1f9374f1c3e0cbc4788a3ce1d4c5

          SHA1

          30667d6dbaa689db9a08b42acacdf68435dac46e

          SHA256

          bdbd0882aba924075c40de48fcbbe951ea6a937c0b85541fd6f1fa5701b8e655

          SHA512

          d0a5260ae123d4698e2f62fdcf97a73aa038b69b200508948185bb5de5f5edb50d6859c9e6e21e84145ceebc144882d0ed5723ce1486e805c26737358ae77504

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_hi.dll

          Filesize

          29KB

          MD5

          274c267b7ee544d36698b2db119a6929

          SHA1

          27377267ddc09060254033c4aa9916a60a254956

          SHA256

          ac843711f010925cfdd60c396baafc3ead08584ed4b1b3df57b0c975cefd039f

          SHA512

          f9073912e9c314efe60f36dd9b2bdb4b1475aadde18e82bec971c447293a4f8dce46abe625bb9cec4dc48280fce3cf3d8175054b70b4e440e89a8c072f4a505a

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_hr.dll

          Filesize

          29KB

          MD5

          ca9abf92edc001d3c0cea4c926bd004c

          SHA1

          740513a325a5c15376f4b1aea402e9c54155ab33

          SHA256

          d6d9e064773b121fbf224252ef6c7d64f239d6b5013c119738a8240cc047e346

          SHA512

          7171143ee05b0e03bc936fbd98d3a37c3763bc244ffd8ae85e3229b85e13ec6262c3111b93b3a067f3d82f5fa6b6f691438c0e148efd14606cdf5a850e474a7c

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_hu.dll

          Filesize

          29KB

          MD5

          df2764d7bf9bbc6d4e96301c928566b5

          SHA1

          1f9adfed63fff6cd144515e8a7fbf8c4131d2f65

          SHA256

          3dcf3b4acc066674418e30239406abf59b85f9a00ba2a0aa7ca33036caee6514

          SHA512

          8c1eec6d813fe2266f0e03ce72f504f355f720e0112527fd411abd5e7fea05dd4bfa3ee9a878c882c16e8cd30224727eabc5ab38bd85cf146b21547ade988391

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_id.dll

          Filesize

          28KB

          MD5

          c80c6530280315158443cd04f89e9169

          SHA1

          fb87a9ff3696f0acceee6c8f1e4fb40795a8ae7d

          SHA256

          52957587efb4d995597541656f38e0edcd4545acfd92e3b81cc72578839021de

          SHA512

          bee22709e362ade03cf385c9b09d321923cc17a9e7c227fef7717da7405ea7bcc63e6f18b5e3e18e9dc19d5b0d9d4cb32c8548d9f16803959eb13b1189df9815

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_is.dll

          Filesize

          28KB

          MD5

          28064f47523b575c20fc85733cddf487

          SHA1

          0c5583888be256c8e09a396e333ad158b5f87553

          SHA256

          0752855a2e2a69e0f969af6c31102db513dbc390583f07d5df60746721ada58a

          SHA512

          d96656335024e0228a18148de4d27f354fdc90b62f977042ac20199714ef50bad271a83547d6c6823ec03422a9b598828fdc3b0f1ae81c760a57a2d1f2a543b7

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_it.dll

          Filesize

          30KB

          MD5

          0da1fde56fc0bf63e17a891e99f559f1

          SHA1

          131d18d7329be3ff21c78a3921b88e910a3d5a68

          SHA256

          ba936fcce39c889a3cb41569f18019d99429a13e7dbd909d9d26e540ea650dec

          SHA512

          67aa088ea8c01b11874537ae59c150645b61072e4f2134719e833ca0c4c3cab835cb9c51bff97582280870227d99cfb72f3a0d2069f2a9a86a7f7dbaf29ad2d2

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_iw.dll

          Filesize

          25KB

          MD5

          d92167a825c73bd6246483bfa1787c8c

          SHA1

          0a96d89226f1e694275922e5e2640bca3d7e7020

          SHA256

          d477fce0f7fbbe9cf86dbfb724e28c617c8c7c5bea664974593fbf0c032e8019

          SHA512

          12401ac374d3050f9540a3df6fae71ff8466ed3df2bf007b52eaddfea0d549601b5756477c141fd596bd19367ad30a607160957a8ad1818ff34e6da4125e530e

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_ja.dll

          Filesize

          24KB

          MD5

          0ff69dde83bf61a768bc63870d687747

          SHA1

          622714cb8eac68b79021800f28f5874aa23176b5

          SHA256

          3a3a4d24498f0f533a5f5e4f1364e7e2a1f348dac95f649951131185c64d7bc7

          SHA512

          e1300b6f2dd5df3385c06fb43de5aa246f3f1da942e26b86023663e07b12104f0e74b2749d4ef2dd60cabfc8eadfe5f131a8bb5ba8fffd6374f9cd4635b4bc53

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_ka.dll

          Filesize

          29KB

          MD5

          67eb1378381ad4d1a450bd26fe51f5e3

          SHA1

          ae0655d07a4d0b049ed258de646199f9004963ce

          SHA256

          b2ecba67a708b9fc75fc4574b72218f64517dea1aeb5ac26400ac554903cccf9

          SHA512

          1da5356bee3e18f9033b81927368eefb8f7a0742f7f02be9ddf0f3f309d9d4f1ceeb640acac341e504d54c0d0939f1da2bac27645adf404ed2ac48a2846a919d

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_kk.dll

          Filesize

          28KB

          MD5

          d9b956ec540d8b1e528d88d8c5e5fdaa

          SHA1

          bb967aeba493d9ac0b3889f7bbf9136614080331

          SHA256

          cf008a24b53f2d62516a2944b77fd9be17a4778c0ba1b83a09ef7e83c3cf3901

          SHA512

          d6d6171c95c07ddef12bc40a5fda756ed3870a06ff2434bdd7abe02407720bff01fab5eb1bafeb7d4b9b661fc364c39de4a9eab01ef39c6bdce6de58ce4c1a06

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_km.dll

          Filesize

          27KB

          MD5

          5ef433fe15a877e530ba0a044486f200

          SHA1

          db1deb37392e001353f5a098d8686a17fc156b40

          SHA256

          896549adb3d1a38d95e743490cf6f551cac876fa1afc4b07f8eb30ad4d853502

          SHA512

          97839850a49a09cbc416ba1e8e9570adfcacbfccb70903cf597ad8781c7c3d11fd07e2598dccb7e88da7617e44ca99c62dfb3404c0c2a467641d1a6dcd7e8e64

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_kn.dll

          Filesize

          29KB

          MD5

          1ee9fe48904cb43a9147bf16823b16f1

          SHA1

          19fd9c0a2a1d919340eefca7956bd84df467b737

          SHA256

          a65da5bd18d6ac28c45cd11f56f8b868af98e42a69def6199d61235f6fa3d71d

          SHA512

          b556dff94243eeeb8dfe2c185c67ba7359877b8c0161f8fbe9a37a7e7591b0c8242a0be09255b616ac4f5560a728f1780cf6971c826ee6214a1b28c16551bffc

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_ko.dll

          Filesize

          23KB

          MD5

          6c3abddca78cb3ba9f724bad9fed6165

          SHA1

          3114daf9295215bbeed0f4bb4e282b46ec1c74ae

          SHA256

          d47e586aacfa638aab5d681d8b4ce0b42f9d698e213817554b9d42441191d548

          SHA512

          b37b7c8d7d24ead85389ce445536ef4a68c43e2a55508801ab00e9bee2c2ef428d07eb30b62228d647508dc4f6b0d78b1b8edc25052eff0ec5a9ec87fdbcba1d

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_kok.dll

          Filesize

          28KB

          MD5

          f97d285a3ba35b1395d9868e15bce4f1

          SHA1

          154dfcb8646bdb02b618dddf8a0dc1cbdab2269a

          SHA256

          33506ad10fafd8a767afcdd93cab2d91999b4e6468771379d944ff4758c2f5e4

          SHA512

          bae3152e85cc5e8f96299e7d45be8a85e47ea1119fd4d8d2bcb038ce293dab6820e35bcfffc03c9596b95e716e40711c47682f0c71e308755dc71b4c20c57628

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_lb.dll

          Filesize

          30KB

          MD5

          9c7c3dec8769f8b33aab63a15f642d81

          SHA1

          41ab17373c388d005b6d39c3ffc9fd5aac1a75cb

          SHA256

          c088700c358cfad6bd692233e450b8f4836a30a457c7b047e67681c10aecf2f7

          SHA512

          86923405fdcb2ebbf9a2dff24847d55bf1cf39550f475b1268e7edf279269e317c09b638b06e29f4d30ba59fd606f4ab5787f7d09da5ae3c5572ad41f3b3fac8

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_lo.dll

          Filesize

          27KB

          MD5

          b0973b4e4407ea116a723bd7c39c1d45

          SHA1

          011e9126cf2fd3db3f0f810dc1d8e60891ef0695

          SHA256

          36e1ea95cd9663137ae49504980e00fbb311023c8f5f6f40f3cfe14a14ff183a

          SHA512

          574eb8426f774a7ccf860b4f0e324a2cc32581c9aecb834aa25c5f62946d15ef781a9f32feea8cd44e352d4878f3f6b8f097635bddb9df3bf2a443fecd0946e5

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_lt.dll

          Filesize

          28KB

          MD5

          883f3e1c963322852aa6ce7177ba11fd

          SHA1

          3da37835cb54a847e3fa2edec45c4589e2c31561

          SHA256

          c3e3bd953b1035bcb34db9077c41643a503aafeecf99afbc92c9e4326bc6fea5

          SHA512

          52e7eae669ce211be72ed62cddd43f926c8d581a28a5efc167d1bb9c7f132f40a000cec02c91cd81604ca9f1cbb61952a9da8d09044703a49309a4faf2ff2f25

        • C:\Program Files (x86)\Microsoft\Temp\EUFB29.tmp\msedgeupdateres_lv.dll

          Filesize

          29KB

          MD5

          0edaf7aa97694524c60369256b17c9f8

          SHA1

          48a81d2c180b9dbb970dfc381b204c3e0bf11532

          SHA256

          74b7ff57e79ee2685709678d55a4b4b414f3fdf77ab1783c0ded0196a126c0fe

          SHA512

          de1ec10ba23b7f76dae78b6a98a3eee6df1eea424aa9a4800b70ee7b185e5c6a0dd30d0dc950bf7b37a9c07fd7614652258cdccd64413c49647b42351e02e90e

        • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

          Filesize

          15KB

          MD5

          ef7514c031a34ab9029c934d2776a3d4

          SHA1

          3adf69ff0c2ccf48c2e5f7f70218b7e3b6e3c4a0

          SHA256

          ba3a12294a09b0de61fe176bee28c200ed64112b040cbd759392143450da0be2

          SHA512

          b9b150bf17e6ae0b822a73a7afacd99874396fc0b1818c2a52de493c097703f9b88c1a659241b07a1dd8024376c91fc7120dfe95dde4efc315ab469264320b79

        • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

          Filesize

          1.6MB

          MD5

          431a51d6443439e7c3063c36e18e87d6

          SHA1

          5d704eb554c78f13b7a07c90e14d65f74b590e3a

          SHA256

          726732c59f91424e8fb9280c1e773e1db72c8607ad110113bc62c67c452154a6

          SHA512

          495d60ad05d1fadb2abd827d778fe94132e5bfc2ae5355e03f2551cd7a879acf50cc0526990e4ccde93bf4eff65f07953035b93cc435f743001f21b017cbfdfd

        • C:\Users\Admin\AppData\Local\Temp\luna\Luna.dll

          Filesize

          1.4MB

          MD5

          d3418af778a91c134b8361c10fd16be4

          SHA1

          1654ab09bcc1ef4d168088518adc165e0c6469a4

          SHA256

          d21975e541c3838d2f83bf6faf360d7a7417da2106a610489a768b382ad3b91a

          SHA512

          128e8741bbe08bb90185d0c1c352572757e2848773ec39f21c8744ce4eb0bf9095ade326174f9164e94f568a00714be8bedc197f36a46c6fb16a880f2c6f9c8d

        • C:\Users\Admin\AppData\Local\Temp\luna\Luna.exe

          Filesize

          16.1MB

          MD5

          5c558b0f23bac737dda7334f514f9a4b

          SHA1

          80646ed48d077fc6d7b4952124465d05cee00b34

          SHA256

          ffa97d6728aec4883a8dd36204d14936ba96f0ca1270fa56421e3c8e8c663e12

          SHA512

          4b35f193fbf6c0135f2ae7f5a9ca7132098e6e3bf0708e0887cdfaf662aa4aae27e1ed0e82f76f00a6e68c11e625d6b83e9e5a95ea94b07ae606fa6c287cfa8e

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Crashpad\settings.dat

          Filesize

          280B

          MD5

          9a05e3814a3af2637ebc132ee371891c

          SHA1

          0b6547ccfc006d7947d2f1b19fb0aa7b5565f08c

          SHA256

          6202f2e6721743c4cf0519c118981260ae7c235f6426f6792eac16b15e638c11

          SHA512

          35adf34f9093c932fab97961948bdd91af340d4f5b172d91b514f77fcade4c96a04eaf8aa0e6c2e2a53b181494b7170fd055210f2d6a2e2b6fb3caf059f57ba3

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index

          Filesize

          288B

          MD5

          234ac97db865dec612393a7a0634fc29

          SHA1

          f2566d194a5d1325ef333436fbf4db1ee24d9ea4

          SHA256

          2a24ec9ec775e9f132fef3fd1d058bf3c4ce60ccc4fbc893457c191337a60d80

          SHA512

          b7649f34b7d8de06baab3436433d89dc54f63be2916add12314827d8aaf61249f4436f94c8d55ab8418b4a23d48d7d18951a316d28d0cdbb3b8bef17e7f42850

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59fa16.TMP

          Filesize

          48B

          MD5

          30cb5f21ab71981dce9293ed39747c60

          SHA1

          a1858e0adef7810bf10c4fef71b937919723e1df

          SHA256

          8e5567b03582bebefdd54ef6068f98468ba1331ae5f18851801a1938eb2560af

          SHA512

          e754c99b6e1ace0c987d63402e5bbcc5f5a9afaa198983b1ebee9f9a4158285ddc6016ce7aa1e05a7d0681a32c3ef37b57f88c26483890380d45d0a50e91c011

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Default\DawnWebGPUCache\data_0

          Filesize

          8KB

          MD5

          cf89d16bb9107c631daabf0c0ee58efb

          SHA1

          3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

          SHA256

          d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

          SHA512

          8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Default\DawnWebGPUCache\data_1

          Filesize

          264KB

          MD5

          d0d388f3865d0523e451d6ba0be34cc4

          SHA1

          8571c6a52aacc2747c048e3419e5657b74612995

          SHA256

          902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

          SHA512

          376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Default\DawnWebGPUCache\data_2

          Filesize

          8KB

          MD5

          0962291d6d367570bee5454721c17e11

          SHA1

          59d10a893ef321a706a9255176761366115bedcb

          SHA256

          ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

          SHA512

          f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Default\DawnWebGPUCache\data_3

          Filesize

          8KB

          MD5

          41876349cb12d6db992f1309f22df3f0

          SHA1

          5cf26b3420fc0302cd0a71e8d029739b8765be27

          SHA256

          e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

          SHA512

          e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Default\Network\SCT Auditing Pending Reports

          Filesize

          2B

          MD5

          d751713988987e9331980363e24189ce

          SHA1

          97d170e1550eee4afc0af065b78cda302a97674c

          SHA256

          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

          SHA512

          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Default\shared_proto_db\CURRENT

          Filesize

          16B

          MD5

          46295cac801e5d4857d09837238a6394

          SHA1

          44e0fa1b517dbf802b18faf0785eeea6ac51594b

          SHA256

          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

          SHA512

          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001

          Filesize

          41B

          MD5

          5af87dfd673ba2115e2fcf5cfdb727ab

          SHA1

          d5b5bbf396dc291274584ef71f444f420b6056f1

          SHA256

          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

          SHA512

          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Local State

          Filesize

          1KB

          MD5

          22f6efb6ec863b388adcb6daaa8ac90f

          SHA1

          8cf77c1ca86bd5c1969564f658a9ba526868ff94

          SHA256

          ceffe110eaa1cf1db256fb430800db252621e47a58873fb5d1032b9acc62aba9

          SHA512

          912ceaeddc439a189b49329e7aacd011e35c4487c04d3c87758a2a0c3548d5d9572d2327595dd45ebaf8740606dadc8b25bb653511f6fc03559a42813270d2e9

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Local State

          Filesize

          2KB

          MD5

          6ef0e04252c713a0fa9af2e91f7c51a3

          SHA1

          a45fb487e9a93bc1852a6ca07a8b49284e4c8281

          SHA256

          15aa4e026f9ae36469560a7fa4db7647ce9c26b4b28a771060ae76c36556bc9c

          SHA512

          8d5e9aa3c01a9ca7a0b954564b1a6b4770b84ad484c2901e6bfa3dbd244a012c0b1ac68640e884f78ae77444d1464255d289f9f2e0fd913f937a3b086f9885bd

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Local State

          Filesize

          16KB

          MD5

          427f627a392ad7016903951cf270389f

          SHA1

          c622a173bf81562cf8960dcbae7c892d7551fede

          SHA256

          2a3296698e220d65be7627a3f604d26a1c0d42dea36488945bd502043e02f7ac

          SHA512

          53ac0e50e7c99205525d4587dac1d44452a27c17f1b10b2d78dda028879cf7a9a1aaf606590c948011a031cfd3f42cb1378362ffb12cf2b73a218616090417f7

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Local State

          Filesize

          3KB

          MD5

          2eaee9b80c72f87a29e822eff3cc3eb8

          SHA1

          8a8601bbd3ab0108d3a719452efc50020840919c

          SHA256

          f67051505bbb7babcc883df43bf7f10de68b3fca0886f618c740755cc5ba5677

          SHA512

          b9a17aabd3fae39af618cefbf6896f2f8860371350aeabf1d401fbd3283340542fbb3c2787a6dbc7e1c6e327731f3cf4e3879d94a9d0770754e50c0fa1325f7b

        • C:\Users\Admin\AppData\Roaming\Luna.exe\EBWebView\Local State~RFe598c87.TMP

          Filesize

          1KB

          MD5

          089fcf71b34dc4ddf7b1d3c5cd571a48

          SHA1

          22597a8158a7e02d6cb87d38f3ccc43ddb032fd1

          SHA256

          35e5456201cdea6434b6e9f52822758dbccaa6afeeb7bdfb509141d51ef63528

          SHA512

          70569633b1c871a3a5252b4d868b789bc2ee2620a975f3c7eccf8ddec8c29c96f302148d49f4d4ad94d4eaed1f38d5259854406e6becc9e20331039d684a641f

        • C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

          Filesize

          280B

          MD5

          b34e7dd0ceeb74bf4810fec216518d9d

          SHA1

          81f22beba4d4d298109b7417867830c4a2bdd3ef

          SHA256

          1142b43aa70b5953bb5dcc1a350d0bf6ead01fbb8dd2f690a3421e332627c7f9

          SHA512

          59b43e155eef0f4247805631df84f6e19733e04cadb16edad39ad2717bcdb66f04095f3d8ffe2c832125cf23c102082b7d192c5220f3fe8089cc5cf04b955522

        • memory/1156-291-0x00007FF897730000-0x00007FF897731000-memory.dmp

          Filesize

          4KB

        • memory/4912-394-0x00007FF897730000-0x00007FF897731000-memory.dmp

          Filesize

          4KB

        • memory/5020-262-0x00000000000A0000-0x00000000000D5000-memory.dmp

          Filesize

          212KB

        • memory/5020-233-0x0000000074EB0000-0x00000000750D6000-memory.dmp

          Filesize

          2.1MB

        • memory/5020-204-0x0000000074EB0000-0x00000000750D6000-memory.dmp

          Filesize

          2.1MB

        • memory/5020-203-0x00000000000A0000-0x00000000000D5000-memory.dmp

          Filesize

          212KB