hxxp://d | Triage

Analysis

max time kernel
900s
max time network
900s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
16/03/2025, 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://d

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Control Panel\International\Geo\Nation	Windows11InstallationAssistant.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Control Panel\International\Geo\Nation	Windows11InstallationAssistant.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Control Panel\International\Geo\Nation	Windows11InstallationAssistant.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Control Panel\International\Geo\Nation	Windows11InstallationAssistant.exe

Executes dropped EXE 7 IoCs

pid	Process
5872	Windows11InstallationAssistant.exe
1748	Windows11InstallationAssistant.exe
2944	Windows10UpgraderApp.exe
3548	Windows11InstallationAssistant.exe
4080	Windows10UpgraderApp.exe
4420	Windows11InstallationAssistant.exe
5020	Windows10UpgraderApp.exe

Loads dropped DLL 7 IoCs

pid	Process
3200	msedge.exe
2944	Windows10UpgraderApp.exe
2944	Windows10UpgraderApp.exe
4080	Windows10UpgraderApp.exe
4080	Windows10UpgraderApp.exe
5020	Windows10UpgraderApp.exe
5020	Windows10UpgraderApp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktop.css	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_it-it.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ru-ru.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_th-th.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_de-de.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_tr-tr.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_el-gr.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentOOBE.dll	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_lt-lt.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_pt-pt.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\base.js	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_de-de.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_lt-lt.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\ui.js	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\ui.js	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_gl-es.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ja-jp.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ca-es.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\base.js	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_sl-si.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\ui-dark.css	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_germany_region.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_bg-bg.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_fr-ca.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_pt-pt.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_zh-cn.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_es-mx.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\WinDlp.dll	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\eula.css	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ar-sa.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_en-us.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_fr-fr.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_zh-tw.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\block.png	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_en-gb.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_lv-lv.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_pl-pl.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_cs-cz.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentRollback.EXE	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_sl-si.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_da-dk.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_sr-latn-rs.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_fr-fr.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ar-sa.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\WinDlp.dll	Windows11InstallationAssistant.exe
File opened for modification	C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini	Windows10UpgraderApp.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_sl-si.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentRollback.EXE	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_fr-ca.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_th-th.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_sv-se.htm	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css	Windows11InstallationAssistant.exe
File created	C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\pass.png	Windows11InstallationAssistant.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-shared-components\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1457366823\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1431197709\hyph-or.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-hub\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-notification\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-notification-shared\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-shared-components\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\wallet\wallet-checkout\checkoutdata.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1431197709\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1311548806\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1311548806\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-mobile-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\Notification\notification_fast.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\wallet-webui-101.079f5d74a18127cd9d6a.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\wallet-webui-560.da6c8914bf5007e1044c.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-ec\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-ec\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-mobile-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\wallet\wallet-pre-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1146922436\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1918835234\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1431197709\hyph-nn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\crypto.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-mobile-hub\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-mobile-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-tokenized-card\es\strings.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-hub\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-shared-components\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\wallet\wallet-tokenization-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\Wallet-Checkout\wallet-drawer.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1407046027\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_687838494\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1431197709\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1431197709\hyph-uk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\vendor.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1457366823\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\driver-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-shared-components\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1431197709\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1431197709\hyph-sv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1311548806\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-notification-shared\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-notification-shared\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-tokenized-card\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\Wallet-BuyNow\wallet-buynow.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_276806356\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1431197709\hyph-hy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1311548806\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_76635321\shoppingfre.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1146922436\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-shared-components\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\Wallet-Checkout\wallet-drawer.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-ec\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-ec\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-tokenized-card\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_853360100\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1431197709\hyph-be.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
116	4020	WerFault.exe	149
4276	2944	WerFault.exe	158
6120	4080	WerFault.exe	164
5548	5020	WerFault.exe	168

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows10UpgraderApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows11InstallationAssistant.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows10UpgraderApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows11InstallationAssistant.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows10UpgraderApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows11InstallationAssistant.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows10UpgraderApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows11InstallationAssistant.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Software\Microsoft\Internet Explorer\IESettingSync	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Software\Microsoft\Internet Explorer\IESettingSync	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Software\Microsoft\Internet Explorer\IESettingSync	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Software\Microsoft\Internet Explorer\IESettingSync	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Windows10UpgraderApp.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133865762693128473"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2123103809-19148277-2527443841-1000\{BC25E2E2-3127-45C3-B6D6-5B862D5449C6}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2123103809-19148277-2527443841-1000\{B82ED35C-00D2-4F78-A993-4F5914560548}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5788	msedge.exe
5788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeBackupPrivilege	1748	Windows11InstallationAssistant.exe
Token: SeRestorePrivilege	1748	Windows11InstallationAssistant.exe
Token: SeBackupPrivilege	1748	Windows11InstallationAssistant.exe
Token: SeRestorePrivilege	1748	Windows11InstallationAssistant.exe
Token: SeBackupPrivilege	2944	Windows10UpgraderApp.exe
Token: SeRestorePrivilege	2944	Windows10UpgraderApp.exe
Token: SeBackupPrivilege	3548	Windows11InstallationAssistant.exe
Token: SeRestorePrivilege	3548	Windows11InstallationAssistant.exe
Token: SeBackupPrivilege	3548	Windows11InstallationAssistant.exe
Token: SeRestorePrivilege	3548	Windows11InstallationAssistant.exe
Token: SeBackupPrivilege	4080	Windows10UpgraderApp.exe
Token: SeRestorePrivilege	4080	Windows10UpgraderApp.exe
Token: SeBackupPrivilege	4420	Windows11InstallationAssistant.exe
Token: SeRestorePrivilege	4420	Windows11InstallationAssistant.exe
Token: SeBackupPrivilege	4420	Windows11InstallationAssistant.exe
Token: SeRestorePrivilege	4420	Windows11InstallationAssistant.exe
Token: SeBackupPrivilege	5020	Windows10UpgraderApp.exe
Token: SeRestorePrivilege	5020	Windows10UpgraderApp.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
4020	Windows10UpgraderApp.exe
4020	Windows10UpgraderApp.exe
4020	Windows10UpgraderApp.exe
4020	Windows10UpgraderApp.exe
4020	Windows10UpgraderApp.exe
4020	Windows10UpgraderApp.exe
4020	Windows10UpgraderApp.exe
1748	Windows11InstallationAssistant.exe
2944	Windows10UpgraderApp.exe
2944	Windows10UpgraderApp.exe
2944	Windows10UpgraderApp.exe
2944	Windows10UpgraderApp.exe
2944	Windows10UpgraderApp.exe
2944	Windows10UpgraderApp.exe
2944	Windows10UpgraderApp.exe
3548	Windows11InstallationAssistant.exe
4080	Windows10UpgraderApp.exe
4080	Windows10UpgraderApp.exe
4080	Windows10UpgraderApp.exe
4080	Windows10UpgraderApp.exe
4080	Windows10UpgraderApp.exe
4080	Windows10UpgraderApp.exe
4080	Windows10UpgraderApp.exe
4420	Windows11InstallationAssistant.exe
5020	Windows10UpgraderApp.exe
5020	Windows10UpgraderApp.exe
5020	Windows10UpgraderApp.exe
5020	Windows10UpgraderApp.exe
5020	Windows10UpgraderApp.exe
5020	Windows10UpgraderApp.exe
5020	Windows10UpgraderApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 3504	3200	msedge.exe	84
PID 3200 wrote to memory of 3504	3200	msedge.exe	84
PID 3200 wrote to memory of 2212	3200	msedge.exe	85
PID 3200 wrote to memory of 2212	3200	msedge.exe	85
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5556	3200	msedge.exe	86
PID 3200 wrote to memory of 5580	3200	msedge.exe	87
PID 3200 wrote to memory of 5580	3200	msedge.exe	87
PID 3200 wrote to memory of 5580	3200	msedge.exe	87
PID 3200 wrote to memory of 5580	3200	msedge.exe	87
PID 3200 wrote to memory of 5580	3200	msedge.exe	87
PID 3200 wrote to memory of 5580	3200	msedge.exe	87
PID 3200 wrote to memory of 5580	3200	msedge.exe	87
PID 3200 wrote to memory of 5580	3200	msedge.exe	87
PID 3200 wrote to memory of 5580	3200	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://d
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7ff84b4bf208,0x7ff84b4bf214,0x7ff84b4bf220
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1848,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2180,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2456,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3472,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3480,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4868,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3576,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4928,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5044,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5536,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5904,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5904,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=4316,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6176,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4864,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5232,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=5356,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5796,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6032,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6016,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6616,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5128,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=724 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6652,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5740,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5900,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5012,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6212,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6600,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5328,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3740,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4940,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3712,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=2440,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6640,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5104,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6012,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1048,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6592,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=3376,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5416,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=5364,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=5092,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=5376,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=724 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=6224,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --field-trial-handle=6680,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=6608,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=5588,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --field-trial-handle=7328,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7352,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7496,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --field-trial-handle=6084,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7372,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --field-trial-handle=7880,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6964,i,5093415819415279959,1414072185611986731,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:2940
- C:\Users\Admin\Downloads\Windows11InstallationAssistant.exe
  "C:\Users\Admin\Downloads\Windows11InstallationAssistant.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5872
- - C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
    "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe" /SkipSelfUpdate /SunValley
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 1936
      4⤵
      Program crash
      PID:116
- C:\Users\Admin\Downloads\Windows11InstallationAssistant.exe
  "C:\Users\Admin\Downloads\Windows11InstallationAssistant.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1748
- - C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
    "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe" /SkipSelfUpdate /SunValley
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 1916
      4⤵
      Program crash
      PID:4276
- C:\Users\Admin\Downloads\Windows11InstallationAssistant.exe
  "C:\Users\Admin\Downloads\Windows11InstallationAssistant.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3548
- - C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
    "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe" /SkipSelfUpdate /SunValley
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 1940
      4⤵
      Program crash
      PID:6120
- C:\Users\Admin\Downloads\Windows11InstallationAssistant.exe
  "C:\Users\Admin\Downloads\Windows11InstallationAssistant.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4420
- - C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
    "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe" /SkipSelfUpdate /SunValley
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1944
      4⤵
      Program crash
      PID:5548

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4020 -ip 4020
1⤵
PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2944 -ip 2944
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4080 -ip 4080
1⤵
PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5020 -ip 5020
1⤵
PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe

Filesize
3.5MB

MD5
45d00e80581a224f60ee62e5a0a9f253

SHA1
a1016580c15d3eaffce1dd548db1dd927f9f8422

SHA256
a3dcca311b836b0644a465ed48ef726217ef530ffdb296cedeb8069776281c01

SHA512
1c1365bbf018caae353f511ca2bb4fdd404c28d3de29141325e0b52751b040729ef2f21a7c845f4708e64d8a7946bcc649f0489a6b58bd8ac86253246a7d4e35

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll

Filesize
364KB

MD5
9d4f6fc6fd8dbe8e7b498651e0af16c7

SHA1
29cb40c374a35220b72bfa3ea9ed4ffa1b76efc3

SHA256
2acab73e737e9eafa7c74ca3c9b0762a9386016be7cc1ce0c090b00b793a7157

SHA512
7db4d7e0d4ca4c6cc2e2d1bb21915cc240656e94547bb3c3363bc068c0ce490f9e0916bb8745762053e05f1f7e8752a8cb1d83916a71e3a098333b32ede504fa

Download Submit
C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll

Filesize
197KB

MD5
49b42f4e7c5f4b290aba92258fb81348

SHA1
41bbe19d3af1e62b9c85bee3b6232de4db1a3231

SHA256
9de477066c8ac228f050892e1ddc6e2ecbc8ead0d82e0f3be9c8e9caae8b581c

SHA512
18a7860eec7a2c1bf7c13fa7edb95f775614ecb19eccea5a3dd246093b83eca534da7083b85d51e174902e3dc1b13fb10d1bbcc68003f3a92d677e10b907304e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7da492a02c29529dc0ca538b502e3379

SHA1
cee6a1b81936f6a20f1c9c4f35c29394338ff54b

SHA256
553164a83cb91c4905a86373c61bd899bc1007e7719791878bb95290f1f27f36

SHA512
3a1aaff3da507ce35c4e06ff9fd2516c65780849b24fab33417da2e799e20bda3594e5f2f32b1326dd1d3da560c76dbff1f626c147e99c7a990fe09ab0a2e89c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000007.log

Filesize
21KB

MD5
cf1aeceb8ee87b2f6e26ebc0ebd088ab

SHA1
593046e880049e04d3d10fc1ce7da9c63da8366d

SHA256
7594eadba0dd6ef8911998384715b53ba9bd553553c3073413ccc0ac2976a2f4

SHA512
027e44b9967a2d6059de539d2a82a7310d293de5c4138dedb3be9842de83521e9fed20cd7fbfa2be8b29351ae6bc99736b9d91f27e3c5e8a90e870b128889182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
331B

MD5
ad4f735510cc12fdf3e8192f88fd6ba3

SHA1
2511e32b5dd0bb28b377436e97da9364da8b4567

SHA256
aead8c87cec79a3a18f4fe09d07bba6cd6c0e5bdde369c82d1917c353d62c86f

SHA512
889db177c80c3506a9a4a62de7a98c9846aa2ce2fc17d373b9b63cd0f26339f311be182a77c9cfdc8a8faa9d5556aa1570c0816917239ede8a670ff3a776f16a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
331B

MD5
8a75d928b5d59b498442a4f68698b8c0

SHA1
a9c08677bd23d432b2c8d8f823999d76a3cafdd7

SHA256
f001ecb162ab16b7b5156b88b71e16ef7928cf8546cb01ce15072ecc42ce9a9f

SHA512
478e62832b8fc5a2a4c9b6c5e05cc4b62996f23e1aef6099c90ea49ef2912b32d53ac1e22de69224193b055fd23aa667278ba0b4d078b4e111ff2bbded7a7668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
331B

MD5
a9ff3995fd4a02c199aa85509450a551

SHA1
452932aa0a007e4d85c7ad260c6f8309ffb31a42

SHA256
f72d693f88cc89cf1dc24872a9a3a40be5b67b1f1f9b164ef6ac6253b0db54bc

SHA512
5b39c4e7c46608be9477747c7e2333a69c16496de70c07ee499a7c801e143d93da017b956dca2a94da205cd9a71fc1551623349e09fcc71981c2f2ba2bac53cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
c9f990013881f4f7e226412ae6e54846

SHA1
abce30f859b8a4111c81a74a408944b5f6f0809b

SHA256
768064b0d91d1f80ae1e57b9ca7614dc09400958876f022df02c9e8f54f7c202

SHA512
8c9bd69afdca71b29606fcba794eebda6dca13e1a1b4963493cfe059bdfe13c09cbd21b626f065dced14f2e1a3e988490476dd981388a53faa2b7d69c63efba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe64c46a.TMP

Filesize
3KB

MD5
8de0b4047348406e0641dd00805d5469

SHA1
a8f5d9b342d1dfd6311914a82ab3f34628aca35a

SHA256
4a366794e90857e805a6aebd2dee100e0aad80a3ea0fa509b8dd823bbe15b3e1

SHA512
9581ece0980902a382c61fb16f757fbf6f6a1ccedba7ade3e2a707429eaa7c64c40cee7efa2baf3c07a309fe7306e2509f6b26a9d950d4fbcc8f1562d9a39e58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_vlscppe.microsoft.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.microsoft.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
e5b348a57ece3799311abc19a62c73c9

SHA1
7869d34a83be76de7e9865c3abeb880b79599f10

SHA256
299a84c7ebc870fc422e50973659eecb784fb2340619f734c0739fb6da076b7c

SHA512
3a39cf9f1fbbbabd66059d6656491970ac3b3a6abd22b4289212f21f3d9c1db16e8d1da7a0c8847ba313256874ed848586b01e593d40055d1c0a988b1622010c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
93cb5b5f34d5ea15205222e938c617c2

SHA1
4de92bb7cda73498e0ba1299cab13079008b9946

SHA256
6bf1bfc2c71f1fa7676086c82c1590f8e7606f30a4c345dc33da723a3c23c338

SHA512
0ef1b50187f526b51a6e4ae826ba2a9c24bbeb91aa3451b654642a04f9ac8edf3d785d99b97e293bb7aea89882015684cf556d29fa19977c9269dd5d6b2991d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
c0e08c51ab1f2367722377164b3a54e9

SHA1
6457bd6f7e0676d96972b9c4f633e709d398fbbb

SHA256
3568e245037121165266bf913b0a382218d25edba4d8c14665032f1e75772ec2

SHA512
19de67077570df74cc3e6b26fd4eec45e66d11efa990fb14c9f8d61e1ba0be0eb64a7eb8fefb3d4d6c9e91d90dbb5aad87a5993e24b6a6c3ef40d951fe512125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
cf5583519f18c7a5ae41a33d5fad399c

SHA1
eb9bcc8fe2221d570d68b05bf5a59ddb9fd88c4e

SHA256
0fff0ce9000378f13fb09566a99990fbda96113d811dcedf5835b9934c883a7e

SHA512
90919338079e635cbf3620f9682450abfe19ce55333a63948609cc071c072b203ce53b216baa10ee15adde452e98532b808f135431e4160fff075a3e09c3d889

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
6ea98a427314d2e6e68d78fbb5b8612d

SHA1
a9dab0d7d83332ddc6b32c9397da9daa5d1f4a30

SHA256
0a612128de7fa8554ff0459a4e12654d44c68b00fba73c5a95c3b11cb8f53be7

SHA512
bf3f17ae97e6fccd18062d38a5cbd2dd60329537736eec31ebea1e90d5485233f8c55ebd8e01a239cfb2af92e07ff5f3dcfce84b4cc2292d793dc76a82de4b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
79bb9d0001bf18deb18215c6aad71399

SHA1
96d5978cd3c5b4f521078e8ed93ff01460df6df3

SHA256
fef1a31ab3f79742e87798ccd21fa301b5e14f647c3434353beb23c294cc4d8b

SHA512
07cb7c26200d0f67c985d1b99343f41644d8e65103f6b8d0c6b7901325f8aa282288d28ce7eb096ef335bcb3e50d983ce2cc316c85230faeeb74a32687e5be95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
65028828317a2b582349439fe918e2de

SHA1
900f65e28522b68b3e7bf10ffd028d6caa313c8f

SHA256
963b09f401c6d09186d29e8e6805ad5a9531e9a73d31a2d440c94d252a06c857

SHA512
1825f6d1e81a84158c4b6f782a8db895beead82d54d115754e1ac2e49fefb7da586e0eeffaff014121b4f026a691dae0484841ae033e5ec6601d62a75324a5b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
4261d5ee604447f12cd3ae2b284c7a6c

SHA1
6cb0811dc0102052eccb4fb1fd2b29bf40fbe8f4

SHA256
f661f9ebb47760d9fcfdc294cb8cd9774c866e445fc9b40880e9770c507227ea

SHA512
552af273b23154c5196c2ba0456ea024c17a320945f48bb4b69b6502c78b6c9d9633ff3e66de1a8cb7db160954bf76a5d8042bd862fd888e5798948edccc1f33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
5ea577e6970c397bb418645fbc85c228

SHA1
e17cf95e6e595a67355bbfff6350350090c60b0d

SHA256
b5a72d082c7bc8503ec125589d4ac590dc27d506e4ac4bce6d5105e561ffefda

SHA512
b9c8c0f12c28898954ea6a3d17a0cabd4b588914e5bd14fe273df29c9d6d1f93f0331d0ef2df38f708d4a548d03226cb9359a940ab1446fb5fdc7dfb70fb11a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
413KB

MD5
abc96ae49495ab08e51cb8e46ab5d01c

SHA1
aec07e3cafc6ee939a7605daee824d0701dc3119

SHA256
c8c4b4b696977fe43f0ec90756e3c9a2ff69cac0de40551559a38612763f5202

SHA512
3135cdbc346d18b603372cf382e516de9875e47340e71e78d099c996585c613766f9b758bac4c074f1c75970e744e5e3d4169b340ad90a7b3e681b4d0a65002c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
6baf11656b0c4d203755a506c0c0c571

SHA1
0f5e958de2ccb1ba332a4e942c51e8008a485d30

SHA256
e6a6b522f33a3573898c16708db5c9a54b4a018114777a624746813af0de222b

SHA512
94382ff342697e5a49ac3ac1ccbdd94cfa6dcdb3eab591f5ef9322e9f330773f05d6dea75ca46a2b3be613629a316bc5aa114bc98c57cfe6d690771f0ae7952e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
7d5523644e3bf91847dc9e674365ee6b

SHA1
809745e65ed7f6a605c8a21fcb222cd380e64d9a

SHA256
eacc62e9e9db06d25e35bfed354c7966b727d5adc7e424f590d603ce33ddcf4b

SHA512
78f11f9c15b294664802c19d81c349efa70fd0df2bf60c3091ce10691b0ce6f69cfab1e74b5068b28cd7321695ea8f6aaf857c4b9a266053b3c670920f43bcdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
412KB

MD5
a5567c2ee63c903e0af5805c4f21293f

SHA1
c562b2edee80bde112ef243b1cf7f3271374b0d6

SHA256
52161cddba33a84a57bf20c393144a1b31981804687cefe65cd83ff63f8b0a1f

SHA512
e727f801b440d33f9b1097f3bc74ff3561d8ed7cc0ecaea35f9dedaa9b8bc96ba9d32964a1bcb661e782ed67731fe4f6a4f368fd5dd28c04616d8ba0b4b48a8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
78dacff0e5bf9729a82164ff61b26e27

SHA1
b5a12525862cd8084ac95f4d5a4aca1e54821e18

SHA256
239c088c243100553b382f6ad761eac100ea6f6719442dc5e29348a229febffc

SHA512
3ec64cc92d54ab79d9edbc29a91da610c3a818fbff100aed13e3a2c5f071e0a380dce1735781e405c6e3b2ba0ada86bc0e77f54c102c409f0aee72beb0fd5ed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
160e747804fd3293545e9f8d987cb184

SHA1
505b69b50c591267b0cb06a30584c1ab6738b8c2

SHA256
30796378761a13a133c29efc96b979a2edf4e5646549e3c80f494d3176d1a31e

SHA512
f23e454b38cd43f226b55d3522766abd9f70288c78f27a8f70723d9e5e9d47d85d0ae62ff7b4cf5eabe8243eb7037feefe947b9d958732ec0122c72b3161330e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
462B

MD5
3e11a54ff164912e277a442f9ba73f1c

SHA1
3c532a5c30ec1c9c55eb778c51e30232c04beb3d

SHA256
0c10c9d458c194f8e0d99161797c0e7ae3dd089fc0e4bebf5eed0893ae41e3ec

SHA512
170ae37d17d09baceb28871de1c96d608d8a697b5a59c7945b6edc0af3c289811c6a452d59981b9ccb4b32386af074902f934e65395fc665516eab29c42af959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
866b37379af86b19d41b84f8c39fd4fb

SHA1
dfb1a6a91908661f90384e28520c7b4a12f0aa8e

SHA256
bcca377c2884478edd12c5fe8b9eb2dffc5e59b3d717d1ce7aa92f17751ae13f

SHA512
c8f43862317c7b80d8c7cbb01a7e9469693ce0f6210e64e77053a25f3e8b78365d84bab3ebd259bab938d492013c67a5f8a2746cd66102de851da534a6a519b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
eee4dc4b45dd5f1c439af076d7dd5bb4

SHA1
7cec3bc5fa03efad32fb38a36a2b64e8d5112ead

SHA256
d206f664812695832dc7b8208c9a89f6b682a18744ca6483b35898658071664a

SHA512
da8d174c1f16abe06e6a422f85d482102fe1ff4c463f04fedfa65ef00fa44e7c92390d253800ea5f29563e971844cd83f6a214ae3bba23f7377de02a13f233ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
75f22fc111b6f9ede948105b029d86b8

SHA1
e93425da06d05171f6308fc9343528bde65e73d6

SHA256
ff38f1159e33208b5dd97f642996881760ba2a17d3885a800ec2381c48327af4

SHA512
e06bce348496e68c3323e0b40222e8e3b927d213aea0509d0409650c2695a8a0d60eab1f9e304ff5e109433e15b55547e93da7402f21a8bb120c9482980ad55a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
f0fe0f461b829119b936daa262bf7e75

SHA1
f985ffdcd29daeb2f576ed77c3122a6335f28c0c

SHA256
0143edb82df86e497c4f65d09c837a2ada47d691ccee91952f21f7f4f3b32704

SHA512
12e318544a762569386c31ee078c77f6892e8836c171b1743338145150b784dd3983db61225fd86ad2644d62721f23ddd0a3c6003bd87fde93d15c4a9f6c4c07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
7c61f12cd36c9001d5bf76cb48a4e47e

SHA1
342f28da2903c85696ad4de85512b8ae3611759e

SHA256
e2ecaf2370d8c5737acf55f9c6e1580ad5334ca35a72d73a947b4c119f85d1c7

SHA512
3153682504cac93d7d8c1bddd179bfe2feb3048c2344c317fa10433f2dc624e8f1e7e471465e9a07dfc8acc8dcd93c7aea4b57058fe024842a24ee0f5ca2087f

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUDB9B.tmp\resources\ux\EULA\EULA_en-us.htm

Filesize
68KB

MD5
05627bc6899f8853de9a63f304d1937a

SHA1
11ccb451025a9b3d1f58b44b730521a7652fdb74

SHA256
49aa5fe536281681d0bf933c59622910753c0ee4eb26d96f548cf4b2d752129f

SHA512
2a0c6569b1dbf7a6754cb870325eefc028f69a758ca44c78da9ac77b03f60feba862e1bdd230ab6b78efb64e0da056917a50b18dd9adadd7e79f1fbb164eef9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUDB9B.tmp\resources\ux\EULA\EULA_es-mx.htm

Filesize
78KB

MD5
75c32dd12eb6a303f16b4561aa4a3720

SHA1
628b9c1504abc72296821575f769a14d4635841f

SHA256
2cd165a4c0828c814c27b1ce07c3e4d8f254cda4eb2e91cf87b242c53002f312

SHA512
b6759d223f0bef67f36ca74bd519e3f2cbf8dbb97ff218fb2f236cf41facaa08cdd6e8949adb4e22c75a00dd19e048c7d2fb68ef3d9d7f790ab7b49ba44b42f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUDB9B.tmp\resources\ux\EULA\EULA_fr-fr.htm

Filesize
82KB

MD5
b0bbf69d2d7a34f86e0acea9bd678ea7

SHA1
c0343796308bdfe623eb1f0caf99538eb58b76fb

SHA256
531ae3e6ae92c7d173415fb7a3a95fdf61fb3e3fcb703a4606c9590225f03aca

SHA512
7bc0b314cf4eb625aa56e6134f1cd544ce1f38b84c7a478ba2f34a484ab41328f820a1601a8d0f5ee602a59ace1e496f69c2820ce472b8d57a5dfa5fc8be69be

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUDB9B.tmp\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css

Filesize
40KB

MD5
415d4bb726c52bd91be8f3afd81e50cc

SHA1
9732e1e6aeb13a6f180b21bb5bd8a4acf7d96dbd

SHA256
c6dd0940a263382fb735f1cdc8550234f9c081625bfe2e5363cb8bb65cc06440

SHA512
c7a8b805027906d8b67d50773a7e362f2e87d3af61b23fab33aec929e21f42610a35f857ede9a17772c5f2b42c1382f8daf7240b76f3996aa65988a87c367847

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\ESDHelper.dll

Filesize
60KB

MD5
d25f901a3856dabb1e73c5362c72a724

SHA1
ff4a20fa85c72c7d5020f84761677ce44d2d1088

SHA256
c3c360cc72ce0f227327c4a2680511f35de05f158cbab4e09c1b48128b2a1f82

SHA512
03d7fe826e20adcd911e9887e11b1095d9a3b0e8d584dc0f883e97884b59df078170beb3c2fdebe08cd02ca14d59169c8e35a353b0175b1dbd43844cea3a59df

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\GetCurrentDeploy.dll

Filesize
404KB

MD5
0e26aba54f4bd83da2913e9bd381e010

SHA1
39aed623d74f5fa611fdedf2059d17e11bb4a567

SHA256
468f0aa8750fc5beb03b33cb10b40c048d2ddedd19da02dd82a52be93e54ad57

SHA512
8335b839ac0fd4fc52b3355694076f91b6139c2b8cc0940da1b8683b72b1d32d9d76d0002d97eb296ab7745761141919b9e76f40613fc84ba082dae6690d0b16

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\GetCurrentOOBE.dll

Filesize
126KB

MD5
e6c2cc40546052d4b6beb5627490a1c7

SHA1
7ba2e1e96ab78b564a4f095669ebe111802d7575

SHA256
9c16bf522ae7eb5cb0cb309d819d4e51820aed39c0bc599c301046f5bb803256

SHA512
8de1326817f09b4299efae443b7721839c786b264650b7e5448d5045c7d08d7e27b234ae73b27d417b7d44c956a97ecab55e2176caab05c520580bb4cd7e4b4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\GetCurrentRollback.EXE

Filesize
65KB

MD5
4f93177181c76bb5f534e4fa89fbd08a

SHA1
a51622ccc8a61596ed96a3e12dbbcb6589d1bd9d

SHA256
1a87ab84c11297973b31e845e97e78d33bebb516ba08ba517bc7a6ed8011fa39

SHA512
ec2b7e69495ff054a97d49a876b9d67d1b733d240353e665b1c8e11bca55783d4d3b693cf97de5844fe6dfebb39e20d1e81c3cdb51f3e4ca48691bef6235957b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\WinDlp.dll

Filesize
1.1MB

MD5
5cad688a56837b74aae132fe72140f6e

SHA1
288f1628099106338fb1ac98847a1de991680376

SHA256
27d85aa797229a2d9e121dcf3bc8ec31661a6e4779d8225ac1af3476264ab4d4

SHA512
7827163d172f0da3dbcfdd4b6318e24a524e87b83ee0d6d68de5bce1d443e34f0c9531e98287b7232077cca1ca9cf6291e2e5ae18989f28a9c126d7db0665d2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_ar-sa.htm

Filesize
290KB

MD5
2c856a4aef3c9a90b19b0df0f00eef74

SHA1
9865a43fadf6f3919ce1c1a8c3b62e5afd110af0

SHA256
b3fcfd5a00e48f0d149b2e7ee1c9f7e879a599e042e55406de09d2b4b9867790

SHA512
0a1426252ebe373b326a1aceb3361af70150dd93626ca472c0e059bb025e9773406b4dbb0009f7f9ec9185ead936c5e35a263dfe888d7b96fb5f7e66548f7d29

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_bg-bg.htm

Filesize
287KB

MD5
df640b2c1e060347a0dd568a8b66d300

SHA1
92837dc54b2c97ff8757ac6e38219d07f421e9f7

SHA256
bd71f06846a9408798e6f35726302ea2dea7d70d484a7d63a27e9f00c766325d

SHA512
aa9afa8d83b60c5c18c08ccb887de91b18107872f771775434726e8d76705d593d57260abd28291fff15298588e24514d7a4420b3f21f4af81e1077b07cec593

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_ca-es.htm

Filesize
77KB

MD5
feafe39b8ea25bdc65de40b088d64229

SHA1
5799fea352de6ff8d452ca93a918ad4d6e315720

SHA256
c81a02a2631e7d1705aa51d949557c140a4b0c1a3865cc4345ed7b66d3dc953f

SHA512
e54acff2613f3152e8cd33083a36e1e265d9b72d7b75e3d28e0574bcff71deae500e3cf41c3f3896c746e51d5a3c6544c349d6c9b4b166fe315b657d92ed6829

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_cs-cz.htm

Filesize
82KB

MD5
b17a1389ebaaf221038a84e49ff34148

SHA1
974fcb96d2285b0489f3efec2a38f2d2f3e5f998

SHA256
4df38c77e7ade9c699079479ecb12e280c2b7745a8a8d170b82fbde34afc39e5

SHA512
bcba4b08d57387e056b7aad2f03f4c2650548232afb00bf6733e569ab4242fa591f7c86d13ec43444ef14ecaee6f4348046cb98b4ec87d2aa8dbdffe5447a71c

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_da-dk.htm

Filesize
75KB

MD5
a8c464fd13c1f7ad7ddabd07d95226f6

SHA1
7c7a87bcaf2a5846db6fe48c4158edbde87ee7b4

SHA256
b94ae965c22b7224e127646fe9e811a0028809ebc872e095db0e45f89f12c94b

SHA512
e18587e082acfadf317fd4126414a0eeecc544bf7e444101f59f28f9ed949991db446f7395021f39994d985a533b25b72deccca0dc2a45855e1944cc75a91bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_de-de.htm

Filesize
81KB

MD5
70e012f11322454062979f1abd26b79f

SHA1
a99b08ddfa0f729556a57a8d798ea7b490fa4e05

SHA256
93d83f3773c7236a45298a3457118bbbdf77080a7a3296eb202618af0efb0bf0

SHA512
65a5d34529842bf387c233943a3e20aa24aa37498041a2c5171d4ebf44753ad01bcca4ff7e4a316dc64d8dc2522e409f60f62565ad07a5eb84594ac94b13cfd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_el-gr.htm

Filesize
274KB

MD5
511abcef6c44ebbb73f1c7388d5a54c1

SHA1
0d479ba97336bfbf5c181c13d2406287cbfe0601

SHA256
5d8886b75dab167f80ea9a2de6bf2cc373ac467a00d4ba528aa824836e7761cf

SHA512
bcc3716bf028af69a8d72fb0ee18cbaac39e03b78d8bb24ba9235518ed9834e9843d7e1f3e42e9331df2b349318b8bba218abf2b6f5def52c34c9b9444ab630b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_et-ee.htm

Filesize
72KB

MD5
343be393c8b9082730ffa920524d3ce5

SHA1
41a4c0f423700ec8b36e3980b28d92d7ddf5618b

SHA256
6a378519ae4fa1d0f9b100fd975995564bdd73ce02127b75ea4e376ced028f30

SHA512
42b647ef9e933e079d1d4fee8dbbc1fe3d8b084e115b19e8637eb96eb02e5585ca674730af2d6b7fef9178aa550d6a0206c858c840ab7d116af7fb945c05d41d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_eu-es.htm

Filesize
76KB

MD5
feeabccdfa22431f37d41d0b97d8a74d

SHA1
b662c6c286a1f2363dcc3ca76913f0b6d2b416b4

SHA256
48b6e9638e97cca94c0261e1ecd6195ce29cb5d10b1ba09998894ab0b44b10ab

SHA512
115e2f96f41d3e203219849dc21d7daf14481d3fde426b4f9c6c10c53ed5cb14773a9ca404d0c4a2c15dc5165691bc67bfed185e65c93935f022e3e9722cfeb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_fi-fi.htm

Filesize
76KB

MD5
452f2733d06c6056d739a60f0944675d

SHA1
6b6e682193da816aeb512cc1cb03f856ac0dac8e

SHA256
3b9ac837969fc10adeed2d2bceb389adff4a0a06d691712fdbc4bc4541505dae

SHA512
00e1cdc8773a60682c05bd817fc58b16f3ff9041bbf5fa48dc2494e1781b20e266275d4dce658a80624fa7b1fac9bc795414847c7c4cb95faa12f3e279a310f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_germany_region.htm

Filesize
48KB

MD5
e4ba175dad87798fb4ef742e06bafde3

SHA1
d5f79e69fb29a70c59a0e5d10ba324f66aa216ea

SHA256
5388110906120e31c7900b17d841f5e0ae2e0c2a0f2c40e5525fcb16be75ad35

SHA512
51808ad3bd9074bed7fb38c6c4fb1e07465c5fd68e3b610e95d0b2fcc86f0ce75bcebaa6f6803d25bbcb7973196e2108b0d50156140427e8b462d335ddb14ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_gl-es.htm

Filesize
77KB

MD5
4ffb743eb44d9369c6f3fa394f17adb6

SHA1
a906eb44f83c1128db73b02b64ed7ae54bdb968a

SHA256
26fa1abd793e253b2e001c5ab03506390c3fda24792c1ee906da43a6de50c4df

SHA512
51d113f88739b3f9eabbda64a83b03e42266f814decf25561bd7d014dad0c23f85c73c9ac316aa1cd1f66674d4b08911755bcb9092295d5a405a2076808b209f

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_he-il.htm

Filesize
251KB

MD5
2504979af88203e9dc9166787ee08668

SHA1
55e7be5616002f3b1b4c911a588559811114928e

SHA256
b588595557d4571c681d726ecbaab9a73e1d127dce6ebfb091a81f1377174b65

SHA512
d4c45f48b1247c4332404ff45455a68ebcc3fd25e41a74455c78e7a843810bd7515ac826210c0beed7232f1cd27b3988b463e8504bd68a334c5a1f9f4fd2bbb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_hr-hr.htm

Filesize
76KB

MD5
c3a94b82f3d3d9c083f37549876ab85d

SHA1
47e436a7c204c592df414a8f168bc605931d1586

SHA256
0a1283af24ddfa7837cec9b8aaff0bed2c55d51799803d10b6401f026b5a3d92

SHA512
4b9115a7e7878ccf267f6484b218e2579bf03d9e031b5f1e5a431d25a4fd724dce479569f25395585d6364b6c569953aa2bdfa020ddae12f6672b41bd0398b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_hu-hu.htm

Filesize
83KB

MD5
2c8ce7a5087b00f287d344a38600a47e

SHA1
abc211acbd2e4c4d67e6da78bcbc7b8203447990

SHA256
eb685de31648c446b974312cfb6266d5845d5d55e96ddce0a8f3ea50a8788fdb

SHA512
07d5e49eeccc0ce124cca8bd8971f76f92b71d0020966dcf58db13292eab4827bec66a286a8147b85eaf0e02acf21aecc76f052dd0de632ff5aca98a565748be

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_it-it.htm

Filesize
82KB

MD5
be0426246e23ebb4da7cf29946254ea6

SHA1
b956e56b9590458d4c6991b5c7270c3aa26b33de

SHA256
375168ace8119839dd8bae0c34df6e67b1fd388633dba636e24b034c20a56cd0

SHA512
fdc692a646468e4820102f801c5bf00468c3821f4c8082eb638de7786eefb97ebf0edb939e0137532847d6b444b84d13e9b2b795359c95a7b77dd7339e924084

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_ja-jp.htm

Filesize
236KB

MD5
e9bd5a8f54caf70e74a2090d265828a8

SHA1
89ee391531d9544eecce2a550314e0a196b6b4b8

SHA256
80d9394d7e0aaa9a16b1edd877783eddc3659164c9a93f0f6e6377a38f07a6ca

SHA512
b2c353239a1e4cc8c6e4346e9be7b60478c08c7e40a783b9867413b02c39f7f960d23703e63b0e0e9ec07ddb94aeabaff58ed1e69a5bfceaa2103b057338e9d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_ko-kr.htm

Filesize
765KB

MD5
3ec01cc311000a72026edb99624d5754

SHA1
ba67debb2bf2e8e4473887e5ae6bec8be9133910

SHA256
7a2a4d20fee4b96c91b26dfa4978fc8b38a41ba34827d1100b37e016c287b6cd

SHA512
10c730d84a362c0e9229b4fadd10e03fba3921386fbdd537911d3221ab7bc41b696de25b63c968331a5d80d6d1e35fab0d144f3778e9f0e6f9d7aba013f39b08

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_lt-lt.htm

Filesize
86KB

MD5
ef5e98b39d6cb21ddc46d3175110fc93

SHA1
1b023b8028738142d28aa72d767f8e75738fa802

SHA256
5fdcf8566eabddb3c0be9e1ef0de80cbf3c58333170fe49d841573af759ff141

SHA512
efd69e37a648e71e7a379c7ddc9cb60b6a2a961a47f6329fd67a9d2c3d6de8fc3b0fe4793f063df5603fc7a496473bd29c001381a3bd845769b0e6b10bbd907a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_lv-lv.htm

Filesize
95KB

MD5
146054ef4b7222da7147a3a35c9a6034

SHA1
a0455c483d29f2a2941fb12367a09beb93a091ab

SHA256
8c41970ebfde9f04a57697a065d526e263fa5698c3492dc976fdc7e8132e756b

SHA512
49dded669ea7aa2daf5b3cd9242ef0063415d59463e69e01c160f0bc08edd119e918757864587ce826cccb9c47b585d956f8fa888660f85fa3a3aa50f3c0d477

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_nb-no.htm

Filesize
73KB

MD5
f5eb9a7075153cb765d16127e2725e25

SHA1
ad45b41ff5605192efd33d796bed64813a8566c1

SHA256
e4d615c2ff01da1ecf420e829e66f14b323b293027a06b97e8aa952629f39f45

SHA512
68ecda160c37543e4718c201167f7ecccecee105f7de61957316116814862da9e615523fc50facf9ea6583374f55c4a41794032a0bc59b824eae1b243d2fcb04

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_nl-nl.htm

Filesize
80KB

MD5
f01e0c5b9c30cd6474cb2d2fa15c4e92

SHA1
d8d52a431bfac46085cd6076bb15b81aab158925

SHA256
f82576865c9aedd7ab22ff215139bc053260c21cae0cb1aebd83798f0b357a63

SHA512
d594b9bc117aab6271f75d52603a5dfce668df465243468daa4ba0c3ae99d47ad8cd3b0fc0f39ef9d0a9d359e465267c27273edf2ee5890e2f7525b0840e844e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_pl-pl.htm

Filesize
94KB

MD5
993258db3eac84921aaa064806da523e

SHA1
2e538ca75c8e3a6e4dcc2918ef545e164abe8c76

SHA256
f3566de6ea0ba208aaa007c3dbd792d229363b5f5997e6c4135cc0b85e7a6eb5

SHA512
ee108ae49b029e412f432a571cdb660df1b95dfb881de2a2a8f42610af2677cd931c591778a9a86d1e6019b12aa486b804b91beb43325172aed9adebf9ae3710

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_pt-br.htm

Filesize
76KB

MD5
4d9084e41ec02eb50beeba3e5b9639b0

SHA1
554793f5d8db92834c4a68d293219bcdfeb2afe1

SHA256
abf424f36439f310b7a003ff7a1e9469ddd12fa9deb581942d6f0d72c0b91e78

SHA512
78f7153bd583fcb3dcd5eb0cc8fb092424a28b7ea1c7c5e85dd0b6dc812fd227dff07fbeaec9da9f136e1d9d7a4aa93126764aecd9fd95ac862d56c4882a6395

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_pt-pt.htm

Filesize
79KB

MD5
dd808886515ddd8293920e172e3bcf40

SHA1
e084a844236930cf7710d75c600df8443bfe9cca

SHA256
59b03a6c8fb6d98745fe2e03543117634ae3128c28b8ae38c12c17d481942721

SHA512
cbaca6507fa72982c9e4822f0770693c3b7078c2a090c4b29bb5a25ab514d94deced4f03b96251e9dd091e7d36ccab03b25ec0220adc39d422a681d525c6363f

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_ro-ro.htm

Filesize
99KB

MD5
300df2954cca5abb3b6ab303530d14b9

SHA1
ba2f248d4165cdab5086341b3d504dc3e934df9c

SHA256
efd68efdb1f9ad89e3a0e320004130e72e6204961bf0f67238827798b997d304

SHA512
8ff29401bf0883da06a468d15b8f9795c617f231107a86ddccb9e4dad39e5ed4159b9d97f10aa758a81d8c4ea16da00dcf23647a9bd5192184b4fdfb3ef237bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_ru-ru.htm

Filesize
320KB

MD5
276d647540eeea22ea7a30d538835e35

SHA1
8525a5decc17735a842e98706bb5e38502702c50

SHA256
eff9625404e40713e58dea1fbaa4ab368d1c807b52b2501323ecc0f3618521ae

SHA512
bd61587cc52a5f684ffbc0bae6221151df5963f496702357ba377d0a8a1e19a60ecc219c38faab8596e53a8a778b24d5fa21bb708f31e9ed4ec871939e945659

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_sk-sk.htm

Filesize
80KB

MD5
d342df3fcd458c336e81164d9a3ca78a

SHA1
10787e253c5499e1a5ea8d3a5f9a160c74ede1d5

SHA256
1500229bf884dbff0656c6474491a35000decf225bc3e0fadb56c4f20e310396

SHA512
09caa744ecbb5b6738f16a6b27874d3e3bb40fe948b64b5c577b8f31430278a8e9cdd000b52fea52ae0f97b81acf4424f641558357bf544c41e62fe3c9807092

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_sl-si.htm

Filesize
77KB

MD5
32af6d098c147a86dd3afad6bffa4d4f

SHA1
ee0c2ef4978a5178d61aa7d180eb6f56e91f53cb

SHA256
979e3b154c3077223155f6b8528c50082ae2332aa4bb3766977a5e85eb98b909

SHA512
9fc0fe485d9d0777d1dd69006db9352992e45a5d17280a57a9dde892f3991f65428b41f04ef9f741846e4a5c8ad201813d10e4f2a0a5770f875a6ea14316c1b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_sr-latn-rs.htm

Filesize
77KB

MD5
fa29d15e175701b9c45b2f5cd46580c3

SHA1
8a7697bd35e4999f5cec098dd5bcd35905f4661e

SHA256
571952a003c79c2f6783e2153101adaebcd1ee05e243cf7d0c7633234f0b0c83

SHA512
28795b508cee1e9991e1ae654f1af04ef3707891c673e63662331bbce3d87998c69241f58a13497ab286ace5a45a14bbdab17c71f0cc9373488a27d34d840fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_sv-se.htm

Filesize
76KB

MD5
5d16f59bc922664a266507b26928407f

SHA1
90c32f4c8e786913b928a811fcb8f7f804049162

SHA256
707d1d42645cb9bc4e398ffe7d27393e08de7e787a7e7bf267103b2febe67d79

SHA512
58f80b390732898d09b238b77562da22b33fda1f3a900ac3a3e91748806280b65122f752e270894933a705dc1a359f285bde9701ab7d593d720cfb60fe096335

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_th-th.htm

Filesize
422KB

MD5
53926de25c9cb506add73e5f8622a356

SHA1
ee5029d126ab7e0eec7d306a4e4ed0d7fc532ce2

SHA256
16048d17f54097989b8c453aaa87358cef4eb9dbaa2aac51c97eba8cb214a050

SHA512
308991a8a0e7fc70c5fca3ee9f157a5da46c132e0355bceeb0a7d500dd121c93bcd8c8f91e2be638d94ecdea585a49993dc22b0ba95dc93549c6395cc018c55c

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_tr-tr.htm

Filesize
88KB

MD5
fb8c0bc3894baacadeb5a6564e860189

SHA1
1d5927b80122e1c5bdc19ca4c443d2e91524a75f

SHA256
ef525ea372970c9ae2c92bd4050b70f2efc598243686ddacaa880d381746a145

SHA512
d45ee6f1177b8a9de732008f1847fe52ba89b65b4dd3428b788039bf46ef4a0e7169d103fda99804df14ee2845ee6c10a957b6b035bab4ff709324f17cd955d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_uk-ua.htm

Filesize
302KB

MD5
0fa78e0744427ae456ba2f25ede6de5d

SHA1
5e67baec9be37452f1ea06055ba018fec09ecc6c

SHA256
c80303f8062fa0880233f3bb5122ba5347e266d50b6b126b23fdbe46e85289e8

SHA512
82e791c38b56fd0fde5b8c5bb42d863ceec6844aae60248490e5b19169b9d11551ed6300da228a633ccc55d4a10bf6f74ec8cfd01fd0b02a80f23d03cc7eb17d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_zh-cn.htm

Filesize
148KB

MD5
5003b1669a38660976272af577f5942c

SHA1
6aa147998857103254fcaba0b8d08acb713169d9

SHA256
269badd578437fd794c67f8fc2a7da87e918908363f63ddec38bf277222d5354

SHA512
4368ee937ee110a6aa70e6e2221d0ffe24512c70fc3cc7bfecf53fc861f6840f88890c5105627c7d79380220f0c40c1bfa4f403eaa1525a6cc6403d7081d5f42

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\EULA\EULA_zh-tw.htm

Filesize
186KB

MD5
d4e2ded6c7c9e9f7e26addc5dac82cfb

SHA1
0866ae3cfc06644996c73192d45780bd6cc2927b

SHA256
db73b99097f3e817d908e09efce52e50d6fb9776b9fe5239eeb536cb6c2fb3c1

SHA512
4d1d543e8eeeccd64e8ea9d64ddee9ab5b4c4245533d72e3fbd7ff068e85c04481ad3c9fd0119c5b3bb8e0cb3d4f835a0fe8d1833d7c23fbdf14ee374760b34d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\Microsoft.WinJS\css\ui-dark.css

Filesize
262KB

MD5
c9674190d140117be506a070c4ef5be2

SHA1
51db8cf46f6ecac6cab85a52402fd66c035e837f

SHA256
1e8e74e5a29f269157c043718b43c10c6f8beb806a6d2b3f3f2dd542731fd196

SHA512
9d41b784a377dc9a1bb61e337ade6acf7f841a672609626697925ace30f8fc574e58ee54388a76b446a84d4ba6de46d72e0b7cad64ada5bf5664c28df09ca585

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\Microsoft.WinJS\js\base.js

Filesize
1.2MB

MD5
221c534deb612992681b0a2fb55bc5ed

SHA1
1ac3eb5a4ea6a0d876f8077e87357fccba472323

SHA256
7b67ab12bd5dcc229ea7f197fcb7723b1c41a517e198fad31020d8fea42e9715

SHA512
c9bd493fad305eb4c881eb6c9aa1daf672ec3531ca4871c44f3383b48389db24232b6dfe35ab6e82a5c8bc1a38f68b57fd30e2fab35bd6237d751285fd74444e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\Microsoft.WinJS\js\ui.js

Filesize
2.9MB

MD5
b02d15ec9159d708837121c9685fa551

SHA1
577edd3d56f6a92d5248b35cd76a442b2c1caf37

SHA256
d23519634fa23488b7151ff1c31cc81e9531033f669d10c119f375198d02e22b

SHA512
60305cd9baa19a7e526f4ee9eac425f17563ab4dda0c861cc163b64495e72b547258ff7e804dd7c9820bd3543b2158109b1f72775096a2ba36ce02ad908f8a0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\block.png

Filesize
919B

MD5
a132f4d4f23f1bc40cfdb88223b1c74a

SHA1
11fc3eea08765c7dfa697cd9cacd18f7a9900181

SHA256
35825ad138cec97d3cff27cd8d139377e6ba4d0a55b473b59fb4f5f4b9508be6

SHA512
c5284f403c6617947545b0282d935d7e3b2ccb30c67d85920907b7cbd00c01e4c560824c3e7d77a51e97a646aff806879f76e418973a66e2fe1086b8288326b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\bullet.png

Filesize
174B

MD5
062f3f1fff1deb4e8abe7a16c8aa6398

SHA1
c943234ce3e553a05be711da23cbafbe459c5988

SHA256
f67ac334038896e37ca126ac4dbd1fff51cd0ffe8c99ed1cb709d64864b72392

SHA512
c6bf7e63476f4ba36aa09a133bff02c6d68503361d9487d598b28a0bda631a496810bb9b0ba8c89efbfe16bb53693a6a81c93da1d00fc923b655a070d5dbdd2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\default.css

Filesize
5KB

MD5
7f5fcac447cc2150ac90020f8dc8c98b

SHA1
5710398d65fba59bd91d603fc340bf2a101df40a

SHA256
453d8ca4f52fb8fd40d5b4596596911b9fb0794bb89fbf9b60dc27af3eaa2850

SHA512
b9fb315fdcf93d028423f49438b1eff40216b377d8c3bc866a20914c17e00bef58a18228bebb8b33c8a64fcaaa34bee84064bb24a525b4c9ac2f26e384edb1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\default_sunvalley.htm

Filesize
54KB

MD5
66b63e270cc9186f7186b316606f541f

SHA1
35468eeefc8d878f843bbf0bb0b4b1d43b843cdf

SHA256
00f8f3e4534146858326d6d2524f3360dfc9e5d149e207d61cabac17ad7a5f9f

SHA512
b9d1b4b201cabf087a44d958584ecb1c110807b9bd9865f1e76bf9d989d7d000ee84f07558bcae5e05d11f7121fe2c402fcf916b00ff5d8eac7eaf05e21a29f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\eula.css

Filesize
82B

MD5
b81d1e97c529ac3d7f5a699afce27080

SHA1
0a981264db289afd71695b4d6849672187e8120f

SHA256
35c6e30c7954f7e4b806c883576218621e2620166c8940701b33157bdd0ba225

SHA512
e5a8c95d0e9f7464f7bd908cf2f76c89100e69d9bc2e9354c0519bf7da15c5665b3ed97cd676d960d48c024993de0e9eb6683352d902eb86b8af68692334e607

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\loading.gif

Filesize
16KB

MD5
1a276cb116bdece96adf8e32c4af4fee

SHA1
6bc30738fcd0c04370436f4d3340d460d25b788f

SHA256
9d9a156c6ca2929f0f22c310260723e28428cb38995c0f940f2617b25e15b618

SHA512
5b515b5975fda333a6d9ca0e7de81dbc70311f4ecd8be22770d31c5f159807f653c87acf9df4a72b2d0664f0ef3141088de7f5aa12efc6307715c1c31ba55bb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\logo.png

Filesize
2KB

MD5
afeed45df4d74d93c260a86e71e09102

SHA1
2cc520e3d23f6b371c288645649a482a5db7ccd9

SHA256
f5fb1e3a7bca4e2778903e8299c63ab34894e810a174b0143b79183c0fa5072f

SHA512
778a6c494eab333c5bb00905adf556c019160c5ab858415c1dd918933f494faf3650e60845d557171c6e1370bcff687672d5af0f647302867b449a2cff9b925d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\marketing.png

Filesize
420B

MD5
0968430a52f9f877d83ef2b46b107631

SHA1
c1436477b4ee1ee0b0c81c9036eb228e4038b376

SHA256
b210f3b072c60c2feb959e56c529e24cec77c1fcf933dcadad1f491f974f5e96

SHA512
7a8a15524aecdb48753cc201c215df19bc79950373adc6dd4a8f641e3add53eba31d1309bf671e3b9e696616a3badce65839b211591a2eeebb9306390d81cfcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXUFEA4.tmp\resources\ux\pass.png

Filesize
1KB

MD5
5a7499645619886bfe949250e1807415

SHA1
152295cf08fcf1e21e26f05969cbb02bd22a8af6

SHA256
db27bad6e59128d58031706c83210ae780a9261e01af6fde6323bd30f7a97b12

SHA512
201fc4fa1aa035cf09872d6f335d94c97433b79af343d532d0dd5c6ab6ba60b5a3a3b60f466e2c7107c19e04ffcdfa8a016842b4f29ea3ee6dd3d60304d8d8dc

Download Submit
C:\Users\Admin\Downloads\Windows11InstallationAssistant.exe.crdownload

Filesize
4.0MB

MD5
73c8041e8b532d9791ef3987f82d73c2

SHA1
0ad458c01db820fa808d41d38e282cf962806910

SHA256
188698d10b1f7b9710061ec95e0aec55a0cb2239e622fa4f7fdd5d360d00a007

SHA512
a5402ec7871867d579d1a9c8142ebce31c23153ec4395e746474e524531dd58781a0644cccd869333c044a41e61fef48e118f4ed46860bc8cb7b90fc60925304

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt

Filesize
551B

MD5
7bf61e84e614585030a26b0b148f4d79

SHA1
c4ffbc5c6aa599e578d3f5524a59a99228eea400

SHA256
38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

SHA512
ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\Notification\notification.bundle.js.LICENSE.txt

Filesize
1KB

MD5
8595bdd96ab7d24cc60eb749ce1b8b82

SHA1
3b612cc3d05e372c5ac91124f3756bbf099b378d

SHA256
363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

SHA512
555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1339917345\json\i18n-tokenized-card\fr\strings.json

Filesize
2KB

MD5
cd247582beb274ca64f720aa588ffbc0

SHA1
4aaeef0905e67b490d4a9508ed5d4a406263ed9c

SHA256
c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

SHA512
bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1431197709\hyph-bn.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1431197709\hyph-mr.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1431197709\hyph-nn.hyb

Filesize
141KB

MD5
f2d8fe158d5361fc1d4b794a7255835a

SHA1
6c8744fa70651f629ed887cb76b6bc1bed304af9

SHA256
5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809

SHA512
946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab

Download Submit
\??\Volume{4b4f6944-0000-0000-0000-d08302000000}\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini

Filesize
39B

MD5
4fbef54f1973ec7d9484668e95657435

SHA1
36072b5eeba0ab74e5ddeb8dbaa58c0818efec96

SHA256
8c0b1ccd67e2f916cab23ea1b658dc6c4670f9090df8e622770ca75ebc0fd15d

SHA512
5a75513620973c2eec856dcb31182834353124a6e9e5d5446839a33fbea3b515431107d3a31d7d640f109b4f2e022f308becebf90bb8ae970bd20958d63ae283

Download Submit