hxxp://noescape[.]exe

max time kernel
1050s
max time network
1047s
platform
windows11-21h2_x64
resource
win11-20250211-en
resource tags

arch:x64arch:x86image:win11-20250211-enlocale:en-usos:windows11-21h2-x64system
submitted
15-02-2025 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://noescape.exe

Score

8^/10

adware discovery persistence privilege_escalation stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge"	setup.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
70	3856	Process not Found
109	3856	Process not Found

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 10 IoCs

pid	Process
3920	setup.exe
3116	setup.exe
5036	setup.exe
4512	setup.exe
4444	setup.exe
1576	setup.exe
1584	setup.exe
1040	setup.exe
1792	setup.exe
3596	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk	setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\gu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Installer\msedge_7z.data	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Locales\gu.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\sv.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\Mu\Content	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.VisualElementsManifest.xml	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\es.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\Sigma\Fingerprinting	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\VisualElements\LogoCanary.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\onnxruntime.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\VisualElements\SmallLogo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\EDGEMITMP_E564A.tmp\setup.exe	MicrosoftEdge_X64_133.0.3065.59.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Locales\ml.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\lo.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\he.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Locales\ug.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Edge.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\et.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\msvcp140_codecvt_ids.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\he.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\ko.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\th.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\VisualElements\SmallLogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF780691-ED85-4750-A96E-297FAA1A2021}\MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe	MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\v8_context_snapshot.bin	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\or.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\hi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\msedge.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Trust Protection Lists\Mu\LICENSE	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\fr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\tt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\ur.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\ug.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\ca.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\Sigma\Fingerprinting	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\win11\identity_helper.Sparse.Stable.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\oneauth.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\prefs_enclave_x64.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\Mu\Fingerprinting	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\msedge_wer.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\Sigma\LICENSE	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\MEIPreload\preloaded_data.pb	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Locales\nb.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\it.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\tr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\telclient.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Locales\is.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\el.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\Sigma\Content	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Trust Protection Lists\Sigma\Entities	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\win10\identity_helper.Sparse.Dev.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\msedge_100_percent.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Extensions\external_extensions.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\oneauth.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\th.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Trust Protection Lists\Sigma\Content	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\Mu\Social	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\Sigma\Advertising	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Locales\lb.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\stable.identity_helper.exe.manifest	setup.exe

Drops file in Windows directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File created	C:\Windows\SystemTemp\b3a65b1f-3264-45f2-a47a-32c7cf80aeee.tmp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\840939c6-65eb-4fae-9f4c-3d74f68f2345.tmp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4732	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\BHO"	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\BHO"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1"	setup.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\InstallerPinned = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge	setup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{31575964-95F7-414B-85E4-0E9A93699E13}\ = "ie_to_edge_bho"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib\	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\EnablePreviewHandler = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/html\Extension = ".htm"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\ = "Microsoft Edge HTML Document"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgeHTM\shell\runas\command	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ie_to_edge_bho.dll\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ProgID\	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgeHTM	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\AppUserModelId = "MSEdge"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\URL Protocol	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell\runas\command	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LoadUserSettings = "1"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\open\command\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument %1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.svg\OpenWithProgIds\MSEdgeHTM	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xml\OpenWithProgids	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO\CurVer\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\DefaultIcon\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\msedge.exe,0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\DefaultIcon\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\msedge.exe,0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO.1\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\Application\ApplicationIcon = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\msedge.exe,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgeHTM\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\AppUserModelId = "MSEdge"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\Application\AppUserModelId = "MSEdge"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\TypeLib\ = "{C9C2B807-7731-4F34-81B7-44FF7779522B}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\OpenWithProgIds\MSEdgeHTM	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.html	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgePDF\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xht\OpenWithProgIds\MSEdgeHTM	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\win32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib\ = "{2397ECFE-3237-400F-AE51-62B25B3F15B5}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib\ = "{2397ECFE-3237-400F-AE51-62B25B3F15B5}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pdf	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xml\OpenWithProgIds\MSEdgeHTM	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\BHO\\ie_to_edge_bho_64.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\ = "Microsoft Edge PDF Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\Application\ApplicationCompany = "Microsoft Corporation"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/svg+xml\Extension = ".svg"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgeHTM\shell\open	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xhtml	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\OpenWithProgIds\MSEdgeMHT	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgePDF\Application	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.webp\OpenWithProgids\MSEdgeHTM	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.html\OpenWithProgids	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell\open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\Application\AppUserModelId = "MSEdge"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0	setup.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
5080	msedge.exe
5080	msedge.exe
1512	identity_helper.exe
1512	identity_helper.exe
2292	msedge.exe
2292	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	3920	setup.exe
Token: SeIncBasePriorityPrivilege	3920	setup.exe
Token: 33	1792	setup.exe
Token: SeIncBasePriorityPrivilege	1792	setup.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 3020	5080	msedge.exe	86
PID 5080 wrote to memory of 3020	5080	msedge.exe	86
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4812	5080	msedge.exe	87
PID 5080 wrote to memory of 4744	5080	msedge.exe	88
PID 5080 wrote to memory of 4744	5080	msedge.exe	88
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89
PID 5080 wrote to memory of 4152	5080	msedge.exe	89

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1"	setup.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://noescape.exe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff81ea03cb8,0x7ff81ea03cc8,0x7ff81ea03cd8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1724 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1960 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1864 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,10466023070679188994,8191482227693399011,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1800

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTZFN0UwNTYtRDEzNS00RjIxLUFGRDAtN0U5RjZBODc4MEVBfSIgdXNlcmlkPSJ7RTBGMzEyRDctNjE4Ni00MjZCLUI3MUEtQkJBNTNBNENDMzBCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MTdGQzg5OUUtMTcwNC00RkE4LUI4MkMtMTkyMDM3OTg0OTMxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjMiIGluc3RhbGxkYXRldGltZT0iMTczOTI5NDgzNCIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNzY2NTUyNTM3MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMDgxNDY4OTMiLz48L2FwcD48L3JlcXVlc3Q-
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4732

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F0
1⤵
PID:1508

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\MicrosoftEdge_X64_133.0.3065.59.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
1⤵
- Drops file in Program Files directory
PID:2128
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\EDGEMITMP_E564A.tmp\setup.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\EDGEMITMP_E564A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:3920
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\EDGEMITMP_E564A.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\EDGEMITMP_E564A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\EDGEMITMP_E564A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff70eb56a68,0x7ff70eb56a74,0x7ff70eb56a80
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3116
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\EDGEMITMP_E564A.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\EDGEMITMP_E564A.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:5036
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\EDGEMITMP_E564A.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\EDGEMITMP_E564A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\EDGEMITMP_E564A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff70eb56a68,0x7ff70eb56a74,0x7ff70eb56a80
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff756bb6a68,0x7ff756bb6a74,0x7ff756bb6a80
      4⤵
      Executes dropped EXE
      PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff756bb6a68,0x7ff756bb6a74,0x7ff756bb6a80
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:1040

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF780691-ED85-4750-A96E-297FAA1A2021}\MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF780691-ED85-4750-A96E-297FAA1A2021}\MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
1⤵
- Drops file in Program Files directory
PID:4568
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF780691-ED85-4750-A96E-297FAA1A2021}\EDGEMITMP_26A08.tmp\setup.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF780691-ED85-4750-A96E-297FAA1A2021}\EDGEMITMP_26A08.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF780691-ED85-4750-A96E-297FAA1A2021}\MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe" --previous-version="132.0.2957.140" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF780691-ED85-4750-A96E-297FAA1A2021}\EDGEMITMP_26A08.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF780691-ED85-4750-A96E-297FAA1A2021}\EDGEMITMP_26A08.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF780691-ED85-4750-A96E-297FAA1A2021}\EDGEMITMP_26A08.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff61d476a68,0x7ff61d476a74,0x7ff61d476a80
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Installer\msedge_7z.data

Filesize
3KB

MD5
a43e9ce8d33ed6eb2b8f5133450d64dd

SHA1
f2b9a2eab4b80d7bef0a6e076423993b77f66332

SHA256
39bace95aa685a42bb379404c0e4f2a11254a7d5ab9a9b5551d311d1dbc05bb6

SHA512
9db1c9de9521cd7bd4af5062693d3557ab196fd552bb6000c1d4266426127c9c7c6eada263e90f99bf941fb1c863d10463940e164a03e0742ee070a35fbcdf6e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0B40E2EC-F843-4048-8E0D-207F570C685C}\EDGEMITMP_E564A.tmp\setup.exe

Filesize
6.8MB

MD5
1b3e9c59f9c7a134ec630ada1eb76a39

SHA1
a7e831d392e99f3d37847dcc561dd2e017065439

SHA256
ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae

SHA512
c0e50410dc92d80ff7bc854907774fc551564e078a8d38ca6421f15cea50282c25efac4f357b52b066c4371f9b8d4900fa8122dd80ab06ecbd851c6e049f7a3e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF780691-ED85-4750-A96E-297FAA1A2021}\EDGEMITMP_26A08.tmp\SETUP.EX_

Filesize
2.7MB

MD5
1a59a8af3c58b30ff0fe71db2196b24b

SHA1
6b0e5ba36f4fc5328ec494272054a50cafa13e68

SHA256
ba25974b29a25cb7bc1f58a0990a8ce758354aa6ec5b8b8af210f2c1466ba49d

SHA512
f173fe15db8d7aeef4f6fa62a41246550ccee207e6388095a5f87036362d4c95da646e1a7c68764054556e024da80b749646425076e9bfac42fb77be8f2c0355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a14c2ec70a0175c20aceee2cf4d425f

SHA1
47d680bf85143e5a941b9a2e459bca4c9f8e51f8

SHA256
8e424c207cf0e2e4780c5fd51143b92e9e7a8ad36a9477a8a6819e4b3d4c8d79

SHA512
b9c2dd9927a4fbf1628537235178fdc98f849a30ade35607cff43f479011ab82cff20ce21df9ac3e9d6aceda4d8481e30de973a12451d9ee05a091d9098c11df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ca9db6aa94730283d8a369e08f8f710c

SHA1
c1ef5c3b08fa3ee3edec4155a31cd20312cb7b09

SHA256
60ac735f5b28b26af18d6f5b4cbaa8b81a01ada539c946bfd8ec32379b0c3b33

SHA512
27d982e3f854ee4e6eaba491679ecda3f60aa086bd5a75ee7aac61d01db177a68d9f1185e7039c623793974ae478cd1b3d35b5df4cade0204d5c0eaec4ab9d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
48KB

MD5
df1d27ed34798e62c1b48fb4d5aa4904

SHA1
2e1052b9d649a404cbf8152c47b85c6bc5edc0c9

SHA256
c344508bd16c376f827cf568ef936ad2517174d72bf7154f8b781a621250cc86

SHA512
411311be9bfdf7a890adc15fe89e6f363bc083a186bb9bcb02be13afb60df7ebb545d484c597b5eecdbfb2f86cd246c21678209aa61be3631f983c60e5d5ca94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
25KB

MD5
e580283a2015072bac6b880355fe117e

SHA1
0c0f3ca89e1a9da80cd5f536130ce5da3ad64bfe

SHA256
be8b1b612f207b673b1b031a7c67f8e2421d57a305bebf11d94f1c6e47d569ee

SHA512
65903ba8657d145cc3bbe37f5688b803ee03dd8ff8da23b587f64acaa793eaea52fcb6e8c0ec5032e0e3a2faacc917406ada179706182ce757d1c02979986dd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

Filesize
5KB

MD5
bad53b5a727db28d3f8d04aecf91683e

SHA1
aba34499612e002ca0a1767822715aa1f8089a59

SHA256
be8aa712ca6397df8d1d52c436132d974c27fcbd3fe5f8f170fe6fde2192dbbc

SHA512
256cb3d9036ae16d32a138327e03eae0f921bad745063beb40277fea6c2795aab685add10d7d9dd91c35358cc825972088acdce702918c2055372d244ae2bdbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0d8f78ed5ce62441_0

Filesize
113KB

MD5
ca18c85d99aa8073af1b8321a1211d0d

SHA1
83c8e902aa883e9161fb4de00864c3fe44f88d79

SHA256
8d4208d7ff1ac070a9a3be2a3a421a913138dbff31db38674a325ab69defcdbb

SHA512
3c84157137a68b25ab5bb432666aeb66a53bd927d9c9b0db881649da5c4fd543b5eb17b9001da017bf810072d41377b2b45c558631f11c6953b39b99e480721e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1a914eb5fc51fb84_0

Filesize
9KB

MD5
6a99cd7c35dedb1aa2ad007f089e4f38

SHA1
2e28ed301fb1782a1835d8bf8ba3752e6362464a

SHA256
e82cf8ea92b23414cf5754f7aa7de2aa809c3b2a46c59000ecef7ebe4d9c658f

SHA512
ea771105e8e5822463710ca575e31f7db4aba29dd090f55e7946b81f8f211dbcfb69a6de233e0699e2186d632a18e5e5c9423d7faf43ef4f5615c5ed276685e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
6395bb68738ab07019368cd2c70eb17e

SHA1
53145e066caee10407221ce71bae09e52e7b93c0

SHA256
e8b91c819a5f3d4789e1f493632f64a496870aae62a8c10d4b8f51e6dcefd69c

SHA512
45a63baa5ad68952249372a84dd208a014e4ac5cd58464ba65559de20af7e0a82813329f701e3cd3d99bd07d133ef83c251de2ed5b9ef550344dde67e4a98d1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2692617678c042d9_0

Filesize
10KB

MD5
de56665cd550148172ba2adcda19bf1c

SHA1
01a55591f1f16b199bc0264ab012c131971e1bc9

SHA256
6736d6a634c81d7a921501d60813b04f16810de0d693ab0d90e4da1c34ed8100

SHA512
f611cdaaf612e58ce0c052e6552998770cb1313eae40da5ee8b1286adf7556e4774174b2addabb488b9ea581bd4197a9a5c1381c05237f045dde623edd485dae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f4680e8f8f8a14f_0

Filesize
13KB

MD5
cf7200578ff59cccce38e9f3e096a091

SHA1
6e59ae5a72d36924a250bf417ac427f1ebf427db

SHA256
71e183d732cb447612c7aef7c06b0934c2a861a73ae9ef5f0f6cc1e4081dbb4a

SHA512
52f19ef8c2fe1ba05dd4cbe7c19ee42b2042b9a64a8f50b96f83ccaf336eee2719c3465262b79633a34f4138b621f06e96a19d3ec65d3981691f72a8c0ef3dfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3013bbef4d86b206_0

Filesize
10KB

MD5
b3d18dfde5344f4d87a9dde16fc69acb

SHA1
fdb9924209e38dc1c4c091573e2f674a27174c07

SHA256
716b405ce499acd95739de6d57ce1f31bc5e3cf82f162a886c0b08b90f065166

SHA512
727ccf362c1a247de5813324b9e4e970dcae06d532c4e9110033b90e40cbc30bcd0694155f1f29f93abb4f9180a01ca670181f5c61ea444f59770a8d05cabe60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\37afe38eb817b647_0

Filesize
38KB

MD5
0edac0591efddb8b142b2c7aa8b5f09e

SHA1
adbe90d1762274f2ba7b9d1f284b74d1f638d0bc

SHA256
5d2df968f81bc389b4816ff5473360367d24bf00cecfb9fe8e8b8db8d1a74ade

SHA512
af398981791fc0e5c2df2836e655563ae50d5a62d343b5b10b4f2c0051a4f908cad44ec345b9f1f078c41ef1fa4bf6ab445e7ab0685f42fbc02a183dbe8ef4ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a4259a0181983ba_0

Filesize
22KB

MD5
a73cbfdf08d500ffb3302ee660d20db7

SHA1
71d6c399dcf2afc2d38675da64ef54e2917f5239

SHA256
d554cd378ba776a44c86e87cb1e019774a589716ea00f18c4348e692764fc5ad

SHA512
20e6c9a3d38c6b19629759d4f34dbbf7d80ba76854a7721f03e532477fe678a9248cbc19a9eb5e4117e1b33bc7550d3ccb9d50a61dcc5286f9e819c80b766bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
64f59ca70584c944868d4e845be1e03d

SHA1
adb2cf940deb694a1c06d13547f108011b4b671b

SHA256
4a82505e6a148193f400f9701049641f91b467962aa903dae563985fefed003e

SHA512
fc2d49e2b31c71f342616a720e8c53ea11aa62e0656efacfee41562e9346440f35220493a156d936835ada3b461be4f9868b59f751e9548dff9f7a6a6e55ba2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e9b18b0f66a7183_0

Filesize
1KB

MD5
a6053d922bb567abd32a28a2f946f14a

SHA1
b9b1f24dd611566f0b58073f01201774cfae6324

SHA256
8e0bfecad7d32c8898699d3d026d970d2d114776b426d9e31706c7974d7cc561

SHA512
216f4b16aa74ca683edb41f78b09e2cff4aa0228fbaa40011e34da7af22a5fa19defb628040a3cd49dad2f68b2d792fb449792a4efd1a6f10dee45d481136dbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
3KB

MD5
d9dab1bc0ef67afebe94e254fe48a7c3

SHA1
14ef7a1e63935d26e7604be189a1267d61ab49c5

SHA256
d9bec6ed86a28846fae8708d53cebff5e65acc72572d9f36f185511bab9f0696

SHA512
e2c17af42ba9a0ea61d02bcc3ed6dec8bb60f480f5bdb79e07090749b8d0748cc8b1aba0f5ee66ca9148d40539738135bfbffa9cab5983cba4327faf1f47700b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5dd1e579c9681f95_0

Filesize
2KB

MD5
29122eab609a861c0fcd9ea390227f49

SHA1
c131cd3e427ac9f8f96e3b2f6d1f75e4265a907b

SHA256
ed7c1be268b967755221f2d8ae2444979e27a44a8a0d175b60fb79bbd3a0e1a8

SHA512
18540ec2c15782ce7449eee6e70b17e6e3f9938639adfb72a5b0bc4dcff612c671ac82692864276f9120254d1a519c30ba6ab2f9d4958f5a313a9c7eb9dd2334

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\617c67435e3c2450_0

Filesize
210KB

MD5
e6a70baac9afe351e5e3b3e8fa617623

SHA1
afb2f4a64893827fef5cc37ef93b87628260141d

SHA256
fc950a8c3dd5fa0dd5f291cc390188013a3cac9d9efd7b16a063c50d66ea7192

SHA512
9fcd168d1a8868b9dc46820445aed28cb5e38ccdc875fc58a1d7cabd25472cb1961a3bc71a63e077e4cc4e0f9772f5f5e1726886ea8b9d8a4bc24f1885e17dad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0

Filesize
14KB

MD5
5dcd3f0127a72a7e59beb88afb6c7967

SHA1
29f0136bd75287e90da5d7fa715cd52550ca6073

SHA256
e7951cc09f0206e868617cfd303f9a67cac3dcf4088c9b807fbe1b2b78bb1a6f

SHA512
1d67768e5cef405c4809adbd00019ea01b26d92c42d4be3ad3a1a1f13f9c637551c59b4e55e374cc43d55cd01354b8c1464521f4cdba7fa007989d490eee9533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6db290dce274a012_0

Filesize
4KB

MD5
acdac8c00c673998480c5770c4153b47

SHA1
9bd5fa07e3f2c457e1f8b17b36f03e0ed0ef42e6

SHA256
9e625e78c98a8c1dded344eabd701a95c184373d54a2bb70592f255be481600e

SHA512
6dea9d5214de893ca656b32d254d4ed1f39384bfe145ed4144488c9f246a792b827bff3b5b45c4e8cc715bff4720b72b01bf32d312e3ff214246908bf8c2d030

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71d68e68ea4089fe_0

Filesize
6KB

MD5
00e771fb20e527969246316f08b3152c

SHA1
44411d9dd494d371aa19a46d84a88c2b9973d3dc

SHA256
b6243de125a393f47ea960c96c211c9b5b4db9477eb9683d76f13f3608416561

SHA512
30bbf5593f798d571f08ac9c3e5163612ee4c007a00f6dede261c40570d9295afeead40e58656a06c30644d1f163a3ed13a9289a44b5f265df0711a8d69e5e8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
1KB

MD5
348fac73c4d6aaf52a0731f27567e224

SHA1
6a9c58a8915a39da12ad9b8856887ab913ad8574

SHA256
255cc315348501749c07fb1eb4821da41f6863b8ba8240a5782252e2c7697541

SHA512
eb1f162e5dfef7d9f4f54425f15f2fb06c9893e78af6c4beeaf89b5d2e7366625d20fe00862e5d6ad260eac90f79220684c69b6d314c613c163c745bc9b66306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\78bc646c0524ce58_0

Filesize
2KB

MD5
5692a1a8043ebd4c64a4f8cb2dbe9bc4

SHA1
75e2bebda5d8b065cb902ddc5e145d2120457c1e

SHA256
a1f83c6a4486af53dd9dc3d231a52f830e4df4905d2d60adf0e7378d49374f40

SHA512
df972db6e921e960c11c3561741f24089b4d0a678d412fbb629f45a470bba0566b1a64d8c72be4ac0e2d44eddaeadd491c78863f2504fc0d543afe63e9e83760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\82af833e9b5cc26e_0

Filesize
2KB

MD5
952ee2811a1d2b2a03ff541d47fbb60b

SHA1
721b3b467b6ec515d8938e80dda57a5239a191b8

SHA256
f586a54259f774f6ba6a8a505a74381913de10fa95422afb144ed4aa56810e13

SHA512
a0c4cfb0baed697a2dc1e2be468ccc6d6b359762eae623ea3bcf8a9f65aaea29434eb87b34f9d11ab1f7a427001af3986ec880a5a9a51c445a44f1ec85c5034f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8443d3a592a17a0f_0

Filesize
294B

MD5
474c37db485a5131d45f24da6d7c16d4

SHA1
94cdb890ff9e6a8d47cee00c7cabdc36d13bcb66

SHA256
50feed191030f6dbd778d67b9dadcea2bd23b72a15073eb4aff966c3081a9d41

SHA512
969523734f5accc7a84f4e3cbf1c34f8b8f94a7608d3d188abce01693f718a8b2a044999999faa3467a6fffc12eb8615aabefc1d2065db5618cf4ec4354b24e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90d7d7591a1b39bb_0

Filesize
262B

MD5
cfce921d725d975592961cd63972ab10

SHA1
7ead5f30560676c45b3c3cbdb221082cc537d692

SHA256
890eccc522b09b17df9ebf6d11f6023101a3e9cf6e894e16ff85e94d3f20019f

SHA512
af359c9d61b07f10212ef1e49acbfea79138581c688a7471a4110b0fe295b549396b2f9e5f00da1d0d90cfe869756e8cf1b812d5559064a7db3e84c05732f373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9238b1a4a0b3a1a3_0

Filesize
175KB

MD5
a9725f1bdc595c66a47ce8ae0eb4ca1d

SHA1
7b3c6fb6eb174b0ab2b5c713005f1e134978e3c3

SHA256
9e1fc1f8c0b15bd73f18d884a6b65d1361ee092c9a57035616d5d67fe29a7d8c

SHA512
e16ff253afc9e3b37608d4f51e2760ec853e3784156831b1ea40943e2ba96c4b5b81970e49b352be83b0f11e5ca6ec7ac75f8cd25b96525cf89f5b79004c6eed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a28b766f2e67bd61_0

Filesize
11KB

MD5
bda2f77bf5d9b5f2fdcd3e7fd6f40060

SHA1
a1ed50652468e961f02e0de1817595178e993b09

SHA256
14a71b0d38325774e9f6b7210f60b6c13a97177d68207194f1d5587984d71231

SHA512
450b605fe5d45cbfb3f81f40d4338cf5b7a49c12a4883d992b20391098cadfb600cfb6d447aec3bb40c0c73be63b0799b583f1ec4ed8fe4369380fa418771377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be6d12311ce2b399_0

Filesize
2KB

MD5
2a21bc6961339d293815ffeab4f7fe3b

SHA1
a7763b957f259aec2297403c97e03f7a162a6c67

SHA256
ec8e32a1470894ca825911f6cf027326284bb5e0d5a09e021bfc53b936b778a0

SHA512
2baabd17263073389e65e063d943fab6b5d57ef5beef597e7e73acedd11bc25dde3ef9606a335a5a4ab59048ea53ff199660de2a540078b6d79e9ba3667c802c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c211c9dc68f4bf01_0

Filesize
2KB

MD5
714fb6272ac8a8250e5a380677de9772

SHA1
e30c361584cf29f229341973341acbd7cecfbfbc

SHA256
b6623497c25a4051eeabe6129b47ca796834890700bccd39a312737cfe2d1cdb

SHA512
de1be0fb0157a299635461b53431263beeb351c90b6be5ceef5faa7b873af03c7a22b6ca4a6d020ec957c636333958be40e18078d04dd6f3107eb413442986c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ce003bafb7f85a78_0

Filesize
262B

MD5
21f713ca14c6350d533993867c2848ec

SHA1
5150c057b971f6e0243607af0dbcc7d183d9a8a2

SHA256
4d3b71067e8b32c1d45a1a2f72753c2e8d72043c17669ca2f103b9da59570f70

SHA512
01748e01ab0deb18c15eafff86ebe304e1e0deecc7af1ffaa1ed44fec552c412d974aea0374bc36c84552bc840c6c207a19f61eed1557b34f25c71ab4596fe2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d14b77eb7bcbd2bd_0

Filesize
14KB

MD5
bb49faf4dcb20dbd51da336226cb099d

SHA1
7eef79cc9e19b211e4652b04488312a552e81556

SHA256
f41313520f7e75ff0241b163670c0bb78d948f6189b1ae5966466eeb3d7f95ca

SHA512
23b291634d48877b521f95772528644f97cfb946a83edbef42f9a454545f861fea3cd73762ac6bacfd8e2b5f90c8ec7b72251b3725ee7d84ea95e2adb856e199

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d45aae6d8d9c9ff2_0

Filesize
2KB

MD5
21966332ac7fa2a4bcd6cd8213c4b48d

SHA1
2d647c72209c1d5f11569adbec92db97c49f15fe

SHA256
9bf108b4b5fb5a95fbd5cd05f79490f2a22a3399d02068f01967bff20aa920fc

SHA512
ef7a4e8718fea746bf75e09ad24e87321d530edb9941b588ac281338af16622cd88d89dbf77e9f4e62bb2f98a36cdf9eaa8207f9fac3e4c4a78ae1d200b379ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d79e0a2891fc014a_0

Filesize
262B

MD5
8720b527ef414c38c941f820ef7411f9

SHA1
c825f769ef4886b98f169871977cd6d3c90f40a7

SHA256
8f4ec15de84a222a66b3a3da12d944ce6aad35fc2b9cb58a29c8e676cb3aead0

SHA512
ce1f0a85242f77fa6e501175127dcbbb001ff6dcb82f17c0fd8ad8c7d21944fd93f509ab1e4d8a80c0724ecb04db7b824de40a2e35710998ce58cb283392425a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d7f2ee8b1d1b96ed_0

Filesize
291KB

MD5
59f32a8df4452cc39b710eefb97c3c3e

SHA1
11feeeebae264f4e5994a8e3e308d4e001a39265

SHA256
37909ace407d70aca373153f5b91c5d29fef748d9f74bfe4ce008cae6a8df2d4

SHA512
319118f4771e13ec61ac9c603721bdfa18246713b183c1febe14b8c95c83bc7ce21feab21f8e4dc2b69d31a7708b052f7e38850b5750d7e7bf2a3e4e91a63b89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e146fd968644d345_0

Filesize
10KB

MD5
21672b286b00befbfa5e40c1bd64e6d3

SHA1
909b0c965f886f912659cf3a48db1bdfa0e53f0e

SHA256
15cc90bc158128fbc5cdfff6637049f62afe13ebcbcd5aaee14720be11af64aa

SHA512
10435b866ccca8680108213b8977ccfef296e909225f5cdd3feaaebf8120e5584ab9e5ba347f4fdd7f1a1cf908b196a17c15b69c850e1cb9a60a3f7f12feace8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e239929a95f56ab5_0

Filesize
4KB

MD5
2f0895ef1625cfa2dbeeeb6da645e234

SHA1
67e71afe2433ed2b9d6ac75503137dc9e91df7f9

SHA256
f9f80c578000359788e504d58cfd3f5af2275bccac10b0061aca47e7bfab6970

SHA512
0d2f504b8abddd42ab59da052af9b320e06a3a60c38b10e63eba33ef3d20e2746fca310ba4f788a493d7b46f0a4442ab80cf6ccc1c453e71f453d90e9242039d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e55f0a6d1b533c66_0

Filesize
2KB

MD5
6c07c26bc2dc4f535c52aad704adb5f2

SHA1
5d3f32c86851275d4e949c3d9c7ba91d76934a78

SHA256
ddda2d1a9c56f25b33f6bd2449880c40368ef271cadd0724bcdf61ebd26d2dde

SHA512
c924d510261c670ee2e66b76aa56d3e1260cebdadd5a129510e321e495b7dc79b3e68d65f989f608a79f33c760730f911b358a282481d0d45f69b88297a5a773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9c7e700cc3e33cf_0

Filesize
48KB

MD5
9d0620fd311ec6af97251b2ce1a7165e

SHA1
9211d9ca096bf53d532bff72be7d523b7331f3df

SHA256
6ab09f9305772e739594a3f0a9d2ad1eef5dc9be063a202bdefb66fa3b1789c7

SHA512
45ff9fdca60c8d2a9a2b077015f81fccb710c41ae5dbdde3712c6223bf995c91a7e4229cde337b525469c05721e233af12a43d022ace7312a374b99c4ba99d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
514b9915d569056b42c8845b7da307ee

SHA1
cdd57db5719eb6668789dadcd2cccbb35fc01e05

SHA256
8b232fbe17bb7146060607e64d5412db4fd328ffee2bad4e7f8662800ff4ce56

SHA512
b253250528c8f18c7d9cad2309263eb25c2af22b672ffd44ffc393c2dc556fea6794f6c363f33740beba071e03d2d7805bd4fc8ae55ea80fd835e6953c0ade79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9b2eb8305ac475ccf27465d67cafacec

SHA1
51b531efee3ef5c6ae440a986d3ad4da272f5cf7

SHA256
e9de8c26cac66ac0fbfca356d38f46931a9fec46c30c9731a5dbc6862e92a399

SHA512
440001b281f80ce4eb63f611353ce44fdffc735a364044ca09ca53e656fd6da5291376b5ca871e08c1845705e4273a3a9bc3bb417a962f063e1277d09339743c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
441d3e126aa8b63da0267762bc4eae30

SHA1
af00d46fb18a4dbbbb49007037b0b3257f979764

SHA256
7cb2ade0446581a0fb632ca1e350e16fb985ac7c461584ccabdc8db39f7eb25f

SHA512
266cfff356d6a3b8096168d4425aec3fa2b5c1b427be1772928faccb53cb670b10e426ab4581f05f12c79f68814e31e930acbf9fb663045446e021822457496e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c472a6d89ffd4ef004a64b5538987977

SHA1
e054667aa1567b7c34f79f28da38106ddb0663a3

SHA256
ee097bb5f41ec40fd844e4d67c75bf675437c3ff8e872e3d5ebe59f14906273c

SHA512
6966e6016d5da1caede463925547dd024f4053d07920361d6fb87326335fb3546a025f51c2da407d7ee1d3a8ab688c396e3601854505284cb46c182a6a054e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5a09be1619fae4db5bf8415a4c76cd0c

SHA1
16523e811af43532448096e476e9b03563303239

SHA256
77cd1f7ea803aadffd413a7d59aec5c4dcfdd161d25d288d88b8f7b0db807401

SHA512
c6b450c8ec7955d03dd725d9983a7516ac242d9c1c956421a76170247226e3afeb58ddf49db5a919166b76fe6756993a85f615ebd576597de30c09fa0af83ef3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
45ad463a68f08bfe159de64d7f7387d4

SHA1
bd64cf4688345d8d5f130f3b05d53727936c8d37

SHA256
1e1a44c8c5818b764c9624cf73057a4ff9416aa3b3ad632c063086708de70eef

SHA512
752cc422afd58d37b959c3cc67cedfc87e0f22b7f43ab1e38fdf6ea6f325ca0cba7fbf1560c49b9007a03b845e64a1940c4837050d404fb70c497f5334dfb518

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
799a6c74393f22f6c3b9d487ef52a88d

SHA1
ba8816504fda51d874a531a4ff581b6ea14a9ed5

SHA256
9fa7c7339ea4eefe29737803adaf523922147e95f68685c5ffd67267d183abd3

SHA512
e4d837f0b20c9f6c310bf15aadf0eaaf844908358a9fc4656b9212fedf97612fd0dd9f3b96f4a620d7e406450de639024faa90b420dcd77e8e6c0c5168abedf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
999B

MD5
ca1986cb3bcaa66cc74893e76ec7e0fb

SHA1
e26b81db847c6b20a525f41a9d88d9e4c459f7de

SHA256
1f57aa9d7bf432e027ca9560a5aa498f49a5ba0de33375ee8a3351b321f7bd08

SHA512
ae14156d7b4bab61155107ec4c3ea65ce1583979021feacb4d54b97f8cae41f9576d29d0bc27eb1474ef62eb376648bf5d3bbccd0b3a8ab6033e5d87536b52e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
835B

MD5
3cbd078bac847c5b71f09b9b0a7a4458

SHA1
f94a67216c4e5ef9aee4fea7f87c0a3cd4002ac6

SHA256
77cf5335005ee603f7b4e190b84b42f66dd0755e48d12f5816e7d63318a09483

SHA512
30dde8a210cd39b30bb79299728e839793fc2599db470e847cc3e252107640e5170ce80dd6122ae690c8d80184ef0140903a11eb66733b5cb82c9a8672fc7a29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a3847e0bd03d91f091045a9ae4145611

SHA1
c649a0702d850dbdbf1852f81c15b79644b9b90a

SHA256
dfc9dd3b91f2f942972a60089f4ad519561bf81aa9a4876ec74563646b3ba5da

SHA512
de5e368ff3d03301212d91557f114497ecc65fa92d00be0dcdb1f038146f864bcad926c3e5d5dcef7f4f8ea9c9424d3ce1bbf5790113e71c3ea6e846297d1cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ff3bc48cdb23f66f95dd52404419d7f3

SHA1
4ddf4344e75850a1c535d81d36851995f2b9dab4

SHA256
026b1f8de6a58c8f739c35ecd7d9074e894d6274da11f7b4b34a71891dc0521b

SHA512
943381076db4953776d443932c746228d11fdbdf2333f6ccbaddbd285fdb73f3782ac036acc3c3f488881c03fc71367ed24774059a94c3ec8276fb9f879e9616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1078a1f97d61cd8d76e82e01d38c65ab

SHA1
4223ee900cae5e91c57857c04d94b57bc17dc2d2

SHA256
49e608085797c9f1d8f4ad2e285d8ccb88abaff679d7e1b06f097fb7be7547b5

SHA512
902bc91e1af62b1606f73f4ba65d3978e30374098c8c24b1eb87044ab6c608377a3dc529521b1c12ff59d086157f95ab81a9505c7346610053f372b80b74dd00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
305b627485d13501ea233adc116424dd

SHA1
68a141ef5aba3959358e122c3af55dc1f481d59b

SHA256
ea0d6071efab50730057920a0807ca6da4faf3e68de6a2d22d90751fd0ed5677

SHA512
d6ebd06e28d4d95090237e882982af1b88aa6e4a292fc45b87fe560b915e63566c6807f342b45a3c263b94609b2ef00af970fd268ca09f74313fad2cda638f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ccb5fe951f56746f5300421fabaf220b

SHA1
c4521de38deabeceaec5db37592c840c019838be

SHA256
f952c93542283ff4fa5966d076bab878e4962a6da9b06778b6bd10bcecb4d298

SHA512
449823c38b230db25a475f0014cc7e5a87522e1bc0fdd764ab7d4b824b4304dc6a7c0e8d93430c59bfb9112ad9f64a13ac46f83ba6012189643591c7aada67dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eeccf074c6cd831a3d27a64075e3be17

SHA1
6a56bfd59bf1e704d8e086877ff4a2d9b0b809e0

SHA256
836dc05aa501bc66219cf3a273d52a50b271bad5b758de3213135f599f3a699b

SHA512
8b8736777c83dba60ffd4d911d1436a28293df08ad9faae4cc6fc96c78a6db25b1e123f3545f2c9f339a9a2010f86b7ca8bb4ad20d26cd721ea371f86950d5d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63861da7ef76948543453be03e5a78fa

SHA1
ea98e9cef3041aa785acdfa49fdea1db8d1de1d3

SHA256
d5569a37c386b1861df811518d2966a38753c7fdf9e35b601364ef863cecad22

SHA512
223f625dc3c6f9048c49c52b23dd5b47a2a82b06b197e8a965a6ad2b6c385f76432d9b8bc3377fad8589baccd7bbd39bf15dae14b13fa35a5ca3c4dbcaee2d17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c9c1f43981c85aa4c6aea45a5886614

SHA1
c04eb0fb6b1702f48418adff340d5c520651cc07

SHA256
38537039005bb4722c750625fc04b8ca3991e9ee17a8f948ef5104c0b9bce7ed

SHA512
18e8f393a6a362da0d92042c46b35b313bcc2e36d421d7220bfa53db1ae2f7d47a7c2475f378935a9aa6cf281a29f5eac781c6da3fb8379fdfe66a9839045a01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a52a62908e926bd86239fe4553f4174e

SHA1
689e32da941007dad878dee0e59c51f95474ef66

SHA256
673ac6f49acbc56bbc77c54436379b33fb93299a1ab6b33cc2ddc82f18278cca

SHA512
80f36f586b1006b29048e5747256fa8e6c7dca947e949e81dcbb937a35f403dd7adbfae6f46da463b8329228cea7bf966071f3ea3daf7dd97b4647c4416c84c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c51e309733ed1caaa02e597329ee775d

SHA1
f78c82cf24041596371a0f2f4e2acbd65d37b5f3

SHA256
b8e74d02c07eafa9c3c3c63c1079ab9b8709be2142139fa99778cd51f824e0a3

SHA512
d32f37a5389a723fd620ebda07f170461a6b52f468dea62b51aa451682db03c77b82742af18f4c5ea83a1ce9efb1e706a5027f1f6b2e152bd7d0a759c0a442c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f81aef03caf1f26b8780acec4f67adb

SHA1
49b0504d8ddaad967dca8fbaa2aaecdda918d964

SHA256
b09346ad24db3acb4a527980565c6bdaffb394050db32c09a6b36351fc01aff2

SHA512
183d5f0c64f0f0b98c8e07115973b79ab4b75a6532c4bc4e916b32b22b99a2435e876721578d0323157adaf2d47d98d2088f47648e3da7c1f915d33d6d1f585b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
bcab76f65c2433ae998edd9a9e39230e

SHA1
be4e30778fdf158f3ea2b56f33dfc3e7f7bc298e

SHA256
fa7d7650c645b46d342da428812ed6dc7b36af0305d261a1be0a97a7a85f9244

SHA512
0de4df2de18c1822450d417b763700199ede11a0a1db584ccb02b7106fb6d16d65ef7ca6479fd02965c225d18beaba1d1d7873f4f442522d11d263aa3a0fcd4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
33aa5945a23bca5a0c7947307dac04a6

SHA1
18778c7ac4f38264161e59976f80d756b56d4216

SHA256
ccac3b32cf9037a53a60c33fbbc37175a85c4995a177ee07ce7bbe61c91834cb

SHA512
e81c17d3a29ae57de1432daa730658f6f4822648fc7ae54fb1312ada190b21179a9810e48bf84d10eb01f9559ca76ef6d02c562871cb1fc88268703057b60e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
8bf72e8970e0a43086ea1bbcbfcfb1d6

SHA1
1a2d04c3605563dee6935268d8330226bfa6bfa0

SHA256
a00c6f9c3ddb9e07ef991c715fe5b0e557d8418cebf0a8b370f8ead6d3f5df2c

SHA512
d102cd6f669f4587598c2969579a7faf5d0ccf257a2e6e88cbf10f67b131424f3939a0e6a113042313217a651db3f6b1fb45a395fb0ed100536d0a304ff3861c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
6b59a7f0759776fc4365e29937cdd793

SHA1
fb795690c80e610945753d8236136c750925a526

SHA256
d057e6b72b3e4a37ed7de1123b9248a9f2ea9a307f2d7ff963ab29e842762d57

SHA512
28a94a29bdfffe9bb38427835d86e56b7e68847257532f5c2eda4c91d2a47716390151f9039288c1ea61782ac159dcfd2197bde1ded40e137730826fb0a10e81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
8e7f8530b1b514eb5db51ce0ffa5518e

SHA1
d5c7987b883d4ad76abfff999425c7f84a7c292a

SHA256
53a98f67b547cc74783442bf0c643996cbc473438401f6c37b7215019212eb42

SHA512
cde5c6f7a591b94017c7b6994174d53af2f8400c250564e33ee3e05fcbdb24d5badd694b4bd5ab33a5cd2194963ce0157bd6c5dbb5b639d35bc9d005dc91fba4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
d064f94d915a4d1dcaeb73317cfff79a

SHA1
43acf1d435ac4462467a3258bcb1679ce0927f76

SHA256
b3de333c382f7fe0aff5fafb92ddade5dcfcda38ac9cf67c1b70632b5012f4d5

SHA512
a823d9e8546a98145a4d187bec487271300d31e5430bba6ae6cbb0cbca2f813f209eba75d0ec92101f737c04ec355f060bf1a718a4281b803757ae0386f2520e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
f3eeb623609db292076f2b910b664174

SHA1
f4cb076c4911db1e0eff2f4473d2c2a5924b416e

SHA256
4fd69904a39f8195bcb77324f2359049122c7b1faac6be11ae2bea18942139f0

SHA512
653d8cdbac248b13a9715b0dbeca77176a7489c799f2400beaa742b90de9f42965556212ab02e2db3880263e7535a585ed92edf490a7f5eafa01685decba1632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58394b.TMP

Filesize
538B

MD5
b1bfa1969064f4e572cadc2dd475b785

SHA1
01c97613a7beccada396fef9fb8ae9188e10955d

SHA256
d80cba70db5dd348aaf8b01a036bd492fe5b3f0fbddba8225b8d4c70cd28eebd

SHA512
4171f9930f90e1b86af1a667bd68e9340e35a8676cf400dd0417cf996f0c3da00ee68f68bc57cdddcea8c7e6a05f5daf5201bc6acc21c1046bc62d6990230ba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1c347b1ced8226c832db0e5f3b357a66

SHA1
a2a4a98fe009136308585a43340aa4910d99ad07

SHA256
f5d9466484fe9477d82af1e1e7e93a26c9458745dd392f42f6b18aa6d422d32d

SHA512
3e4fb4554ac853e67a3610321f49d390704aa5b780c1681e26a90b043e7d7c7d91b87bfa4853ccb2feb905b2fe7a54e0eaddf91f3ccda55eb36ce4b6f519a44d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
4cde6765df2efa6dc4009572ce69226a

SHA1
8c4c8bdc5ea2610c06f8b8d0a455f3d27837b387

SHA256
4e8b3e8f711866c0ea968c1984d50fe465e798e4d18d86c94de722578a292189

SHA512
0a414d7ef7044bc5a2c828752101cf9d187eba74d398d60c6c9f51c4b100b56c04f3f93371459dff8b0c286fd673ffabe29ba85c1897f9bb515b51e5be34b5f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
08467e94bf5dc5d30b98592603f2a383

SHA1
6576e85c493c963ab5d65400e24dbaa74ba58415

SHA256
de61a21a2adaca4dafb0d4609e185c542f5ed0873d86de324b9e335f349bc411

SHA512
81a5b03dbff070fbf7ae0c4adb94f9c5b6d671ab424d436477a947d0f1c42924ba928ea24ea85895ac7d579a2a041c4644bb8089d45d96e17e0e21443faef7cf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
34a80ffb5add1f49d0bc7e59584cc629

SHA1
b4408bd72b2df23fe1fba9870cf3de755ae97db5

SHA256
08f6386f12f964fad28f0608bfc6bad915c953d0f82d66ac61b526f82ef18442

SHA512
1132f148e3d3e854c43d909b750e141ea855f0facd6cdbb086062ffc29dacf2482bafe82403ad4d9c8a7040a520cd73fb3165abb7f3453e1246892f7a4206bdf

Download Submit
C:\Windows\SystemTemp\msedge_installer.log

Filesize
73KB

MD5
5afb8648a987aacb1df3364ab134ecbe

SHA1
238d7ee5ec7deb4d043c178adb15d1e62c5a4040

SHA256
62120e69d245c5da14ea428bdb94a02c0ef9114668d99a6a74f1364ef05d89e8

SHA512
cfcb86c221b7a6eede94e05c6a39676973b11d964bf48184614158743dda415271563f7866ce722748e764a84676268fb953cdc1dac4e1665be114bb65715e65

Download Submit
C:\Windows\SystemTemp\msedge_installer.log

Filesize
102KB

MD5
c534f3b26f80b6ddffcde07b108ffa43

SHA1
01e5d6592ae627726fb4c904858c8628edead208

SHA256
a04c20157e762e30f9feab3d69753afceed084dfbd36e8ab9c3b4f7f5fc7734c

SHA512
de3cee92e501b7ab0c413b987e466ce165deaa8676cfe61411e0fe3af4152e1d72082a46ad4879087c5a62d1156ae8354efc352ab59e9279632e1513ee8acfa1

Download Submit
C:\Windows\SystemTemp\msedge_installer.log

Filesize
104KB

MD5
efff2a4522d392dddd17d9359367ce67

SHA1
089070ab78f4da20d5424ae4e31daf4a63d8c063

SHA256
85fd9338da3e152f9912d36f4380225f32dcd0569075d1500ea1f5d2539f8082

SHA512
675839299f18ddf5ca4f4d4f82df4524839492cf279a5d2a4cb2e3ec03fb540e3cecd9779504273cf8892dc43a836b65e95aecccb8d74be6b0709fabcd5d74df

Download Submit
C:\Windows\SystemTemp\msedge_installer.log

Filesize
106KB

MD5
b473fa6e70fdbcca96c45fde01ae8ac0

SHA1
5eb0cd562460d26d2a153f5ae1c8151efc47e9a6

SHA256
443cc9d17f2bee30383bc64ccffc5705e19c2f7ce49e5819a3b16d41d159e902

SHA512
917c8cb2dd48d9f00f3376caeed18f1154542df37ed7d932c8474b62b0d86ae02e61ecaf8c0aa03f1b5ec0b32acde10a51ac36a89e7ac4c586133498060b8c08

Download Submit