Overview

overview

6

Static

static

1

MicrosoftE...up.exe

windows11-21h2-x64

6

Resubmissions

01/06/2026, 01:54

260601-cbx4vabt6t6

01/06/2026, 01:47

260601-b7wp8abs8v6

Analysis

  • user interaction
    yes
  • max time kernel
    76s
  • max time network
    82s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    01/06/2026, 01:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MicrosoftEdgeSetup.exe
  • Size 1.6MB
  • Sample260601-b7wp8abs8v
  • SHA256 bc3aa8419c7b6f3368006609d38ca1632eab3a04f624b5790d570d9d9ee7e9fa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Executes dropped EXE 42 IoCs
  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 9 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • System policy modification 1 TTPs 5 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeSetup.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5156
    • C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&usagestats=1&lang=ar&brand=M100"
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4400
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1624
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:5116
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:4696
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:964
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzcuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzNy43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezQxQzlCQzk0LTI0QUYtNEQzNi1CMjc2LTdCMzBDQTY4MjExM30iIHVzZXJpZD0ie0VBODhFNzE3LTIzOEEtNDY3NC1BQTI0LTk2RDZGRDA2Q0Q0N30iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9InszMEE3MjU1RS01QURBLTRDMTEtOUM1OS05RUEyQkFGNzFBQzN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtzVGFURlVvZFZPNmJnOXlubGpzQ3VscUMyTldZYmpiVEpEbHRmQ1B3VnlnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjY1IiBuZXh0dmVyc2lvbj0iMS4zLjIzNy43IiBsYW5nPSJhciIgYnJhbmQ9Ik0xMDAiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTAxMzY4NzMyIiBpbnN0YWxsX3RpbWVfbXM9Ijc1MCIvPjwvYXBwPjwvcmVxdWVzdD4
        3⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:3216
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&usagestats=1&lang=ar&brand=M100" /installsource taggedmi /sessionid "{41C9BC94-24AF-4D36-B276-7B30CA682113}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2240
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Checks system information in the registry
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzcuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzNy43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezQxQzlCQzk0LTI0QUYtNEQzNi1CMjc2LTdCMzBDQTY4MjExM30iIHVzZXJpZD0ie0VBODhFNzE3LTIzOEEtNDY3NC1BQTI0LTk2RDZGRDA2Q0Q0N30iIGluc3RhbGxzb3VyY2U9ImxpbWl0ZWQiIHJlcXVlc3RpZD0ie0MzRjBBNEJCLUQyRDAtNEUxMi1BODFCLTA1RkMxNjE0OTU3Rn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSIxNiIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O3NUYVRGVW9kVk82Ymc5eW5sanNDdWxxQzJOV1liamJUSkRsdGZDUHdWeWc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjE0MC4wLjczMzkuODEiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjE4IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Nzg3MTY5MzUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzQyMzE4OTQ0NzA3MzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxNTMxNzQ4MDciIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5MDc5MzEyODAiLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:3192
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CCED4559-0FA1-445D-8EF1-4408D12375C2}\MicrosoftEdge_X64_148.0.3967.96.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CCED4559-0FA1-445D-8EF1-4408D12375C2}\MicrosoftEdge_X64_148.0.3967.96.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5572
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CCED4559-0FA1-445D-8EF1-4408D12375C2}\EDGEMITMP_48D72.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CCED4559-0FA1-445D-8EF1-4408D12375C2}\EDGEMITMP_48D72.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CCED4559-0FA1-445D-8EF1-4408D12375C2}\MicrosoftEdge_X64_148.0.3967.96.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:5788
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CCED4559-0FA1-445D-8EF1-4408D12375C2}\EDGEMITMP_48D72.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CCED4559-0FA1-445D-8EF1-4408D12375C2}\EDGEMITMP_48D72.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          PID:1308
        • C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.96\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.96\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
          4⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:3156
        • C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.96\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.96\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
          4⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          PID:4780
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzcuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzNy43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezQxQzlCQzk0LTI0QUYtNEQzNi1CMjc2LTdCMzBDQTY4MjExM30iIHVzZXJpZD0ie0VBODhFNzE3LTIzOEEtNDY3NC1BQTI0LTk2RDZGRDA2Q0Q0N30iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntGQ0M0OEQ3OC0xRjYyLTRGN0QtOUU5Ri1FRTgxMzE4Q0IwRjB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtsU2Q4YWJiSmhqcVBkdGFVT0VLMnZadGtib2sxMWI1RVkvWEIxUjMyZTlVPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxNDguMC4zOTY3Ljk2IiBsYW5nPSJhciIgYnJhbmQ9Ik0xMDAiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxOCIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzNDIzMTk0ODYxMzUzMDI3MCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTIyMTQ5OTMxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDkyMjE0OTkzMSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMzEzNjg2NzciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2Q5OTU2YTc2LWFiNDItNDI4Yy1iNjQyLWNlM2ZlNjQxNmZmMT9QMT0xNzgwODgzMzAxJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWV3OGROOGp0YkNGbTNQeUd2TmF5OXVoUVlDYjl0MnJzVzkwZHVYaGpIWlRvS0hYTSUyZllMczlyJTJmNGxQQlZDT29paUx1Y29KTTNHTHJLN0NnckNFa04lMmJnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTkzMTQ4NzkyIiB0b3RhbD0iMTkzMTQ4NzkyIiBkb3dubG9hZF90aW1lX21zPSIxNDI5NyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMzE1MjQ5NjQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTQ2NTI1MDA1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDU1MTYxMTM0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNzM0IiBkb3dubG9hZF90aW1lX21zPSIyMDkzOCIgZG93bmxvYWRlZD0iMTkzMTQ4NzkyIiB0b3RhbD0iMTkzMTQ4NzkyIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIzMDg0OCIvPjwvYXBwPjwvcmVxdWVzdD4
      2⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:240
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3468
    • C:\Windows\SysWOW64\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3468" "800" "684" "820" "0" "0" "0" "0" "0" "0" "0" "0"
      2⤵
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:2596
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k UnistackSvcGroup
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:412
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Edge.GameAssist_8wekyb3d8bbwe
    1⤵
      PID:1632
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-installer
      1⤵
      • Drops file in Windows directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4536
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.217 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.96 --initial-client-data=0x240,0x244,0x248,0x23c,0x254,0x7ff83fbc5d58,0x7ff83fbc5d64,0x7ff83fbc5d70
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2952
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1888,i,6496946858984746206,15983420682792620041,524288 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2300 /prefetch:11
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3032
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1816,i,13621430976542162889,9465356019316908187,262144 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2104 /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2988
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2372,i,4931528512388625057,15911345193345113317,524288 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2552 /prefetch:13
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2196
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --skip-read-main-dll --metrics-shmem-handle=3128,i,17848007574811829884,15724717090049207094,2097152 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3204 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1120
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2984,i,11345081367506106285,1772663836050249206,2097152 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3136 /prefetch:1
        2⤵
        • Executes dropped EXE
        PID:2928
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --skip-read-main-dll --metrics-shmem-handle=3968,i,977352007849848286,15178268171496566627,2097152 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4052 /prefetch:1
        2⤵
        • Executes dropped EXE
        PID:1224
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --skip-read-main-dll --metrics-shmem-handle=3984,i,1273752097949012445,18130631226801076138,2097152 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4056 /prefetch:9
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4744
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --skip-read-main-dll --metrics-shmem-handle=4148,i,7590558520972874219,17739170317141728159,2097152 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4060 /prefetch:9
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2944
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --skip-read-main-dll --metrics-shmem-handle=4004,i,15734514401272008640,15861329745988689897,2097152 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4068 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2000
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=5448,i,13229778166168938799,14586227260400586245,524288 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5396 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5928
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=5480,i,9045901370611634241,2365503368221207883,524288 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5576 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3924
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5512,i,11797548231310441887,694596541814517029,524288 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5476 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5804
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5524,i,3153922453349552188,7438903613362138209,524288 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5528 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4972
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6460,i,1621343751560389195,607398691809015547,524288 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6464 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1272
        • C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.96\cookie_exporter.exe
          cookie_exporter.exe --cookie-json=1144
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5112
      • C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.96\identity_helper.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.96\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6520,i,1750750970529388474,18121291093341323973,524288 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6532 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:1860
      • C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.96\identity_helper.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.96\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6520,i,1750750970529388474,18121291093341323973,524288 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6532 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4864
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=6700,i,8505610203222778525,13429155810455680355,524288 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6728 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1112
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=6712,i,13572517268951889988,16619542083106869864,524288 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6764 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4048
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=7000,i,11981201345649492809,3673800669644212498,524288 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7016 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4004
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=7156,i,7759145572552391492,13778289877558747108,524288 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7164 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:2444
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=7320,i,14791168007934978114,5549629449189194312,524288 --field-trial-handle=2108,i,15241183152078358589,3394607444185940313,262144 --variations-seed-version --pseudonymization-salt-handle=2112,i,6260277348472892471,16711833913160403411,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7312 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5436
    • C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.96\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.96\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2664
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
      1⤵
        PID:5484

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Browser Extensions

            1
            T1176

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Image File Execution Options Injection

            1
            T1546.012

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Image File Execution Options Injection

            1
            T1546.012

            Defense Evasion

            Modify Registry

            4
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Browser Information Discovery

            1
            T1217

            Query Registry

            5
            T1012

            System Information Discovery

            5
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            setup.exe
            • Path C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Installer\setup.exe
            • Size 5.1MB
            • SHA256 a14996885114643e2419d470a02c29d182bddb0204565ab1987cff0c01774492
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedge_7z.data
            • Path C:\Program Files (x86)\Microsoft\EdgeCore\Optimized\Installer\msedge_7z.data
            • Size 5KB
            • SHA256 80de022b22ea34a032bd1a55172737eedd204a72a79d6806d960477eefab7ed2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CopilotUpdate.exe
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\CopilotUpdate.exe
            • Size 22KB
            • SHA256 01093a46273f0cb2a5c1882bc4e7e5dcaec20329917d5cc68c3703cddd89d520
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            EdgeUpdate.dat
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\EdgeUpdate.dat
            • Size 12KB
            • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MicrosoftEdgeComRegisterShellARM64.exe
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\MicrosoftEdgeComRegisterShellARM64.exe
            • Size 190KB
            • SHA256 1c904d7076f36b18733eeeecf73c633b870d5e8ed140976fb5132252db3373ad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MicrosoftEdgeUpdate.exe
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\MicrosoftEdgeUpdate.exe
            • Size 201KB
            • SHA256 9433867b0e1f703728adbb2b83e43113dabadcff5e77a56d62da02780d5a3350
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MicrosoftEdgeUpdateComRegisterShell64.exe
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
            • Size 224KB
            • SHA256 26851260f16e76e556471ca51d973f386f504addcfc8134b89d077eed54f1b1b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MicrosoftEdgeUpdateCore.exe
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\MicrosoftEdgeUpdateCore.exe
            • Size 272KB
            • SHA256 34dab27cf63e8d478158e18a709c12f13420e04f139de2a11fabe9798de1d7f3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NOTICE.TXT
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\NOTICE.TXT
            • Size 4KB
            • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdate.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdate.dll
            • Size 2.2MB
            • SHA256 b02dbe2d712d5d2af197cbe906e9cbbbe311eac250656554ae80ba68b13cf803
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_af.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_af.dll
            • Size 29KB
            • SHA256 45c087e9de686ef8303e52d3365e1522d0171fdd73aa97301cd82a9828ee7554
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_am.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_am.dll
            • Size 24KB
            • SHA256 9b34400303f50cf9f4847299607d95dc5ebaf6a195dcacde9286d9e02dc0a9be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ar.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_ar.dll
            • Size 26KB
            • SHA256 dd153bb18ddc7739b0fa70f4a9b8e453fede5a68ed6e4b7d3c4e9868b2e686e6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_as.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_as.dll
            • Size 28KB
            • SHA256 c0008c220180185455ffd89a799fa65107faa3cb15bdd60f727d95d755e1bc0d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_az.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_az.dll
            • Size 29KB
            • SHA256 26c857a73732ecefd60e59f12f2064dd80912f31febd221d34f5305396ecbccd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_bg.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_bg.dll
            • Size 29KB
            • SHA256 512e149d931589d00b06c6a81b0f8bd2cdddce87d92e2bca63448dc733b27f64
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_bn-IN.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_bn-IN.dll
            • Size 29KB
            • SHA256 6d9e04f1ea5d8a07bf54ae550210c7d14a4a641b6aa0781145dde6c8ec52ec62
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_bn.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_bn.dll
            • Size 29KB
            • SHA256 6379d00bd1b255f5fcfb7022be44b0dddb2ffba286c5a316c45edacbca7b7b85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_bs.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_bs.dll
            • Size 28KB
            • SHA256 94cee22396b55db9bc87177b2ff04ba8586fb64f3c9ea90539e68dd4ac2975f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ca-Es-VALENCIA.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
            • Size 30KB
            • SHA256 a273fe4e4ff29631d58b5c20164b5fee6295ce79942f933c7b21ddf18d6e313e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ca.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_ca.dll
            • Size 30KB
            • SHA256 c329b7a62f0486cf980bc5f0b827ea1be89d7576e526025ed65150e4f8b0dfd2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_cs.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_cs.dll
            • Size 28KB
            • SHA256 56859c575ed804409c586d9ea0c07fd33f2c641d9e3de58be479a5553e2b692d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_cy.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_cy.dll
            • Size 28KB
            • SHA256 b22b1c1109cfd95f9cffdaa792b386c176fb4a1dff96507edfd93e6f9d728ce1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_da.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_da.dll
            • Size 28KB
            • SHA256 43a54c0648137f3874bf9b03e008bfc0a53a0fb44fb0104df05c6f94f6375557
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_de.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_de.dll
            • Size 30KB
            • SHA256 4ad43580ee86f6bf01b39b08bf8618c4881c3505006d03251a3c98065c4176b6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_el.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_el.dll
            • Size 30KB
            • SHA256 7586f50370609fb1765b48f23af8702d65a88de3c785a6593e44d1666aba1325
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_en-GB.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_en-GB.dll
            • Size 27KB
            • SHA256 84ae379784465903a7daedc596670827f87df1916115a4f3981e25ebfdea17f8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_en.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_en.dll
            • Size 27KB
            • SHA256 886a45777512cee613dff15117a30f7c6cc965dec2537b5f9966f1b471be3d9c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_es-419.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_es-419.dll
            • Size 29KB
            • SHA256 490d5be41800508904b4530740610b6beb1847e3e6365bd06073bbba78e1e0ea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_es.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_es.dll
            • Size 28KB
            • SHA256 59621792791f9fed035ae7d528d157f6b9181f8ebfebe0590dba9097abfe3b89
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_et.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_et.dll
            • Size 28KB
            • SHA256 14c02eb31eb44d88c0756c82afdc68e2d7e3de02dc4dd4a7690521d08e305afc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_eu.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_eu.dll
            • Size 28KB
            • SHA256 e6181c997ed19dab536fb5cfd759fcca058edd05b6d1c6a7ee5db510bef61b1f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_fa.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_fa.dll
            • Size 27KB
            • SHA256 471f012dd01cc7e5361ff27a967acd22c12951dbef7f703ff69fad16fe58711f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_fi.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_fi.dll
            • Size 28KB
            • SHA256 6b13faef46ee9cb161201455015308f3cd9ea26359357a0a9b2e22fdfde97e7e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_fil.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_fil.dll
            • Size 29KB
            • SHA256 0bb20964c4da984392b1e34bfdbc104e97436702136b3d518c81945599efe5f6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_fr-CA.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_fr-CA.dll
            • Size 30KB
            • SHA256 8e596f3278774b6a234573ff5b03e039c8d5c8852b0bb069d26134404aa3ca95
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_fr.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_fr.dll
            • Size 30KB
            • SHA256 e614046aa15649d6252f25703a79347ebb017efb0a7b7873a256ae2d3ea59ba9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ga.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_ga.dll
            • Size 28KB
            • SHA256 5b3f1e6bd5a3e3fa31f96b653b0552d0c6f36e480848a53a8c93aefca9b027a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_gd.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_gd.dll
            • Size 30KB
            • SHA256 4dd0652934cbb40ccaf2017e8e463d78d1e136c09c99e7cd322506ec43f7dc9e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_gl.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_gl.dll
            • Size 28KB
            • SHA256 b833276fc66448fc7014abec760c832f812397d36912f868bcc6bf982e908384
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_gu.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_gu.dll
            • Size 28KB
            • SHA256 284aa36abead44c60916a4552ebb1760e93f34baf946247dc4f6ecec5306fbbb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_hi.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_hi.dll
            • Size 28KB
            • SHA256 dfb9f2475321efdd597eff7f8a6878c0c7eeea805cd00040d743ea204accd9d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_hr.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_hr.dll
            • Size 29KB
            • SHA256 61903e920fd02e83b2a7961335c09627aafb12753cf19fa330880cbe997f1873
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_hu.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_hu.dll
            • Size 29KB
            • SHA256 24e8727d53608e1a1edee1787ed56f076b2ad72c5f4c7d46d293f46dddbd1dd6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_id.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_id.dll
            • Size 28KB
            • SHA256 9bb163a6e0c654001e27596e78fd94216f11665d76b6f1677140de1dd7eb7d14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_is.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_is.dll
            • Size 28KB
            • SHA256 142b23ed07c722efa6da9f9d53ea2a793aaa001b13919d2bc4156128b4f2bfde
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_it.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_it.dll
            • Size 30KB
            • SHA256 503c95fdfa0a2bd7d07aa982283767b4319c37954d3da6624fcd127ed8447ce7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_iw.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_iw.dll
            • Size 25KB
            • SHA256 092eefae18876594665f8ae03a10e05271a9857fb88fe820d2c6ac07c9759e10
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ja.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_ja.dll
            • Size 24KB
            • SHA256 733538bcaff0d32c6d086999be78f3ed345b32f045faf0e4ecc1d60b7c94e9ab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ka.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_ka.dll
            • Size 29KB
            • SHA256 7ff184205da4b305a8a55e629ab3f7c56f5c4f1246fd475ea7dd4c99443fede0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_kk.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_kk.dll
            • Size 28KB
            • SHA256 fd44d30353305ba091ebf208755752f57463a288a973907589fe4155d9e672c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_km.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_km.dll
            • Size 27KB
            • SHA256 66ffc0e7325d324a2e7acc8769830c45b48268d53ff2e3211a8abeb071923a1b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_kn.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_kn.dll
            • Size 29KB
            • SHA256 b54e7d75a8a2f8068decbddda098beab6ad4a4576f2b3697781367bc31b6fd85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ko.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_ko.dll
            • Size 23KB
            • SHA256 3cb1b558d15ce220774efce4640e0361571a71fd7d69ed45e8f312cf9e7402ac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_kok.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_kok.dll
            • Size 28KB
            • SHA256 151a3caa09a6f5ab79859bcc1bd42002f791b7185b729d90536ca55e77a9f130
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_lb.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_lb.dll
            • Size 30KB
            • SHA256 ebae71e0d4fb2e0fc933a5a934f88fd367f97ce8b134290029c4dd334f6e7628
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_lo.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_lo.dll
            • Size 27KB
            • SHA256 5a3d8d496908bcb9a888a73bcf5f9385a7eedd3a5bd1d8be342e59de6b0f1913
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_lt.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_lt.dll
            • Size 28KB
            • SHA256 63e0e437e918688a971a3dc37b81e8ea674b582e23892ddf45a7e4f33554827f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_lv.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_lv.dll
            • Size 28KB
            • SHA256 d5d17dc3cdf54fcd9312158ecdc61ffcc902f19f766faac8fc82db8f2db3859c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_mi.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_mi.dll
            • Size 28KB
            • SHA256 fe29568b8d221cec984d1c52871d21bb79ff4a4f9aaa9be6ddec0fa433192101
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_mk.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_mk.dll
            • Size 29KB
            • SHA256 1eafea76f45119d944ab628fa8628995ab8e7430961ff66c8a4bd911a94efa9b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ml.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_ml.dll
            • Size 30KB
            • SHA256 a0ddcc46795a982d65a20cf0647be28d75aa117481e80312453429fa56b431c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_mr.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_mr.dll
            • Size 28KB
            • SHA256 b806bbb5bf20117b54d2870ccb90771e694e6f44485cd2037ddedecbd739f847
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ms.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUEF90.tmp\msedgeupdateres_ms.dll
            • Size 28KB
            • SHA256 2417bc0621f5b270da42c2bdc6cfe97c59540cb25d95cb8587e5559e590f3e6e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MicrosoftEdgeUpdate.log
            • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
            • Size 229KB
            • SHA256 e84f7c3f5fe99c4d5cc5606587b1002ad1433b7b9233071f2e61e2540245640c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.dat
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
            • Size 288B
            • SHA256 81563fb7dadb370abbbbf831d3b0205e18ad4e176e28389c2916cfc61fa7dd96
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            BookmarkMergedSurfaceOrdering
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
            • Size 6B
            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
            • MD5 SHA1 SHA512
            Submit Download

            SiteList-Enterprise.json
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
            • Size 2B
            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
            • MD5 SHA1 SHA512
            Submit Download

            Edge Profile.ico
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
            • Size 70KB
            • SHA256 99d779659d1d8c19b3013162dfa3c016b19e8a44b96f36cb563adfe16fc8d295
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            HubApps
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
            • Size 106KB
            • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
            • Size 111B
            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            Secure Preferences
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
            • Size 44KB
            • SHA256 d7fadd935f35d49fc82a3f74c03612bd7bf7b9278883150983cfe94d96a65854
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sync_diagnostic.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
            • Size 5KB
            • SHA256 bbe1477207abfa35105f03c2e2578d2a3e6fa3dd284303e2c95d47e1185b4040
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            da11f79a-ab4c-460a-9e70-768f8006b6d2.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\da11f79a-ab4c-460a-9e70-768f8006b6d2.tmp
            • Size 19KB
            • SHA256 3e3c3390893edd52a4ced54168da5df29e55324426b96d1b2033fe797ddbef57
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
            • Size 7KB
            • SHA256 4652817976357441173da335e0cda1651609f7fdebcd50fd950f83a307152d28
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
            • Size 8KB
            • SHA256 6a22915fd5a72cd344973cfb542bed628ece6d9c1e2057cc4c6af35fbc5c66a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
            • Size 22KB
            • SHA256 d31f818d119579207873e68f6dac9b2877f968b318db2186e0f010b8bc0d965e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2e308276-3cb8-435b-8a46-e92ee2203ec2.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2e308276-3cb8-435b-8a46-e92ee2203ec2.tmp
            • Size 13B
            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
            • MD5 SHA1 SHA512
            Submit Download

            38081944-cb88-44e2-8ff9-0d00e75b9779.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\38081944-cb88-44e2-8ff9-0d00e75b9779.tmp
            • Size 10KB
            • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            content_new.js
            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4536_545974555\CRX_INSTALL\content_new.js
            • Size 10KB
            • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            c5075377-2daa-418f-b276-619c57f063a1.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4536_630907005\c5075377-2daa-418f-b276-619c57f063a1.tmp
            • Size 147KB
            • SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/412-300-0x000001C336A30000-0x000001C336A31000-memory.dmp
            Download

            memory/412-283-0x000001C336ED0000-0x000001C336ED1000-memory.dmp
            Download

            memory/412-297-0x000001C336AF0000-0x000001C336AF1000-memory.dmp
            Download

            memory/412-287-0x000001C336ED0000-0x000001C336ED1000-memory.dmp
            Download

            memory/412-310-0x000001C336C40000-0x000001C336C41000-memory.dmp
            Download

            memory/412-308-0x000001C336C30000-0x000001C336C31000-memory.dmp
            Download

            memory/412-312-0x000001C336D50000-0x000001C336D51000-memory.dmp
            Download

            memory/412-311-0x000001C336C40000-0x000001C336C41000-memory.dmp
            Download

            memory/412-319-0x000001C326640000-0x000001C32675D000-memory.dmp
            Download

            memory/412-288-0x000001C336ED0000-0x000001C336ED1000-memory.dmp
            Download

            memory/412-285-0x000001C336ED0000-0x000001C336ED1000-memory.dmp
            Download

            memory/412-286-0x000001C336ED0000-0x000001C336ED1000-memory.dmp
            Download

            memory/412-284-0x000001C336ED0000-0x000001C336ED1000-memory.dmp
            Download

            memory/412-294-0x000001C336B00000-0x000001C336B01000-memory.dmp
            Download

            memory/412-282-0x000001C336ED0000-0x000001C336ED1000-memory.dmp
            Download

            memory/412-281-0x000001C336EB0000-0x000001C336EB1000-memory.dmp
            Download

            memory/412-280-0x000001C336EB0000-0x000001C336EB1000-memory.dmp
            Download

            memory/412-291-0x000001C336B00000-0x000001C336B01000-memory.dmp
            Download

            memory/412-249-0x000001C3267D0000-0x000001C3267E0000-memory.dmp
            Download

            memory/412-292-0x000001C336AF0000-0x000001C336AF1000-memory.dmp
            Download

            memory/412-290-0x000001C336ED0000-0x000001C336ED1000-memory.dmp
            Download

            memory/412-264-0x000001C3268C0000-0x000001C3268D0000-memory.dmp
            Download

            memory/412-289-0x000001C336ED0000-0x000001C336ED1000-memory.dmp
            Download

            memory/4632-247-0x00000000743B0000-0x00000000745F1000-memory.dmp
            Download

            memory/4632-200-0x00000000743B0000-0x00000000745F1000-memory.dmp
            Download

            memory/4632-323-0x0000000000D70000-0x0000000000DA5000-memory.dmp
            Download

            memory/4632-199-0x0000000000D70000-0x0000000000DA5000-memory.dmp
            Download