hxxps://www[.]mediafire[.]com/file/o5nth1568oz727t/Cryptic[.]zip/file

Analysis

max time kernel
259s
max time network
256s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
16/01/2025, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/o5nth1568oz727t/Cryptic.zip/file

Score

8^/10

microsoft defense_evasion discovery persistence phishing privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3454535599-122122096-1812617400-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3454535599-122122096-1812617400-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3454535599-122122096-1812617400-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3454535599-122122096-1812617400-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 23 IoCs

pid	Process
5424	MicrosoftEdgeWebView2RuntimeInstallerX64.exe
6140	MicrosoftEdgeUpdate.exe
3868	MicrosoftEdgeUpdate.exe
2760	MicrosoftEdgeUpdate.exe
4716	MicrosoftEdgeUpdateComRegisterShell64.exe
2092	MicrosoftEdgeUpdateComRegisterShell64.exe
60	MicrosoftEdgeUpdateComRegisterShell64.exe
5468	MicrosoftEdgeUpdate.exe
5564	MicrosoftEdgeUpdate.exe
3088	MicrosoftEdgeUpdate.exe
3100	MicrosoftEdgeUpdate.exe
3676	MicrosoftEdgeWebview_X64_131.0.2903.146.exe
5796	setup.exe
5844	setup.exe
5256	MicrosoftEdgeUpdate.exe
5536	msedgewebview2.exe
5676	msedgewebview2.exe
216	msedgewebview2.exe
5964	msedgewebview2.exe
2992	msedgewebview2.exe
5640	msedgewebview2.exe
3048	msedgewebview2.exe
5164	msedgewebview2.exe

Loads dropped DLL 40 IoCs

pid	Process
6140	MicrosoftEdgeUpdate.exe
3868	MicrosoftEdgeUpdate.exe
2760	MicrosoftEdgeUpdate.exe
4716	MicrosoftEdgeUpdateComRegisterShell64.exe
2760	MicrosoftEdgeUpdate.exe
2092	MicrosoftEdgeUpdateComRegisterShell64.exe
2760	MicrosoftEdgeUpdate.exe
60	MicrosoftEdgeUpdateComRegisterShell64.exe
2760	MicrosoftEdgeUpdate.exe
5468	MicrosoftEdgeUpdate.exe
5564	MicrosoftEdgeUpdate.exe
3088	MicrosoftEdgeUpdate.exe
3088	MicrosoftEdgeUpdate.exe
5564	MicrosoftEdgeUpdate.exe
3100	MicrosoftEdgeUpdate.exe
5256	MicrosoftEdgeUpdate.exe
3868	Cryptic.exe
5536	msedgewebview2.exe
5676	msedgewebview2.exe
5536	msedgewebview2.exe
5536	msedgewebview2.exe
5536	msedgewebview2.exe
216	msedgewebview2.exe
5964	msedgewebview2.exe
2992	msedgewebview2.exe
2992	msedgewebview2.exe
5964	msedgewebview2.exe
216	msedgewebview2.exe
5640	msedgewebview2.exe
216	msedgewebview2.exe
216	msedgewebview2.exe
216	msedgewebview2.exe
5640	msedgewebview2.exe
216	msedgewebview2.exe
5640	msedgewebview2.exe
5536	msedgewebview2.exe
3048	msedgewebview2.exe
3048	msedgewebview2.exe
5164	msedgewebview2.exe
5164	msedgewebview2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
454	raw.githubusercontent.com
455	raw.githubusercontent.com
456	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\msedge.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\PdfPreview\PdfPreviewHandler.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Trust Protection Lists\Mu\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\icudtl.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Locales\kok.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\identity_proxy\canary.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\edge_game_assist\EdgeGameAssist.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\EBWebView\x86\EmbeddedBrowserWebView.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\delegatedWebFeatures.sccd	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_ca.dll	MicrosoftEdgeWebView2RuntimeInstallerX64.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Trust Protection Lists\Sigma\LICENSE	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Trust Protection Lists\Mu\Other	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Locales\uk.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_mt.dll	MicrosoftEdgeWebView2RuntimeInstallerX64.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\identity_proxy\win11\identity_helper.Sparse.Internal.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\VisualElements\SmallLogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\Locales\kk.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\oneds.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Trust Protection Lists\Mu\CompatExceptions	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Locales\fil.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Locales\pa.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\edge_feedback\mf_trace.wprp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\Locales\ja.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\Locales\sr-Latn-RS.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\identity_proxy\win11\identity_helper.Sparse.Dev.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_lt.dll	MicrosoftEdgeWebView2RuntimeInstallerX64.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_nl.dll	MicrosoftEdgeWebView2RuntimeInstallerX64.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Locales\fi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\telclient.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\VisualElements\Logo.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\edge_game_assist\VERSION	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Locales\sk.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\show_third_party_software_licenses.bat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Trust Protection Lists\Mu\TransparentAdvertisers	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\edge_game_assist\VERSION	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\Trust Protection Lists\Sigma\Fingerprinting	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\Locales\nn.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\edge_game_assist\VERSION	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_ko.dll	MicrosoftEdgeWebView2RuntimeInstallerX64.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\Offline\{03369F1C-F55B-4C60-BAE1-CE25D5B66980}\OfflineManifest.gup	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\identity_helper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\webview2_integration.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\MicrosoftEdge_X64_131.0.2903.146.exe.{0D50BFEC-CD6A-4F9A-964C-C7416E3ACB10}	MicrosoftEdgeWebView2RuntimeInstallerX64.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Locales\pa.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\v8_context_snapshot.bin	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Locales\tr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_ta.dll	MicrosoftEdgeWebView2RuntimeInstallerX64.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_zh-CN.dll	MicrosoftEdgeWebView2RuntimeInstallerX64.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\msedge_proxy.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Edge.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Trust Protection Lists\Mu\Analytics	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\identity_proxy\win10\identity_helper.Sparse.Beta.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\Trust Protection Lists\Mu\Fingerprinting	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_ml.dll	MicrosoftEdgeWebView2RuntimeInstallerX64.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_sv.dll	MicrosoftEdgeWebView2RuntimeInstallerX64.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\microsoft_shell_integration.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Locales\af.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Locales\en-GB.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\Locales\en-US.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\AdSelectionAttestationsPreloaded\manifest.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\oneauth.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\msedgewebview2.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.146\Trust Protection Lists\manifest.json	setup.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_661349720\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_661349720\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_661349720\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_661349720\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_5116830\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_5116830\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_661349720\crs.pb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_5116830\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\MicrosoftEdgeWebView2RuntimeInstallerX64.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebView2RuntimeInstallerX64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5468	MicrosoftEdgeUpdate.exe
3100	MicrosoftEdgeUpdate.exe
5256	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133815202462466513"	msedgewebview2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.43\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{41E1FADF-C62D-4DF4-A0A2-A3BEB272D8AF}\InprocHandler32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.43\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\CLSID\ = "{B5977F34-9264-4AC3-9B31-1224827FF6E8}"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2"	MicrosoftEdgeUpdateComRegisterShell64.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Cryptic.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MicrosoftEdgeWebView2RuntimeInstallerX64.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6140	MicrosoftEdgeUpdate.exe
6140	MicrosoftEdgeUpdate.exe
6140	MicrosoftEdgeUpdate.exe
6140	MicrosoftEdgeUpdate.exe
6140	MicrosoftEdgeUpdate.exe
6140	MicrosoftEdgeUpdate.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
3868	Cryptic.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
3868	Cryptic.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
3868	Cryptic.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
3868	Cryptic.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
3868	Cryptic.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
3868	Cryptic.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
3868	Cryptic.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
3868	Cryptic.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
3868	Cryptic.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
3868	Cryptic.exe
2564	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5536	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	firefox.exe
Token: SeDebugPrivilege	2884	firefox.exe
Token: SeDebugPrivilege	2884	firefox.exe
Token: SeDebugPrivilege	6140	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2884	firefox.exe
Token: SeDebugPrivilege	2884	firefox.exe
Token: SeDebugPrivilege	2884	firefox.exe
Token: SeDebugPrivilege	6140	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3868	Cryptic.exe
Token: SeDebugPrivilege	2564	taskmgr.exe
Token: SeSystemProfilePrivilege	2564	taskmgr.exe
Token: SeCreateGlobalPrivilege	2564	taskmgr.exe
Token: SeDebugPrivilege	2884	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe
2564	taskmgr.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe
2884	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 2884	4248	firefox.exe	81
PID 4248 wrote to memory of 2884	4248	firefox.exe	81
PID 4248 wrote to memory of 2884	4248	firefox.exe	81
PID 4248 wrote to memory of 2884	4248	firefox.exe	81
PID 4248 wrote to memory of 2884	4248	firefox.exe	81
PID 4248 wrote to memory of 2884	4248	firefox.exe	81
PID 4248 wrote to memory of 2884	4248	firefox.exe	81
PID 4248 wrote to memory of 2884	4248	firefox.exe	81
PID 4248 wrote to memory of 2884	4248	firefox.exe	81
PID 4248 wrote to memory of 2884	4248	firefox.exe	81
PID 4248 wrote to memory of 2884	4248	firefox.exe	81
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 4324	2884	firefox.exe	82
PID 2884 wrote to memory of 3384	2884	firefox.exe	83
PID 2884 wrote to memory of 3384	2884	firefox.exe	83
PID 2884 wrote to memory of 3384	2884	firefox.exe	83
PID 2884 wrote to memory of 3384	2884	firefox.exe	83
PID 2884 wrote to memory of 3384	2884	firefox.exe	83
PID 2884 wrote to memory of 3384	2884	firefox.exe	83
PID 2884 wrote to memory of 3384	2884	firefox.exe	83
PID 2884 wrote to memory of 3384	2884	firefox.exe	83

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.mediafire.com/file/o5nth1568oz727t/Cryptic.zip/file"
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.mediafire.com/file/o5nth1568oz727t/Cryptic.zip/file
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1896 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 27137 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {efb47762-9d08-4d33-b6dc-39dd6e48d88d} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" gpu
    3⤵
    PID:4324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 28057 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {244c08a8-17bb-4a3c-9370-f6c19610824e} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" socket
    3⤵
    PID:3384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1504 -childID 1 -isForBrowser -prefsHandle 2896 -prefMapHandle 3260 -prefsLen 22746 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c87e716b-7c0f-4164-929a-cda5e1844763} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" tab
    3⤵
    PID:5064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3684 -childID 2 -isForBrowser -prefsHandle 3668 -prefMapHandle 3664 -prefsLen 32547 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9b68d04-ca4f-451e-8407-1442c29e6ae1} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" tab
    3⤵
    PID:4284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4552 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4596 -prefMapHandle 4592 -prefsLen 32547 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4492efd0-b860-4bf2-836f-9ec9a17ede70} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" utility
    3⤵
    - Checks processor information in registry
    PID:1088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5376 -childID 3 -isForBrowser -prefsHandle 5368 -prefMapHandle 5360 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {549e3a35-7c49-49ba-8ef9-a9e017657abd} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" tab
    3⤵
    PID:1872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5536 -childID 4 -isForBrowser -prefsHandle 5616 -prefMapHandle 5612 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04d53dd4-9ae6-45bd-86da-881157a8f63a} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" tab
    3⤵
    PID:1672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5804 -childID 5 -isForBrowser -prefsHandle 5512 -prefMapHandle 5412 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c52e53e8-76d8-4b16-9784-cef4b49a6543} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" tab
    3⤵
    PID:3120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6204 -childID 6 -isForBrowser -prefsHandle 6220 -prefMapHandle 6208 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a760e7d8-419f-46b3-9056-02f00ae3cda5} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" tab
    3⤵
    PID:4436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6400 -childID 7 -isForBrowser -prefsHandle 6236 -prefMapHandle 6204 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7be7ff3d-b3ca-4366-873d-c808dfc6ed06} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" tab
    3⤵
    PID:4560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3808 -childID 8 -isForBrowser -prefsHandle 3828 -prefMapHandle 3592 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7101cacb-0a10-4b00-9203-d092e363e933} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" tab
    3⤵
    PID:64
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6768 -childID 9 -isForBrowser -prefsHandle 6760 -prefMapHandle 6756 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {314391ed-4464-456b-b68c-e6a0c9442ddb} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" tab
    3⤵
    PID:1384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6928 -childID 10 -isForBrowser -prefsHandle 6780 -prefMapHandle 6792 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7a6f4b3-10d6-42c8-827b-683ba134aa7b} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" tab
    3⤵
    PID:1296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6136 -childID 11 -isForBrowser -prefsHandle 6000 -prefMapHandle 3568 -prefsLen 33956 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e67e333-79c9-494f-9ae9-a5760bafede7} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" tab
    3⤵
    PID:5296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 12 -isForBrowser -prefsHandle 6324 -prefMapHandle 7564 -prefsLen 28148 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ced5d92-60ca-47d7-8e73-a00292182a18} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" tab
    3⤵
    PID:5668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6564 -childID 13 -isForBrowser -prefsHandle 6636 -prefMapHandle 6528 -prefsLen 28148 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac23f1cb-6870-4da4-bdd7-0891adf7bca2} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" tab
    3⤵
    PID:6128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7720 -childID 14 -isForBrowser -prefsHandle 5268 -prefMapHandle 3820 -prefsLen 28148 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db0c5c75-90eb-4dcd-825b-8a393d696fda} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" tab
    3⤵
    PID:2636
- - C:\Users\Admin\Downloads\MicrosoftEdgeWebView2RuntimeInstallerX64.exe
    "C:\Users\Admin\Downloads\MicrosoftEdgeWebView2RuntimeInstallerX64.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:5424
  - - C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6140
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3868
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2760
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4716
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2092
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:60
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTg2MEFGMjMtMTkxRC00NDgzLTg1NDEtMUZEMzgxOEM2RkZFfSIgdXNlcmlkPSJ7QzcxQUEyMTQtRkE1OC00NUMzLUJBMDYtMzEyQzhCMzg2NjU5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezc1MkQyNDk5LTI4NEMtNDBDOS04OTkzLUZCOTlGRUU4NjdENH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDQuNDUyOSIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjEyNSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjQzIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1ODIyOTE0MjkxIiBpbnN0YWxsX3RpbWVfbXM9IjcyMyIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5468
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers" /installsource offline /sessionid "{A860AF23-191D-4483-8541-1FD3818C6FFE}" /offlinedir "{03369F1C-F55B-4C60-BAE1-CE25D5B66980}"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5564

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:192

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
PID:3088
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTg2MEFGMjMtMTkxRC00NDgzLTg1NDEtMUZEMzgxOEM2RkZFfSIgdXNlcmlkPSJ7QzcxQUEyMTQtRkE1OC00NUMzLUJBMDYtMzEyQzhCMzg2NjU5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RTI4QUNDQjktMURDMy00MkIzLTgwQ0YtNzJFMTExMTk2M0M3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMyIgaW5zdGFsbGRhdGV0aW1lPSIxNzM2Nzc2NTc4IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODEyNDkxNTk5MzYwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTgyNzA1NDI3NyIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3100
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BF6F616B-91AC-40A7-9403-CB3A7F725EE4}\MicrosoftEdgeWebview_X64_131.0.2903.146.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BF6F616B-91AC-40A7-9403-CB3A7F725EE4}\MicrosoftEdgeWebview_X64_131.0.2903.146.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:3676
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BF6F616B-91AC-40A7-9403-CB3A7F725EE4}\EDGEMITMP_A2977.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BF6F616B-91AC-40A7-9403-CB3A7F725EE4}\EDGEMITMP_A2977.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BF6F616B-91AC-40A7-9403-CB3A7F725EE4}\MicrosoftEdgeWebview_X64_131.0.2903.146.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:5796
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BF6F616B-91AC-40A7-9403-CB3A7F725EE4}\EDGEMITMP_A2977.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BF6F616B-91AC-40A7-9403-CB3A7F725EE4}\EDGEMITMP_A2977.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.265 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BF6F616B-91AC-40A7-9403-CB3A7F725EE4}\EDGEMITMP_A2977.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.146 --initial-client-data=0x1a4,0x244,0x248,0x190,0x24c,0x7ff652222918,0x7ff652222924,0x7ff652222930
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:5844
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTg2MEFGMjMtMTkxRC00NDgzLTg1NDEtMUZEMzgxOEM2RkZFfSIgdXNlcmlkPSJ7QzcxQUEyMTQtRkE1OC00NUMzLUJBMDYtMzEyQzhCMzg2NjU5fSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7MDE3QzBBNzMtNEQxQy00RUM2LTk1MTktOTMyNzNGNzhDREJCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMzEuMC4yOTAzLjE0NiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTgzMDIxNDE3NCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU4MzAyNjQyMDQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1ODM5Njk0MTczIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTg1NDUyNDIzMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjExNzU5MTk0MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlZD0iMTc2NzU0MjU2IiB0b3RhbD0iMTc2NzU0MjU2IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMSIgaW5zdGFsbF90aW1lX21zPSIyNjMwNCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5256

C:\Users\Admin\Desktop\Cryptic\Cryptic.exe
"C:\Users\Admin\Desktop\Cryptic\Cryptic.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=3868.1360.8995473753084284601
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - System policy modification
  PID:5536
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.265 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=131.0.2903.146 --initial-client-data=0x1a0,0x1a4,0x1a8,0x180,0x1b0,0x7ffd59556070,0x7ffd5955607c,0x7ffd59556088
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1840,i,5233929841856917436,15303783270011986391,262144 --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2024,i,5233929841856917436,15303783270011986391,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5964
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2176,i,5233929841856917436,15303783270011986391,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3624,i,5233929841856917436,15303783270011986391,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4868,i,5233929841856917436,15303783270011986391,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3048
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=800,i,5233929841856917436,15303783270011986391,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5164

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
182KB

MD5
8f7c44e937ecc243d05eab5bb218440b

SHA1
57cd89be48efe4cad975044315916cf5060bc096

SHA256
bc3cdd57a892ce1841787061e23e526ad46575460cd66c1dc6dcf0f811563d59

SHA512
9f0020b81d1945fea12efe1a0a5e59caae4a01432429e065e35c73b15db873253094b2ff1f8903a348446dfc9c9fb658f8bfed8c25bc56e8b546c16304a385a3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
70cc35c7fb88d650902e7a5611219931

SHA1
85a28c8f49e36583a2fa9969e616ec85da1345b8

SHA256
7eca199201273f0bcff1e26778cb535e69c74a69064e7759ff8dad86954d42b1

SHA512
3906ddb96b4b1b68b8c2acc940a62c856e8c3415a1b459f17cf2afc09e05751e0086f8e4e5e0ddd8e45cfb61f811bbe4dd96198db68072b45b6379c88d9ea055

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
215KB

MD5
714c34fe6098b45a3303c611c4323eae

SHA1
9dc52906814314cad35d3408427c28801b816203

SHA256
fbf495968c4a385ff0790e6b65d26610ef917a2b36a5387eff7ae79d7a980ac5

SHA512
68a65496275a1511b2d3bd98ac5592cb1c1eb9df0448471a8985cb2f458c66163e6d55545940de72dea80118ff8ec7ba0ad3276f51095f55c1243fb9f3311345

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
262KB

MD5
c8b26176e536e1bce918ae8b1af951a2

SHA1
7d31be0c3398d3bad91d2b7c9bc410f4e45f37be

SHA256
be6ab7dd506e44a0a9eb0dd531929bd8aa0796d85a0353e6944bc6bf1630b717

SHA512
5a362cbabebbffbb0797646576b65e2934a3b0a30306d74078ef2448fea3940df14f0b8f149691a100cc170bd548c9b420dcc8aa41eb1ea0700c9f155626c565

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
40cd707dd3011a9845ff9c42256ea7e3

SHA1
4045ae709979f75b1cf32142c1137b4be2ab9908

SHA256
9f4c7072716e0be1be08207a7024a5e41162e288e677d805be8e5469a8bd4909

SHA512
bf1ada8a0d9c3d9f39fb739d05fc4a61f0a7e0e1bb5eb44e6f0f5f58381ee6d80aad89dbc3211b70a6294fc69d5820c70fa8488ef2f793a3710ecff5ee90422e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_af.dll

Filesize
29KB

MD5
e91e279752e741b25cf473338d5aac88

SHA1
2b8ea61868a26408cd1dd351cca5139a046bbb7b

SHA256
5635ecedd84330f070a9d6f4cea8b8b81e9dad8592d336ebfd236b7d67e58acc

SHA512
7404cdb82309351a21415b045fc7165137492aa262d00fd0f74bad4262ce10e86c3bde1718c38757b7133e41d044035e731c52cccea285d659c4a570776ae535

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
bd175cb3dfc1d43944223bd5d7177539

SHA1
193623dc372937f31a545344d340360665b8d69a

SHA256
bf0d65cebe0c29f15a616a0dda2f1a414e3f96fe7a28ff7876e811855be6621b

SHA512
f5742352852837ce16f3cf1655e4d41e301f0351b68c7346457978aa310b95b69b1070741fc2ab8be5ff449f6fd44660df3b15811630efc1420ced1455fcaf5f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
42015aafd53012b9c8afa009ee501fa0

SHA1
c1fc049feab4fb4b87faf96c31b3d1160f1c1d39

SHA256
86858a1807e6cf0b91565ed7a5a15db24720b0a7f60ae41e67dbf9faeb6ef2fa

SHA512
9ce323da000b51480ee35973872fc7d181e1f69e820ac737c62c36eaa81eb99965bae39fdd394459adfaf8f746f5dc3b768015e01d8724e2d0718f5286c29389

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_as.dll

Filesize
29KB

MD5
8a54873d54a41442b62f9fea9492d3a6

SHA1
fb19af151b15f4bdb7a555924f1835b0337ff1d7

SHA256
af9bdd050b27b8883f72e3596179fe244a6a2e3545950c82889aac7198cf3c32

SHA512
7cc0a578586853afd027264c3898cb1460b23a47eab9c79e064b9f327fbdee6e3f9bc7043a5a76a710ada05edae4ac0b47529be3ae67ca9b5afaaa16151797c7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
e47db9afb646fb31cc8650837f487134

SHA1
f304204c908ea1fe2bcaf76040d5d1f13f1e99e0

SHA256
4e03ed7a538793fdcd4c646c62ddd278c46911099e6485bb2644a17ad3a8ecf6

SHA512
b2b01c86c78ec3450635c0fdef9666ce302600956e8def3bb02d205ba2a11b3d422520a64361c6f666998bd82b5557ec96cbcaba9e1b712c756e75128c8f9bc0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
5887cd452245dc7bd0389a0ad5db98e0

SHA1
6486d0ae59ba338e8bce87b438f86691e955840d

SHA256
922a102cae4e74bfc0b402bbb136116eddc71a8adcf7f1268d48006c858d1d60

SHA512
0720aaebca04e84d8af2d7b153b0fc51e5651cf664051b8c4b44159ed4c6328eb237ba4f4c97bebedbb1a45ca5c1d0f249cdccac76c6d5619e0e761d12aaaba1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
6aab6d42c7b7a90523a3272ad3916096

SHA1
cc638bd6ec6478734b243de2daa4a80f03f37564

SHA256
67180722f255985e849ec3ab313dcdc0bf2834bad7b6163a0b14587fdf4b4c66

SHA512
ebc17e0ef86b8e5bb938040ad78b299e33d1228c730666526aab27e464626b71ea900cb6dbe074bda5e42e77cd569b083637e233d757b8b0bdee2df2e0c509f2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
abc20df0545611a835dcd895d2832cca

SHA1
39e90363156c461e5aef64a714ba43cc61617ee5

SHA256
75d8c2e259b4d113c0967615af61e8f54eafb49c498767291627faae9fcf504b

SHA512
732f31d175f08c5c69b9cf540e2b0e72b8986b44d1ebfdf0e56eb56b68bea64e6446932a546f1fc30dbbbad4ccaf6bc935177a6348c5280ef786d6d8dfa7b325

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_bs.dll

Filesize
29KB

MD5
327e92c7a55ec996ce09dfcf8c89e753

SHA1
2a51c99519257ddebf0d8280d46e0c0fd416e7a5

SHA256
2b61608a7aca43b7ea4374b79acc6e15deb382eef0fa8751c8e57e03e061cab0

SHA512
ac3ca0f66b899759f0d23ba64ff291486edb1e1d3bb626ad3efe3e3a6fd2aa4081411546e4849ff1645dcd26161f35defbd8442278e6d6f66311780c60474296

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
30KB

MD5
e0d2675c6de1b8d4e5e463246529a304

SHA1
132dace535b9cdc7a4e5f6137407d5becb23c4c6

SHA256
4af082aa0193b9b15622eba1f6165d0b6032b4dab17ba16a8a9affb267ebec34

SHA512
afafc1ca5abc636066ee98a6c68356d68f506fe3734a4b3e68073eed1f2ddc51840464e91d3cd3b28648fcc26b9457ef6484100f9543739220ad75a9eecb1e90

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
bfac1c3869df5375aedb24458cf321b7

SHA1
848232c155c7dca65f6cb22d27a72f2c78e964d8

SHA256
a9f5cf25b9512e1d30ecb769a5eeb694888b72b7f05b78c417814802c5aedbd7

SHA512
732270e8e8036f8ec59c214ca3804c6c67420bcf5fd633347c764f90b06b25fd73a0c7aa75ec42461ae3d3570fbfec5c5a7eee10e8d494b805b7c7e0d4aa227e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
c5681c3b4a8145d3b6cbf51e3f0b12fb

SHA1
908a0546ce091906aa5e7728660b838bf1e619e4

SHA256
2b47a6c19ec492149eca6afb03ca82ac1418a727f35cb641bce9f22136dd3459

SHA512
06c850119b5199bfcec41abe2b5e6929e0a960b69337c6048e0dbdd37ca56401885785de96cec235093a4d6536d9de55178a4c739a6ebd5e34514e12635b6d31

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
3206ad1fbe5c53d278607da7767b1996

SHA1
6964da8787c299e71f8428b22ed8ff6909912034

SHA256
9ea2727ca92f74c7c35ea22287f13ef262241a905567b908e2860f19e044a848

SHA512
38281ab3590a2e6210d1d9c0d1f5a4a3ef19772065f87d94570bb448fb83ea0579aa8bac9e94b05ba2b6bb2bb882f1be6d45c921c52ca2f0608056512fb3338c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_da.dll

Filesize
29KB

MD5
7f0ce1bf90bc88d5fb4d32d359063868

SHA1
59d8ba8397c325ed7b2dcd6a262906795549af6c

SHA256
1147a2cac674209b9087f7c81c09000a2177bb7d42d0d518e3c93d8a9ee2d7fb

SHA512
5cd723cad43388c7e2db4452caa20c07e73a676c82bfaca27a293ab70acdbb115fd82c7a65dee3e6c6d8969c4b99e90ce832760b6f7ab47e9a4f631ce53813d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_de.dll

Filesize
31KB

MD5
d9eb30f1811161a6903901f1ff316ebd

SHA1
7ce5e34af30e821a0bbb7074da57636c1be15d6f

SHA256
73b4fab09f7f224b2527dffdb617b7f852c78eca8989d493ba2fa2201b1becf3

SHA512
9d2e2a44fd027c30836254de1ec99fdff4bad2d3488f25d88a9f80f5f994dd5c660903dd3586dca85fa9e1a269ac8c51b5a060156fa65dc1df0d8137bf878c82

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_el.dll

Filesize
31KB

MD5
85dadb4cac0d76fd821346c411d5c3d0

SHA1
999dc0bd7250f71465f5098dde263a7a82ba7b3c

SHA256
1392f864c486e4b4b6859d900b12182f5ad5ec90e183808ab7ed0049aedd807d

SHA512
649833bf473139db879c2c7218567c49ad6436e3af1efdc7d9e9d48b8d3347e2bfacd6140a59d7973fa9df9cc9cab0e042bdaa7dbf32846bdf6b812b7ecaef07

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
5d4f7ab307f71d761a7f0e193f4b2ca1

SHA1
a3580268a98ad5242c7c56fa759f39276b6149de

SHA256
e2f0a11b5269b08261397e2ba8e2a5e44d5bf2e042a1cb91ad395d7c274b44d8

SHA512
307c489db833e4f2c74ab5201909ad2c53c691e0409f5abc29540a84d1c5ae146a072fecaa0ac886c83e4521fecc58ae5b0ff4331f3b37f39114d1fdea731021

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
cfb71031c56d9e8b9490d01fbe86302c

SHA1
9e11ecf5efc88e0beee1db46620bebc73f86dd21

SHA256
b18e14d0e24546193822b83996c5b311500ca213beb4d497cbd1dda9dac9db2f

SHA512
9cf993ea53673e416eead78d45a6d700b74001b69b1b987d479e77348ea8dc151f4ba6d6b1220db21ce792f9da51b9c83f33663621f9350b848a766ceae92370

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
b25a10d8b739ac2eac10b7b7fc7a61d5

SHA1
ec993d8113e4c0a4a1b36920a8991521e4f7eb57

SHA256
cad0cef66ad1097dc11e6396d0a0fb11ec1734acfde15e9eae402ba0d068615f

SHA512
315971e819d2c3dc5fc30ffe2275c3608125f1e4f14dbeb39aa0fd014291dec0c5efb3e02628bf345c92ea0faaa38e30d4ed5c3793995afff9cb9c933f234513

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_es.dll

Filesize
29KB

MD5
6c3d219e2169f5566a8bed031b21bdc4

SHA1
073a61c02b87e37e87fd3c8e609a56828ec49a47

SHA256
3a841555813f21928fdd45003a3f694a87074869b001b3e063eb97ad35d8fe17

SHA512
2b57d8325ada86a1ea01df0c7d0122875450f913bc8c21d8a7dd44ac7037a170e2f4fc92c13c58980aa9371a7bdfdfee34b9e188e16ad0b89181f7f901467152

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
27d45a84e2b94a60d5a821597fdad6dc

SHA1
2125fe5fbaa2db280a859ef3a7d27ba21efec036

SHA256
65f3cd75a7121dc3d417a9c3180bb52b485b5e7d0ac3b483fa355d13515f970a

SHA512
eddccfeee69b7a53adf32e72724ec8ba1668d1927322ce61429a4c663cf3d17e3f6f59fe1930b96f78faa70d30edfd7845ba53cc161f06a4e67ad43d11cd576e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_eu.dll

Filesize
29KB

MD5
d8323f3db20d104441f548decfd022ba

SHA1
de7f58b9ee7cbcad73433a17ff55385fd7e91035

SHA256
d07d8eb066e953af02a6e3a160232a73c1b66bb54d93d6b2ebc1557d1d322358

SHA512
7de3a803131086c3368d4acada0b6a29ef4ed4102a151eb000056c233da4853c97e394c98d6fd856714758ee17a0cc4c3df061a1b5d2b2b3e3bf95447bb729a5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_fa.dll

Filesize
28KB

MD5
6ba182cbb744541288629a2464ba99e6

SHA1
366751e425128654514dc82112238a7d6f4c9908

SHA256
cca362dd297b8d8e20893cf4da8cf9efc9848f97a04a9d69cabff67ae947607d

SHA512
ab3da91d7ab7150100b580d7b25a5fe9cea67affb1c4ac9e479b70e2d17ebb14a0745bf62ffb3792b8ce4cbea130cbd0012053a5dba7930252e2c09b763ea658

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
e7a774a7b404ab800efbdf7ea52e7ead

SHA1
3f0476821281614b9ee32faa5c534de5f6dc21f9

SHA256
1e1f09beed91a6a84535a1cf2b4df5e416cbbf785546f798d736009e31f95691

SHA512
85091f8bf809e88e248f4a899682f15586a083d1bb94cb5674da0e463716fa927ebef578519b653ac4ced381f98c4cf7a409c1ed52927dcf7fce4813008ce900

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
1223e486deb013055cb0b7729681b9ed

SHA1
b5b43fa89f066a9b6ceb47389c05b69ea6a784ba

SHA256
fae283a78757cdc548c728a38cb041db4ffe538c5ee7d2aa2f55e3469f95fa25

SHA512
8862d2f4778bfd0659dcf9dfb992072767af30dea46b34d626580ab8183a765d0c0f95a7070f0aa36e694d9e559f843672000aeaa4d8abdca60ff83da5a2b857

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
9fea64a22d045d8edc38a9b8480a9c12

SHA1
e3342e26166a43a21729b8aadeca653c03dc0528

SHA256
2f324851f0ccd101884b78fe1eb07c2da2932a68015eb8cfb4c801e288c8771b

SHA512
a3601640cf961c88efa476125a71786a109d23355922eda45b5be8824ccce650d703546c5c8c281308dce208edabbeea5cbc3b44ed678d9d36970c4e5f236c0f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
498dddf273f0f2973b1c4581e820f10c

SHA1
aa048015a3ed6ebf9b4848a9cc54beb5e39eedd7

SHA256
9ec8cec72404794a2b2a738502c7f531d976d8c99a57d2b5d2f0f2e818e35e04

SHA512
3596b20469daece28496a13b02ae0c1cd9265fc0046e1fffc384b8a16a4869402831386679c3e9cdfe03903df0b191d2fdc04cc531104c9c0d84bef24eb4d60e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_ga.dll

Filesize
29KB

MD5
81d35302b31bef2a99e154eb64abbaa0

SHA1
ea72f2aa526ea299d5515921fa0ac8f502ce3cde

SHA256
0133af05b669f957174a22b0b568a17a9bef1e387f52ae157766fae42d4e647d

SHA512
4d1df9684e7247ec0d8fbfdcfdb6ac5b2811de649c5b7ee4a20e5733307cdf5855ff767ebcb12ba15b33be58d82bacf9a02522126d927304e11f8e64261b46bc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
2e88f4aec46a293b3ec9bca2d7d2fe73

SHA1
ba34b9635832b2704942d7cd8578c8d70f0ffd2e

SHA256
f7278ba46204bfa387eff0e72fb2a8dd32ccea154fb268a8c39b03ad5334cf38

SHA512
b7f655cdaa3a34a8e0e00186cc49986cf283785a133af87ae47c3a3614f0d15d5b51b4091ff33bd0fc445815665edd37d378a9665d3831d2281b0bf6cc933c87

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_gl.dll

Filesize
29KB

MD5
2dcb17e8da6ed1a62a53029940592cbc

SHA1
b12941091cd1a554cd23d38dffbf75ec8ff57848

SHA256
a6770040c2f93ffc5c542dcdb1e7ea529d6036920957a9709153d80d360b178d

SHA512
0c82b39c7128d81739f64346948784c60d2cc409b637d5ca79825ef12766c10861ac3c119a5f232b12f52e50d3ba6818532968c75fbf455e75bd3be83c931f10

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_gu.dll

Filesize
29KB

MD5
571b69e1a8f9cac5eca53ba624aae924

SHA1
89798cdf858a4ee42ab4ffc01055c0463b6c4c0a

SHA256
37e67d7511d261ba1e022c9019d1b223d6d092260f97b471fbe2259ac5af6d3b

SHA512
961834f77c2683332b7a650360c09fb08e7efedf4249e48662b9a4fb9534bdba687eb9320da1a3aafe6a9c30d624c4bb94b55e1bf086a970354df61f2065e181

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_hi.dll

Filesize
29KB

MD5
4e8b170283c3f3d182eca7ce97e71a08

SHA1
93d86d961014b12c1a376effb3c568318db1ecc6

SHA256
0eb7739ad2863ccc13fa5cdb805189634728a7613918cd54bfe53a06d9c26cf9

SHA512
76a384ede88986c03e659c61e5409446bb472fa50c2e2e6f6e907f74e675ef0c5e932d950733ee6dc0c167881bc948d7ba9771bb77f31db3fb540277afb829fc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
54df61c0431c61851d8b61427f2cd68e

SHA1
84c99b724a2a5f321fd161d3beceb894e377a121

SHA256
6e96de38195de0095c6ab16696ccde2577a65e8c23d07f31e9f3c9f52d76c7ab

SHA512
46bea4f17fb327bce8bc6cb5329b7086a772a6eae07a8f2f34309a42acbb9f3dadd675d9c8d9f9e72c85149b48419fb5807acebbcee5bee150c754f94e98d7c4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
6b201af2eae546c9b638e38cabd9676d

SHA1
626b2029d573f371dbeb7b7878779383adc6253d

SHA256
c849d765c73a969ac10acff6195edd9339054b93a15152e5d1eb1fd1b5017b06

SHA512
1c35c169cf16a37a5537d0911af7da64ce9a0f999e76464f3410ebb224b9e65bc71deaa253e549b196c52409127b55cbb2e4a39bf9731b3ee76dae560b74fc2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_id.dll

Filesize
28KB

MD5
17162657113e9d8d7c1763bfc0ec991d

SHA1
f2507d9d1516bbcfbe408186894474c592f141a3

SHA256
60d759405a83ec4bb64144ed61b0e9a704bfb3b74e8f956277df71a38b19fc9e

SHA512
450e90b4c8ee384994cd6f56677dcacff258eb12442af3fea3a977d7d00b943a1b1f6b12769d4a02aeadc4f4c3b82a06cf8a667ce6691ace5d479d1261a1a629

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
625060f019c3bb8f1d49a9b128e1e4e6

SHA1
0e22bd7e23fed0e856a09bfaf5ee105a3dd27edd

SHA256
6117fb49f06f4d8e7268de9e41862a940fd36600e23f670f3c77ec0adb27257b

SHA512
962910c5a438b0289eea0402a262b8b7920255a1dabafdcc477cbebcc36a1c31b69784947c794bf720e16c0798cd958616a763e67c42327a94f7e66daa63a07c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
258b52e60a1e353b6117917154c7b24d

SHA1
c109ef8d1382991b02fe953679bf3fed063e9e82

SHA256
2362d8f1e8f2c92e43659d73052f2a43dabf95121f852d6d04471710f2c7109c

SHA512
fdaf605922e728f87d7d916f75a83f78f4549dbb35f9d2e7717d369cd658075655a1b903e705b5cb609880033c080e4b3135902fcaba7a8a96c2904f05d53164

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
973e14a5557248bdc2cd3a5fa3540a77

SHA1
66818135e202fc53711053ceba04ecc8b9b28506

SHA256
0af05d8af74609c9436ed0dcd3df52f7ef3dea8b786c85376c57c0cf128b3045

SHA512
e8c271f52fee4f249c27c4c344b5ecbab796227aabeb36b0b7a7d82d5463bcaa707b1f8ea47b863f2d87b35fe9b361ae2e2b7d1c16a4eed0ce0d530e1e34b26a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
dd5aa26cf2d67f50540da8e552f792a7

SHA1
0b14b06a2beb63fde2c1bc86c49a5117287de2c7

SHA256
b11af70867ab588c412cb5d5cc36ec888e74a50f508eb31a28db559aa00f8a35

SHA512
9bc1d7965a66ddbe7dc3fefbf2eb445a0857f83a28b2b3e120de80b03b51e87e6acd20569f2b002bb7adc41cbfe147572306094d83c8ffceb44f7a8417d89e0b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
3cba4b52b099039d2fbed395a3bc7568

SHA1
1a5204510d2c02d02ce361c7a3295498a60efabe

SHA256
79d4684d4d365b2c89f16fa0522f66031a1037cb4ad2a33050ed97a1df825990

SHA512
6ea41e61e4fa8cbd73e693db860a84bb4c6389b0aa5aace965a9567f6c16ae23fd51c018c6d96a1c08500a3cfe6327cc4c9ca9aa6bf9ad0b2f0d0c71e8922e05

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
6543ba7290488f5e3f68675a598255fb

SHA1
7359895f909776c5f14f6e5ed0fa11cd50853cd5

SHA256
df016969fc3ae57abbe8fa9f811364cd84612af0e819284b4d1acce981f6c21e

SHA512
90f376c59d67d89bcd646895209c0fca92866f9866e1cee7a51745077ad05f730cea2624837baf1e5ba92365ff46955ece98938849b87ed7f89a92897949d0f1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
4d101ce3ce6be285845e8f8bae548097

SHA1
195f314bcbee9cc373136334b5089e855e71286c

SHA256
3f11a2020839f5993e6e3cb9b5e7c5c659753cfa49257d3ebc015da6a8ead94a

SHA512
c31214e9aacfe7056be1f7ca6399270e644acef060d208d805b59bc6635772592ae166b06d038e2eb74218c451ef0fdbb09dc7e2ef6d23b751cbd6ae935cdf6d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_kn.dll

Filesize
29KB

MD5
cd6084bee91407a5bb932cad81ca0636

SHA1
c9e56e6d15b413a8061ba38d05ff402b30688684

SHA256
01551c5de82d4d9b262735ecdc39fd6c4ea5a94acb9cb1dc4cea0e3bcfe7ee9f

SHA512
4d1cfa478050c87ff0c7d0b17ab7c23fc6bc400214b121bc86fc217b7b8b764c8109bdb15a3790822295556a7d8706aaeb8ff642b24d2fbd582b2ede61a76a7f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_ko.dll

Filesize
23KB

MD5
e73046fc5427ed78ca02c7f50136efdc

SHA1
df58d20768edc25637ad8fa38f71d25a86633725

SHA256
49e0f43057c404a4ff5a2bc306f70c3728412b887e07870cdfd1f6eb3836ee88

SHA512
fce94d5a6b8f99a5af8f30314a0a7a5a3a557fefc630b907e5266c9f397bf6dd1a8211fa9d6535f75a0db7016ae20a3b295c4780383516d7a234225b798be584

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_kok.dll

Filesize
28KB

MD5
735d775e6772b5072227a3efc91d6f5d

SHA1
b302aecc725b87d3b0402be8d5b30c35084f2d81

SHA256
11c257e800ef3021c2d6147999f5192b28e48a0ff9d486be5e47c181744c15a1

SHA512
8dcd0e07b90ceb6d6f39af9077bd85eba46506791491eda63b05471a7f984c2d1b67cc1335f788682ade2124b32e8b5b436bf717f6b5e2de8276dddbdab3fd34

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_lb.dll

Filesize
30KB

MD5
8fc766f256ccd06f09106c10f9a20edb

SHA1
867c9da84a0e61a8b4787bd3618ed25aea80360b

SHA256
7cec1855457e12c2adcdc3790856f775fcac27bc4911258937f8b08ef0a0d1f8

SHA512
4f545d4914ab62743d2a0c6a461c03597d38b6a8ceff85b154629d2676f41b9cde7efe2e8131d2749321e56e7ac7d90e4f958917a989170bf505840bfba059d9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_lo.dll

Filesize
27KB

MD5
f59fdfea8b8be13fbf3ee855f0f840fc

SHA1
32743d1ccc6702bdcb8e4e1320c60ce3ae0c3a36

SHA256
ca296d434902c4146ad1828ab96679d937d8edb85adf0184de00732d86e49d08

SHA512
fbf31397247f434d67f1f02751a12ecce46253e43218dff701c86ef3990d8ec8cbe50dc94b32810ec665e42246277ca14846ecc77350d0fb4a706b5d03c1484c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_lt.dll

Filesize
28KB

MD5
f4bb4677d5baafb96c2489db597ef7ef

SHA1
ddb9566fa8f2206df5b2a6e71870b08a4ef3e418

SHA256
2a0e85a66fa811b55b5fda8dbb45b5db4ea01a32cfc927e22809ad5f3c8bebfd

SHA512
4beb5fa5ff8643622bb6c971a84f0af33328a98fc6caebc44f02d243c3aa5fb30f390dc65921fc1aabe7099b94a8c4e748c82543670053ff6d20a3c0a15a513c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_lv.dll

Filesize
29KB

MD5
f4d4b8ca1664b954595d872cd6ccccd7

SHA1
288231017312ede121141f94ba89051fb6f3c3f1

SHA256
ec7072699b9c3954d0eae183312d4041299a1f2cdccde2ed8de3fe96837745ed

SHA512
b1474c0c4e87f499d8f1b3a83b8b001c72a48656781e8c3df87cd0a5eb2a6d9fec5abdf56922eac3fade2df232322e804f315874d983fa256941d4e03ecb93d8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_mi.dll

Filesize
28KB

MD5
b112ac05613a1942f009db22c776170b

SHA1
3124e35610322ba8eec2779f4d4904a569e093ef

SHA256
9c1f34a7971ad37522136dfe3e9bb8c6939b69e9adc2ecea44ae495ade165419

SHA512
d47455653a9f1d69b0c63040eac6bbdbb8b3f72060862c1adc2bd589bbe20c04f25272e69324b0249a79eba4f089a3e68e787ee80a4d992df160597186d3ca89

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_mk.dll

Filesize
29KB

MD5
3824b848b8d27996e03b77e47d683ad5

SHA1
2112959b86d3699f7748120e9ce704a4b1d3d85d

SHA256
42ddac6cb468b4d938fac198019dfcf36b33bb8b370755425a6a5950d226878b

SHA512
cdfb37d6ffb0f344dbfb95af7cee8f0d7f420a1a98f934ced93ee0c349b1f2661e8331f4ea373a7bd535df89b783ec662935c9dec8f86c31c91bc6383af01028

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_ml.dll

Filesize
31KB

MD5
c48931cb10b1cc296f87e982d00f43bb

SHA1
c9a6574e4e31fdb73699561faac3608df9a846b3

SHA256
170cc518628e509b7121251e08894d2a865ac0ea1e4c96817938d677fb58f7bd

SHA512
05784711f1257fd0397eb324970d31c9807c6c2fadb084a89788dd33e73d7ea55d9cb96d42a2bf077db6720b8b5f330b113f035f82d1830d49de9296541962d8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8C0.tmp\msedgeupdateres_mr.dll

Filesize
28KB

MD5
d3f6ab6ae235e87080e5b4fe3510b937

SHA1
06a4c82db747fdfac0c1114248e40fbd024a9bc2

SHA256
ee83dd12d5a99faf762e5ca10182a9e4ba04044b6c4d04d482de09959fd76a49

SHA512
f5a64838bf8abfe9af4b1a6a25570d8b092babe09ceecdc2b26e5fbbd5e8ffa3ba87c95376972c589d01d9ff7c566d31106ddc46424961ce8062fd2bdf8ba075

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
84KB

MD5
bd1f8f112f9ad45417f8d874674bda2a

SHA1
7bad17b8be5006f7ee3a04a5459333b917a3e851

SHA256
6cf2fa14edaa439a15f08aa0b25f7da8371203a5b2347debb093a68f742df638

SHA512
cc7f18c55d1a6b053fb1427148287afa3ab071fafce35ebb467f7f991a86e7bea73efc2284668386a2c4bab02aec85354482101d3b1cda387676de9ead64b66a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ysnifzz6.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
97191b8bcdd1df009536549bbd55a4c3

SHA1
b92fab023942774355b31bb9a6c9ad40572b23c7

SHA256
b5178a8cc3a2092ebfabefca4c2caffdb46281114a850ea77c777b53d249580a

SHA512
52632c28cba20d14de1cb3ff6d1b709b1117ef48654c79ed78862ebef167eaaca8f8a764e94cfd7378ba215e47c857496126329d76c89d18b67740b54c31acde

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ysnifzz6.default-release\cache2\entries\C480DC2E887C2EC5556F7B69EB07B76AE5666CED

Filesize
443KB

MD5
2a55a6d72bc3c0137677ac435ad6d0ea

SHA1
dd34a8b3de77dac21ad44bb10f20ea7a7d602bdf

SHA256
4b29a7244575937c037687439362297ad410f5fa240bcd0be1220c30a5076bd9

SHA512
a5f0930d6a9004d86a47c59d6260f223480205d5c26816c11e6cc953ef9a7c52636687d47738efeeb8e8ad876ed868f6a2b739dd1b455b74dd3d3f13ec131852

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
25KB

MD5
e6b110dd36bf688c630fee6ed0c5e07a

SHA1
405e2a9e03bb9cb919c3f5c822a1273e2360aa88

SHA256
8dc100c6a6ac124352b0588c55eabeeb8fd8d5a1d279ba0827951f32cc5f9f1d

SHA512
5f19dc8bea8020e0703b8f337c062d2e596347037cbd3f276ca87b8f2771a58505394163b4030150f25156ac7059479cfeeea7098a372ca438238bdc6871a05f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
24KB

MD5
d5cea1686429b742d6e995b2b531990f

SHA1
abc66707249675c5a4c18ae92141042e4d7f1d3a

SHA256
345cf61db5508f3b6a7c7e31cf0517e849923bdcb028e1255a808fb200e81de5

SHA512
239044885d80edb1986890925f83b1e3c104a4832b68a6248e2d6231353e94bceb9cfc2e63f6dee118447355481a6dc6316eca2f0be85761267468a52369c59e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\AlternateServices.bin

Filesize
7KB

MD5
3b86552b7185ae2cf5ac82c5c9453e2c

SHA1
c4d8ff4392efd442650db292920173cd0aa4f6ef

SHA256
4dd46e68164093fe8725893b9fe1b1f267032197e3cfc63aa8f8471c1a952b01

SHA512
aefb2b03c2fee71d58109d5fc8619d2105600ba212045ba44f21c2dca4eda601a846d461c472c3aa243fa2c2a9a60ad610ec3f9bfc123b54f40a87d9ec8255a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\AlternateServices.bin

Filesize
46KB

MD5
a7913540d67e2aba57d7608e5dffe39b

SHA1
d3c8ce43e3cfd342732c66e1c5653feda98181a6

SHA256
3a219471b166fb5492aa38aa5367b905f13c47de644a381d615fcddd9f0ffcc8

SHA512
fad6f613c31ed3c059a6a275d3280688fe4a6667f6d4dd0b3271bedbcf0f4a6897ebd5fe3347c5c2695ebd100c97009ee72ec8352f756d079663519e9e440a35

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
46366ed46bda2daa36257f3be70fb675

SHA1
a53f9f72915bcd4d8fd8ca5b6f984c73d4410037

SHA256
a97f4558f1f7223a5b677fabb761b33bbd7f148c2e4c75024e328bd138220072

SHA512
ed2440a1835f833460f56743a29ea39791edfa0c27bb89531b630042f00aa2d5c5949e815c3f8033920209d19b8aa63e24cead0097841ca830c8a7222d2e0438

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
75ec307c8f1897b28b2e2e23cca83622

SHA1
83ce5037cdd0c6d1ebcf7c84b05e6467a8dbf3e6

SHA256
49b5c675a6539da01e9c6fe2055b4f90a1813fdf35accd39ca94ea491889e6f5

SHA512
a2be7ea5678443b06b784f63fbe4d96d29fba5dbc62e135c8080d2a03a994736c5dfa8bbb3277c716d7fa601394816c79d9227b6294ff054087d556e0a8c655c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
2e7af3be5f070faef72f23bb1ac200ef

SHA1
c6e907087521035cbcb8b6199b5f394290c073aa

SHA256
0d0199efe224f163a7a327bb7a17f3bd84efb1d0563d9731e5dbb723abb739ff

SHA512
09a67ef707bddee6e8d26fcfea9f88e3fbefe306c1274bb0aa4f8f2887176747cec569dcae0e4ff34aa05c4d3d321fe8d7882976496eca4833f84ffcd5dbb10f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\datareporting\glean\pending_pings\0acfd05f-3193-470c-96fa-4fffe7670a16

Filesize
982B

MD5
d45eba4fa736f8625d1af855481777b9

SHA1
3c7ed04eb72353b4e97716dad04f3c839765433e

SHA256
b675e42852f5aa433fbd31c5ba98bdab6b10dd377da7cdaa403322db35acd7db

SHA512
dfe291ef01e406fac523e3e05dd325866d321019efe8a3c21634ff5724c2e3b578166568f1a5c43439172094f1789eeae99e77f0bdb51674b57b91287f4572e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\datareporting\glean\pending_pings\a28db174-e514-4d96-af48-f0cdcb01230b

Filesize
671B

MD5
a8fedce03a9468ec623a2b926a4bd3a9

SHA1
81c8369cf5d9c72ee1abe8ce787e44b1e009c5d0

SHA256
5e6538937438f534e5b8b2065bb10a59acb7c08f1b95f4995871ef295c3a93cd

SHA512
feca861c456964674e34655bdbc4af89149cb455cb6fdeb7e030fa3afebf11531a5165593f4aa038cc3a4ece56d89e706c8a3b3ade5452ac756259886d4be70d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\datareporting\glean\pending_pings\da1619b9-27d9-47b0-ab47-d681c3decc5b

Filesize
24KB

MD5
528d4f75882a7c211f875b51c0984140

SHA1
4a006f11156af19fa9786e7c259e58978fc0fd8c

SHA256
c78ecf0dea61fb403883510f958765b52d634e56eca9e8514156d8aeb9658609

SHA512
d4fa6666422a778c2a9d121ba6d8feb30d1568e631cb0335e50376b5d53f49df1b547ef0a8149ed63a5fabfcbaca4887c4c43d3301b26243c74f8c285b182543

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\prefs-1.js

Filesize
10KB

MD5
164d7584b0aedafb0877800c03b07a69

SHA1
39bfe6b380da69a99dd772c4eb5a2ebed1446d9f

SHA256
cc73f1d2dbdc8c3bf6be579cf55b81c233e4510999746bc404d450f4a916569e

SHA512
c7e9a7938c2265c7f775212a488dc38818277383161321905ba859124e816c99d891b74dba537d9bcf899ee58fbd8956299aba2c2fe375d8732f342351556982

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\prefs.js

Filesize
9KB

MD5
97a1183f589c46f2b2bc9fb17c0f8297

SHA1
03befa6cff1b6b6ef4e3e305774225ee75b5497e

SHA256
67550defdac2a492f3875e76589bf400f6b16a504791522d974d85da4726865d

SHA512
395450c77c16395fff28e82108647efcf13e2980ed7c95a9ef2be135bd55dda0cfa9103af8ebd8cdc07a257a71d1ba88c8f9129116169ac51da78653019fa7bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
995cb75cfb1da3d9f38e3c9d26809b59

SHA1
c0c96899607699c087db7d5a4cc7d72ecc198218

SHA256
4572953c26ab39717905ea9e56212c7b8c0a71fa4119c3140fabc02ea64ddbd0

SHA512
4813b9e5bf7ef90bc6c24ca0b6028c51386838aab17cbe6b2006e0de73685ee45459323fd103e2e2c5986b449299a22dc0b80f30c56e7192f2a767f7695699d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
d215a831a856ce37290907dfcea306b2

SHA1
e413666f7ebb90af5e1c61e5f02f4e6321ec69ce

SHA256
487b48c7060567417b4d245673dad9de13e0e5d49e098a5966a5ae4ca17ffa35

SHA512
bdaaf48b31fd563bb3346077087e7542cd1dc72c34167badf98c2a535312b922f034a01f2ff64ea7886fc884150f8a1c8e96944c9e7f9bc4fbe98b6c9ce69816

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\sessionstore-backups\recovery.baklz4

Filesize
25KB

MD5
724156dfee5bc217207ee63de0da6645

SHA1
1f904d9e7428fd1256d2a853188ce3388ade1041

SHA256
a93b8bd4ca949f38228585003c97e5c18abec851948215a37fb8dd22f91670fc

SHA512
085f3717ffd4d4484c4a62f0b097622fc36b90f570583f615f51ba0f4cab8f0d23ff3dad681ffe15ec89ad8ebb74b5fecf1904100efec7b1c4bdea86aa56c556

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
99ee44c82c339ac2ea41c596f0f2ff53

SHA1
7b9d450c649a7510bd9f6242ee29f6bed94cb3d7

SHA256
bb3a36abf47d99f538dc7abd066f3adad4e816abb7138b4ea772229a382e1ec1

SHA512
0185dc0ce2cde680c9682fd110aadcb5181bde3608526a26211abe55341deea87fb5d2fb56a32651370b60c11a2424e102a0ee84197e1e973ea12f4bcd52030e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\sessionstore-backups\recovery.baklz4

Filesize
22KB

MD5
4e2f70f1f5b35c79faf8717c238b2f06

SHA1
8d8172036289ff44546272c4352b8ce15b45f677

SHA256
326fa96b7cccbdf93e58821721e25271dabde58e440f852262828d36fce1afc6

SHA512
b75081c523b7e770420275e49d03a70a4c06de322c50f136cdb31a47927ee8f0f468fcf6617c97fe75a6c06e4fc921a03eb18946904ac8219f0759ceea6c1e63

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\sessionstore-backups\recovery.baklz4

Filesize
25KB

MD5
a32ed6051489de5017aaf72c15442d7e

SHA1
8a45008579dac68434b53d2d317b3e61137af000

SHA256
833056147bbc7a95d9ba8877b1effd1ea68c5a5d639dd2e27e0943987f0c96d0

SHA512
d0048ef52cd5371297229e1176f7a39c499f6beb1eebc6fc6622bf141f31facd5b39f322071a276e336a72c130da6277f24b27496e4bb6e2be4eccaf6c784ebd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ysnifzz6.default-release\storage\default\https+++www.googletagmanager.com^partitionKey=%28https%2Copera.com%29\cache\morgue\241\{8c88a84a-77b4-406c-941a-38a3e41baef1}.final

Filesize
11KB

MD5
c84f1b624e16ab4c39b9ed6098b665c3

SHA1
a9031f6923b3c7889c066d8e9c3e0a165337b36d

SHA256
74690facfeea8bade05c1f7d74c4a7062fd9bb6145ecb0b5431d6a4666c0a324

SHA512
b5ccdf43dfda65fda4d3d56e8c0ea8825f3da4c421f8e6babaa451ba1bf5087ee39459a76dc6a114a5e0cefd98438b56a9da2c87c31e1a6b92cb78d2e7794e00

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
11d856033dc2a2018d55f7584747d40a

SHA1
f0b9a96b18b459b0538b3ad4af90f1054dccc648

SHA256
063a8d3f21093e2aaa4b4cdab69682c507a614bf50f2c9a1806c3d00e4acfcc6

SHA512
7d23c71a880a327a38500ea441fc99e45150a952c95c074b4461ff99cb25718fc9cd68a47cdb988e9eb067b191e5b8f66c5ea9fabb2883bd7d04868da64defe4

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Default\Extension Rules\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Default\Network\Network Persistent State

Filesize
229B

MD5
5c9f79435fd36dd2a8914a542651f839

SHA1
81f4f5faf2f14d448626b3f49618d11fd4295cad

SHA256
153938ecc186cd98a2f1ebd1f53ae88cfe9d9884bd470e9166a53348a071fb2b

SHA512
0e7cf3372f919b11b0c6341bc4df2bb8ba5106463b06c74f0736b14755fa23a78db7e9b3111938570225435169bd01f7198b6124007defa77e90bbe21fd14588

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5ae2a1.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Default\bcd4d3dc-d8e5-4f71-94ab-75ecb0c55b9c.tmp

Filesize
6KB

MD5
04303821f91f82e8a222dd5a4f1d13d0

SHA1
263e816ce05dc7decff850fdfaa383822db14c68

SHA256
af54d85ee6ecdacdfb6664b16e166f11e9e826a9cb9a96c4aa35828ef58c54b3

SHA512
f9f2a22db22848861e0b318b02aef609363f323ce439ee6294a6ead6694070dd8ad8f5b99cfe8329a2daf97165ea16a015355244e45315b51c8095323ad827fd

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\GrShaderCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\GrShaderCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\GrShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\GrShaderCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Local State

Filesize
16KB

MD5
25a0f78b36950aabf97da5383343e40a

SHA1
87e5a183a8d6a21a377a938706087b6a6cd75451

SHA256
8e5246597fad70efd326e7014a5cd038820aaaab3fdc5773764162a158244d09

SHA512
a2221b5eb861b94468674ccc66e3013b2dfbfeace6c40671c531bebb1d2d86d60987ec7be70cdcc2a69585985e5d7931f9c7d6505a2ba1a2e3f521b3ed7f7ff7

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Local State

Filesize
1KB

MD5
12fb323dfeeab17ea67da3d6086242f3

SHA1
cedc27d2db03e5366ebde52e7efc43e58bae2968

SHA256
54476d27ed6312a2d63a18b6d86f117e309a751362bec54671ff584929866dff

SHA512
053b9daf7d9e15df0418b70d6a43a1f7fd6b995c69a2cea5887c0bff6654ad003fef37e8aafd0afd472d1af1b250669ac9df1cfd41dbe81d6a0e2007e9846c7c

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Local State

Filesize
2KB

MD5
cd5fca6e903b96285c6169440be51ed4

SHA1
c3ba33337c7cb61bf670f006e8630eb1ea009e02

SHA256
979e54bc987cd3579135b39153abceff4997d53dbaf7f6852a5b49ccb1e78270

SHA512
398b90f941b7993ed487d0d65c69a0ea2a2579e39451fcabfd8d0155ad0802575755c1b5dc33c5327861160c3f52af62c34423d17ec120731a5efe968fe1b67d

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Local State

Filesize
3KB

MD5
dbce633c8b30f7395d2d6bbc61d3c823

SHA1
cad4efedec22d3d576eda73261cd50c2ae5abfe2

SHA256
b386dda98c0dc4dc49b8f9d7756b69dc12c69d6f5613738daef8d150b955e859

SHA512
54aab5c050aaca4836440717c390c09776b60ca7463aeae84551f93791ec91ba0a877ab80eb4a4ee2b28985eebd5dc7f3e649f3f5cbaa057d188da069972316d

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Local State~RFe59ce91.TMP

Filesize
1KB

MD5
560a3c1a37fdd1ac99bd797500f7a2bf

SHA1
9f82d426bbf7c28622d1984e18ac0219d1dd539c

SHA256
e350ce6b1faf77e702c3d36eaf71cb2e47ec45243da12b75be2c5a6a3d41d72d

SHA512
eccf139991c48c5b53f1cb9230fc07bf71ffef33cb5043cb1821ec5d8c5fc5b58f093dc704fd5583b5bc6162ae4e116a3fb494c862b239dcdcad07073e761d61

Download Submit
C:\Users\Admin\Downloads\Cryptic.5nZNqNyw.zip.part

Filesize
6.5MB

MD5
576fe1b9566d71aec47bb662445b5a31

SHA1
d5432ad8e994549da0cde1cb5c86b2e9cb5b453f

SHA256
f6b958ccc17f05631144f5abf8393f06f5bc224ff85972739d586cf1bbef628f

SHA512
5e6beefb50aa51cbcc3e365393d350c5832978dc13ae11e1691cf3ad6c7080b366412d9ef9d46532f75f105769971463e012b82ff8a90348dae47ff5892a391a

Download Submit
C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
91a4a9f156befee0fc558c48515b1067

SHA1
2de278775ff7cef56dfd55a8dd70cf3ceb6ec570

SHA256
88de548e0332e6c8850d59018d75f8f3ac3b6d01dc70f3f3f36f591cac8e2ffa

SHA512
320be060831a5d2f87a5d1a8fcc90c6d241880beaac9fa35e9fe6b593d640a1a87bdb3e1207e061cee6b8d335af9bfbeb8759e18b28397e4b3523481d488ed8f

Download Submit
memory/216-1448-0x00007FFD7FEA0000-0x00007FFD7FEA1000-memory.dmp

Filesize
4KB

Download
memory/2564-1669-0x00000171D0620000-0x00000171D0621000-memory.dmp

Filesize
4KB

Download
memory/2564-1671-0x00000171D0620000-0x00000171D0621000-memory.dmp

Filesize
4KB

Download
memory/2564-1668-0x00000171D0620000-0x00000171D0621000-memory.dmp

Filesize
4KB

Download
memory/2564-1662-0x00000171D0620000-0x00000171D0621000-memory.dmp

Filesize
4KB

Download
memory/2564-1663-0x00000171D0620000-0x00000171D0621000-memory.dmp

Filesize
4KB

Download
memory/2564-1664-0x00000171D0620000-0x00000171D0621000-memory.dmp

Filesize
4KB

Download
memory/2564-1674-0x00000171D0620000-0x00000171D0621000-memory.dmp

Filesize
4KB

Download
memory/2564-1673-0x00000171D0620000-0x00000171D0621000-memory.dmp

Filesize
4KB

Download
memory/2564-1672-0x00000171D0620000-0x00000171D0621000-memory.dmp

Filesize
4KB

Download
memory/2564-1670-0x00000171D0620000-0x00000171D0621000-memory.dmp

Filesize
4KB

Download
memory/2992-1504-0x00007FFD7F8C0000-0x00007FFD7F8C1000-memory.dmp

Filesize
4KB

Download
memory/2992-1503-0x00007FFD7FDD0000-0x00007FFD7FDD1000-memory.dmp

Filesize
4KB

Download
memory/5640-1624-0x000001F609B50000-0x000001F609BBB000-memory.dmp

Filesize
428KB

Download
memory/5640-1547-0x00007FFD7FEA0000-0x00007FFD7FEA1000-memory.dmp

Filesize
4KB

Download
memory/6140-1419-0x00000000006F0000-0x0000000000725000-memory.dmp

Filesize
212KB

Download
memory/6140-1383-0x00000000006F0000-0x0000000000725000-memory.dmp

Filesize
212KB

Download
memory/6140-1384-0x00000000751F0000-0x0000000075416000-memory.dmp

Filesize
2.1MB

Download