Overview

overview

6

Static

static

1

fccadb7c25...88.exe

windows10-2004-x64

6

fccadb7c25...88.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/08/2026, 01:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fccadb7c256db537f3cd8a68066b7bdfca080e88359e6989ff90b24d3590f788.exe
  • Size 1.6MB
  • Sample260826-bt2pbaxyes
  • SHA256 fccadb7c256db537f3cd8a68066b7bdfca080e88359e6989ff90b24d3590f788
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 12 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 58 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\fccadb7c256db537f3cd8a68066b7bdfca080e88359e6989ff90b24d3590f788.exe
    "C:\Users\Admin\AppData\Local\Temp\fccadb7c256db537f3cd8a68066b7bdfca080e88359e6989ff90b24d3590f788.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4156
    • C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={2CD8A007-E189-409D-A2C8-9AF4EF3C72AA}&appname=Microsoft%20Edge%20Beta&needsadmin=prefers&usagestats=1&lang=en-us&brand=M103"
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3852
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4684
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4180
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:2148
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:5628
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:4088
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuMjMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNTEuMjMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Q0I1MjREMzQtNDUyMy00QUI1LUFBMTUtMjI0RjlBNUFBNTFEfSIgdXNlcmlkPSJ7RUMzRDIxOEUtMEZENS00MUJGLTg2MjMtQUFENUQ1NkFBODcyfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezJGM0MzRUY4LUFEOEEtNEY0QS1BMjUwLURCRjNFNUI5MEYwQX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSIxNiIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjI2MTAwLjE3NDIiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxOTEiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7WExBRis0L2gxaHJudDZ2NzJrcUsxMnBTaE9LMlJsbjJ6OXRVWjh3S2F3cz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS42NSIgbmV4dHZlcnNpb249IjEuMy4yNTEuMjMiIGxhbmc9ImVuLXVzIiBicmFuZD0iTTEwMyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYyODExNjc5MDAiIGluc3RhbGxfdGltZV9tcz0iOTAzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        3⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:3208
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={2CD8A007-E189-409D-A2C8-9AF4EF3C72AA}&appname=Microsoft%20Edge%20Beta&needsadmin=prefers&usagestats=1&lang=en-us&brand=M103" /installsource taggedmi /sessionid "{CB524D34-4523-4AB5-AA15-224F9A5AA51D}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4232
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Checks system information in the registry
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuMjMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNTEuMjMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Q0I1MjREMzQtNDUyMy00QUI1LUFBMTUtMjI0RjlBNUFBNTFEfSIgdXNlcmlkPSJ7RUMzRDIxOEUtMEZENS00MUJGLTg2MjMtQUFENUQ1NkFBODcyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MzNEREUwNTQtQjA3Ny00MDkyLUE3MUUtREVDOTA3MDNCQUEwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjE5MSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtYTEFGKzQvaDFocm50NnY3MmtxSzEycFNoT0syUmxuMno5dFVaOHdLYXdzPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxNDAuMC43MzM5LjgxIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0NyIgaW5zdGFsbGRhdGV0aW1lPSIxNzgzNjA4MTQyIiBvb2JlX2luc3RhbGxfdGltZT0iMTM0MjgwODAyNTc3MzcwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iODYwNjU5NDMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYyODgwMjA3NTkiLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:1984
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33D380C0-B3FA-406C-8777-BA25A536D220}\MicrosoftEdge_X64_152.0.4191.41.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33D380C0-B3FA-406C-8777-BA25A536D220}\MicrosoftEdge_X64_152.0.4191.41.exe" --msedge-beta --verbose-logging --do-not-launch-msedge --system-level --channel=beta
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1320
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33D380C0-B3FA-406C-8777-BA25A536D220}\EDGEMITMP_BF878.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33D380C0-B3FA-406C-8777-BA25A536D220}\EDGEMITMP_BF878.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33D380C0-B3FA-406C-8777-BA25A536D220}\MicrosoftEdge_X64_152.0.4191.41.exe" --msedge-beta --verbose-logging --do-not-launch-msedge --system-level --channel=beta
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:4896
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33D380C0-B3FA-406C-8777-BA25A536D220}\EDGEMITMP_BF878.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33D380C0-B3FA-406C-8777-BA25A536D220}\EDGEMITMP_BF878.tmp\setup.exe" --msedge-beta --system-level --verbose-logging --create-shortcuts=0 --install-level=1
          4⤵
          • Executes dropped EXE
          PID:4556
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\Installer\setup.exe" --msedge-beta --register-package-identity --verbose-logging --system-level
          4⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4484
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\Installer\setup.exe" --msedge-beta --remove-deprecated-packages --verbose-logging --system-level
          4⤵
          • Executes dropped EXE
          PID:4960
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuMjMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNTEuMjMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Q0I1MjREMzQtNDUyMy00QUI1LUFBMTUtMjI0RjlBNUFBNTFEfSIgdXNlcmlkPSJ7RUMzRDIxOEUtMEZENS00MUJGLTg2MjMtQUFENUQ1NkFBODcyfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0E4NUE3OTg4LTUxOUYtNEQ4Ny1CMDgwLTE2MEVEOTQwMEMzN30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSIxNiIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjI2MTAwLjE3NDIiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxOTEiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7SGh2SElXcFVOWlRNblYyVlQxbGUzZjVZSlE5T1NvVEQ2TXhIRGxBODlQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7MkNEOEEwMDctRTE4OS00MDlELUEyQzgtOUFGNEVGM0M3MkFBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTUyLjAuNDE5MS40MSIgbGFuZz0iZW4tdXMiIGJyYW5kPSJNMTAzIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MzAwMDc4OTIzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjMwMDMyMjYwNiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY2ODY5NTEyNDAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzU3OWI5NDcxLWM2YzYtNGY5Yi1hMmU1LWZiNTMyYThmYjE1Yz9QMT0xNzg4MzEyNDMxJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVA5Q1pnUFlNU0IyVEZQU1VsYnlxQVNORGd4Rm1iMTFkRFdpJTJicnEzSm0lMmJ1MnJFcyUyZjB1bVY0TGpWbWs5ZEtjQ2U1WnQwVXpkaSUyYmRNUWZRek9Fazc3c0ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIyNTMzMzU4ODgiIHRvdGFsPSIyNTMzMzU4ODgiIGRvd25sb2FkX3RpbWVfbXM9IjMwMTQ1Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjY4NzIyOTM5MCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY3MDY4NzQxNDAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjcxMDczMTc3NjciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI3MTUiIGRvd25sb2FkX3RpbWVfbXM9IjM4NjcwIiBkb3dubG9hZGVkPSIyNTMzMzU4ODgiIHRvdGFsPSIyNTMzMzU4ODgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQwMDM3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:3392
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2404
    • C:\Windows\SysWOW64\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2404" "896" "744" "868" "0" "0" "0" "0" "0" "0" "0" "0"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3692
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3004
    • C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4056
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
      1⤵
        PID:1272
      • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --from-installer
        1⤵
        • Checks system information in the registry
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:3344
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data" --annotation=IsOfficialBuild=1 --annotation=channel=beta --annotation=chromium-version=152.0.7977.54 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=152.0.4191.41 --initial-client-data=0x268,0x26c,0x270,0x264,0x234,0x7ff91653e2a0,0x7ff91653e2b0,0x7ff91653e2c0
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3372
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1980,i,13181680347981906030,197958666512976528,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2604 /prefetch:11
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5996
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --startup-read-main-dll --metrics-shmem-handle=1768,i,10041818678424169909,7930556780971825723,262144 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2252 /prefetch:2
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3932
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2724,i,14359931177845789797,8035275525807445715,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2708 /prefetch:13
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2620
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3536,i,10652984330738953247,5260450942445355371,2097152 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3592 /prefetch:1
          2⤵
          • Executes dropped EXE
          PID:2900
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --skip-read-main-dll --metrics-shmem-handle=3544,i,5148317702446396429,14422104936150636257,2097152 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3660 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5792
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=4064,i,7796755452933868573,5548689560088889317,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4288 /prefetch:14
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3892
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --skip-read-main-dll --metrics-shmem-handle=4220,i,17470849781451018199,9903865955544445988,2097152 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5056 /prefetch:1
          2⤵
          • Executes dropped EXE
          PID:556
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --skip-read-main-dll --metrics-shmem-handle=4236,i,15325610694211838481,7175415194734142614,2097152 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5168 /prefetch:9
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5720
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --skip-read-main-dll --metrics-shmem-handle=4260,i,15022303405214957697,8492998691600197915,2097152 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5384 /prefetch:1
          2⤵
          • Executes dropped EXE
          PID:1296
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --skip-read-main-dll --metrics-shmem-handle=4352,i,5709399189335274864,8685021511699210482,2097152 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5200 /prefetch:1
          2⤵
          • Executes dropped EXE
          PID:4952
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --skip-read-main-dll --metrics-shmem-handle=4368,i,4294603709515434035,1847793747477469467,2097152 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5240 /prefetch:9
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3512
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --skip-read-main-dll --metrics-shmem-handle=4388,i,8790108353744311770,4750406375623932663,2097152 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5496 /prefetch:1
          2⤵
          • Executes dropped EXE
          PID:4976
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --skip-read-main-dll --metrics-shmem-handle=4404,i,17052848194368148832,12029602487928214227,2097152 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5480 /prefetch:9
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2684
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --skip-read-main-dll --metrics-shmem-handle=4424,i,15791794769230761482,1118327920643937252,2097152 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5452 /prefetch:1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1688
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --skip-read-main-dll --metrics-shmem-handle=4324,i,6999339995209328334,11337896275951154131,2097152 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5420 /prefetch:9
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1888
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --skip-read-main-dll --metrics-shmem-handle=4440,i,9612592873080379014,2454075971707406505,2097152 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5556 /prefetch:9
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5584
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --skip-read-main-dll --metrics-shmem-handle=6500,i,16646621495443214664,10631261093969165848,2097152 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5432 /prefetch:9
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1968
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=5424,i,12577516867393123862,16100223345512667982,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=4536 /prefetch:14
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2056
          • C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\cookie_exporter.exe
            cookie_exporter.exe --cookie-json=1180
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3756
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=5632,i,17946545264394336456,11555209231357462490,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6372 /prefetch:14
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5404
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=5648,i,1560800759286452357,4996446334297718627,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6996 /prefetch:14
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2968
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=6000,i,7640083968346544113,16318649892936721286,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6100 /prefetch:14
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:456
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\identity_helper.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=7292,i,15299997068032600386,17848084705997532807,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7300 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:2128
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\identity_helper.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=7292,i,15299997068032600386,17848084705997532807,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7300 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:5260
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=8188,i,14500791844409247311,8840301288718020616,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=8256 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:6728
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge-beta --force-configure-user-settings
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:6740
          • C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\Installer\setup.exe" --msedge-beta --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge Beta\Application\master_preferences" --create-shortcuts=1 --install-level=0
            3⤵
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Executes dropped EXE
            PID:6956
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=8412,i,7030493492248814641,1339601365589578978,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=8428 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:6788
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=8576,i,5591964826782030835,2463828682835165162,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=8720 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:6108
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=8240,i,12983551531246147809,10236064952478680865,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8768 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:2324
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=8744,i,3111890953502335979,17048188439661396611,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8228 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:6832
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5368,i,1765964200764009122,6373045104820768421,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=4348 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:6200
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=6928,i,13496972089071757200,13125312577209434723,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=5372 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:6360
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=3716,i,241753346098163944,3557374001111689019,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=5372 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:352
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=3760,i,11769783212245288981,6256725608609913192,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=4208 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:6972
        • C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge Beta\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=6620,i,7264243130405172264,13865936199116208877,524288 --field-trial-handle=2260,i,13809943845343302469,7205604084650007597,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,9977448397736614906,5463425277568986467,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=6636 /prefetch:14
          2⤵
          • Executes dropped EXE
          PID:1380
      • C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:3792
      • C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:800

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Image File Execution Options Injection

            1
            T1546.012

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Image File Execution Options Injection

            1
            T1546.012

            Defense Evasion

            Modify Registry

            3
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            5
            T1012

            System Information Discovery

            5
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            msedge_7z.data
            • Path C:\Program Files (x86)\Microsoft\Edge Beta\Application\152.0.4191.41\Installer\msedge_7z.data
            • Size 9KB
            • SHA256 83ac6eb9419f4192d921b785dbc96fca1c09dc2816a70eb37ae42900a5bd7224
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CopilotUpdate.exe
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\CopilotUpdate.exe
            • Size 22KB
            • SHA256 7ee38e82a14914db6bfa8fd879366cc4eda36ab87c748d61949fc287397ecbb9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            EdgeUpdate.dat
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\EdgeUpdate.dat
            • Size 12KB
            • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MicrosoftEdgeComRegisterShellARM64.exe
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\MicrosoftEdgeComRegisterShellARM64.exe
            • Size 194KB
            • SHA256 35ec821fadfa8209de2886509ae03a1aa6fb7920add0bee5220476bfde0b0f64
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MicrosoftEdgeUpdate.exe
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\MicrosoftEdgeUpdate.exe
            • Size 202KB
            • SHA256 66a9c98a32f8fd576a346863a450f247318250cac103a8e4f04ec2d1cd5eee4a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MicrosoftEdgeUpdateComRegisterShell64.exe
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
            • Size 227KB
            • SHA256 26141f72749fafe473f67bb250b1483900c19b8845e74b69ba46e6c3e443a377
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MicrosoftEdgeUpdateCore.exe
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\MicrosoftEdgeUpdateCore.exe
            • Size 274KB
            • SHA256 78b6ec0464be3aba9513e6d1244d42a0f8ea6d1ddfaf3a24e74ba87576851d33
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NOTICE.TXT
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\NOTICE.TXT
            • Size 4KB
            • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdate.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdate.dll
            • Size 2.3MB
            • SHA256 767d381c7aa5a39191e5c9dcb5e590d56c9741ea80ce2fe11ad85e5e9b2fee5f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_af.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_af.dll
            • Size 29KB
            • SHA256 4ed7a33fc981a85697d84033539c75733e5fa1a17c96f16216e446bb8118244b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_am.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_am.dll
            • Size 24KB
            • SHA256 3c6224236a9b6dfffc0829c229392acc51d1dff8a86ca37a45249db739e4b780
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ar.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_ar.dll
            • Size 26KB
            • SHA256 818e439014cca00a9054db87e131e6f4a6bd2a1018806995d7109fe1453972d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_as.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_as.dll
            • Size 28KB
            • SHA256 ab552f9f4e58f5b4c2d9160dff7aa98ad544f52f428ee039970061d38e088e74
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_az.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_az.dll
            • Size 29KB
            • SHA256 9c31d6651c311955e0a794910e71323239a9066fdea554461a5ed666a198fbaf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_bg.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_bg.dll
            • Size 29KB
            • SHA256 f2c9707b8819b73b46ef132aad79fa2dd00ebf13f2811b247ccebdcc861b1931
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_bn-IN.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_bn-IN.dll
            • Size 29KB
            • SHA256 87136e58703315e012a959e2fcda518a5689f6e975f207e29b69041cda3554fe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_bn.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_bn.dll
            • Size 29KB
            • SHA256 84fd6f3c8210bbed89f6f042e77b80b692d035abb6ba499db1ece479a54bcba1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_bs.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_bs.dll
            • Size 28KB
            • SHA256 ae2c105573d58144bc5d842ae76dbfaccedc633f76e95fcbca2c151602cbd087
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ca-Es-VALENCIA.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
            • Size 30KB
            • SHA256 cc7dca7df4778e9e0f4ee62ab8be39bf82d74fe3b4e4ec44f5f3fc50dcc6f7af
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ca.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_ca.dll
            • Size 30KB
            • SHA256 521823e03f4e0451106740c161f1b72e1975bdbfe040a0debcc55e96562faea7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_cs.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_cs.dll
            • Size 28KB
            • SHA256 81cc678b5842db675179e7111f1c2e4c7678104d48de0e4e6724c0f85cd27889
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_cy.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_cy.dll
            • Size 28KB
            • SHA256 5973a78301b6f91a1aa3a51104522f3e529f59b2c434a427695aedbcbe3abab7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_da.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_da.dll
            • Size 28KB
            • SHA256 9d15832b2f79cedc4f44cd01658a057b6f23556f78486a40cf0f092bb297f9e0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_de.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_de.dll
            • Size 30KB
            • SHA256 3c20d719daa000b9475eca74b1b76d0cb206c5f9e315cdb0069ca05866532d88
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_el.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_el.dll
            • Size 30KB
            • SHA256 4dafed576ef61b4fa0a9fdbc4ba87c77988ee8ddb7a7a7ef25480d4023c9d524
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_en-GB.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_en-GB.dll
            • Size 27KB
            • SHA256 534c28c5b51335871077f862473e07b1d6428d573f011781bf0701125d170200
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_en.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_en.dll
            • Size 27KB
            • SHA256 f95a7d7cd5c3257d694cc5ceb105348aa75522dd1a9b479338721f0cad44cd77
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_es-419.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_es-419.dll
            • Size 29KB
            • SHA256 9bb6c4cc3a62206db9313364a34cbf6fe1b755850e4ed15abd8f2f66657a66b2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_es.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_es.dll
            • Size 28KB
            • SHA256 c4651d574bccb16edea929f0083d167c1eab821a00f4923edb35036e6acc3aad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_et.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_et.dll
            • Size 28KB
            • SHA256 2af694fd709a067972c546f6b795514e9141461ee9f39678b92f7d219df5c24d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_eu.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_eu.dll
            • Size 28KB
            • SHA256 d63d88e2d51286e53cdabd427e13472f52c562c5c3a84ec569f022d9db192b1f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_fa.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_fa.dll
            • Size 27KB
            • SHA256 063420f389706a84784b5026b25a9ce6192e7302166bbadf21ab7e1cec139ff5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_fi.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_fi.dll
            • Size 28KB
            • SHA256 f5cb7bef4416ff9f9bc89334afef573a1e5c7b94caa4eb9f0d03f3ab0b56d40c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_fil.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_fil.dll
            • Size 29KB
            • SHA256 2f448e91a605f3eb09ab0ee0df731ce2cdc30b2243bce5420b0c023cb42dd7e9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_fr-CA.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_fr-CA.dll
            • Size 30KB
            • SHA256 a3a9db1fe202f3b44565ddaf9970235d9e3f4f9cf5c9e3719a3eee484920cc0d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_fr.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_fr.dll
            • Size 30KB
            • SHA256 a80ab41f6a6b13e60840528b13a1ea591d4ae7029ce3dc637f3589223b9b9d84
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ga.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_ga.dll
            • Size 28KB
            • SHA256 ee1a0dfed1f3263ced6ad013dbb0b9aac529df72c09bab5a1b3f0311cfcb2cb7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_gd.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_gd.dll
            • Size 30KB
            • SHA256 1878788ea2dc6d205ab4a130172840d9238d9532f9db6f34b8bf5688acf8d6d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_gl.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_gl.dll
            • Size 28KB
            • SHA256 4eeae8e1abc6282b77f073e87961203bc4aad15234a3f5d379f2874f57d9ae78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_gu.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_gu.dll
            • Size 28KB
            • SHA256 f2c0eec61fb10af7432c31fe970c313bc56df7d60c61ead72153fded0a386239
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_hi.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_hi.dll
            • Size 28KB
            • SHA256 9f8fc77edf5c4affc6441d38b4dbd195145ea9b249c133e2337b2c6ac825b594
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_hr.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_hr.dll
            • Size 29KB
            • SHA256 01270bef18bc494a05da66c375b48ef2fc32933f28a492986d162b980be15915
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_hu.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_hu.dll
            • Size 29KB
            • SHA256 c1229d6b90642fc45b2391a6d155207997d976e813cfc2dc9548230d2d9e42e5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_id.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_id.dll
            • Size 28KB
            • SHA256 271e39a4dac315a96e5be9898c205a5afe8e2a9d427c25e1a8866157849ac10f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_is.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_is.dll
            • Size 28KB
            • SHA256 ccb23fe647cd684b92af67f756dba545310c6b724ac3183478b14583fd492af3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_it.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_it.dll
            • Size 30KB
            • SHA256 0526afbd369ca23aa7c7365464d81a9b0e78f9654ef1a12e99e17e8133e8661e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_iw.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_iw.dll
            • Size 25KB
            • SHA256 5873fac906613708deb9d38ee9c92d089d662815d7c890fe66824f13a9b758e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ja.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_ja.dll
            • Size 24KB
            • SHA256 9804af9177dd6230656b3087649565a02740d2fa6ea154c34eed19a3e9df0e2c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ka.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_ka.dll
            • Size 29KB
            • SHA256 7b815065f1af222551d4a4987e21526ec28a2b5549759d042bfe3a2bc3fae7e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_kk.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_kk.dll
            • Size 28KB
            • SHA256 d1b30f2e9abcd76d7407c4fb537b7b69030554894b2f780cd6eaecf82a38aced
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_km.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_km.dll
            • Size 27KB
            • SHA256 2d14a3764c5ab3b8c74771044d80a39154191825d3eee6f317d931d7fede4949
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_kn.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_kn.dll
            • Size 29KB
            • SHA256 9c38310e8ae1caede6b7d490a27561a84ba179998bd46e9af6e83fa21a5aa675
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ko.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_ko.dll
            • Size 23KB
            • SHA256 408acc13f54a5d242a99a3c0c3ea2e637a0d38aa9c2886ca39dfbf4189cc7095
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_kok.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_kok.dll
            • Size 28KB
            • SHA256 b745969a5ab4820e1f1744e6c925ce0c79afa9c11022f763120c0785a0b7e99a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_lb.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_lb.dll
            • Size 30KB
            • SHA256 01276444b8b9c5db0c23dbed8a1490e377e645e455a838aa79900e6e826f28ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_lo.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_lo.dll
            • Size 27KB
            • SHA256 74161c808612aa7613d9e89abd20666508fb5cd6d71d4335e0e9532595ea7515
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_lt.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_lt.dll
            • Size 28KB
            • SHA256 6d45503c689dc023708fd8c24ab858863a9871e52861b592cfb1d12253f47aff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_lv.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_lv.dll
            • Size 28KB
            • SHA256 4f8320e4617a197a4e99c154e368adeec2c4ef161458f9ce47e0b7d022cf04c3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_mi.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_mi.dll
            • Size 28KB
            • SHA256 85be9005af63b47840d55cbbf0e587f9f328b9c0fe6749e522e8aec88dc36dee
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_mk.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_mk.dll
            • Size 29KB
            • SHA256 1c3af925ab59e8884a96da9e24d0f8df9566afd7f16f5de3987170e87cd81b34
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ml.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_ml.dll
            • Size 30KB
            • SHA256 0c1527f70712c867406cd0b1134032453373715feb8c107798656413449b912f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_mr.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_mr.dll
            • Size 28KB
            • SHA256 9b2e808699fd2a61abcfe674993d0ffc1a607db38de31a35f1f1dc61d7359e92
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msedgeupdateres_ms.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EUE14E.tmp\msedgeupdateres_ms.dll
            • Size 28KB
            • SHA256 1e9f3cbaf3dc4f35aa0a5ee38e70b5e1b32c4e1f43ea10e42f39a216be945178
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MicrosoftEdgeUpdate.log
            • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
            • Size 192KB
            • SHA256 a195573b8f2ef0804debf58e44c532d4eddbd6400bf9a94286ef46983e0701e8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.dat
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Crashpad\settings.dat
            • Size 288B
            • SHA256 dc4751d790778ba75ce69359277b96fbc97068b240d9fbe320227db126f74c17
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            0895081a-714d-4e88-a157-09c3ef941540.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\0895081a-714d-4e88-a157-09c3ef941540.tmp
            • Size 14KB
            • SHA256 6a42011d7f6b858bf0f2a4dac181df7af0643a15731e8358ecac9ea0665eb898
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            52da2aa7-ce67-4804-9e46-f910a57115a4.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\52da2aa7-ce67-4804-9e46-f910a57115a4.tmp
            • Size 35KB
            • SHA256 df4649844138d78aaa5d5579132091b9532aea5e94039391d1482e473cb0f855
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            8e7dd1f3-2010-4f9c-8fb8-279ab7a3b7b3.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\8e7dd1f3-2010-4f9c-8fb8-279ab7a3b7b3.tmp
            • Size 68KB
            • SHA256 1712cebbaf0be5d5e64b2f930408da9b1e1bd70909bb23f5e0d0881d5aba57f8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000032
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Cache\Cache_Data\f_000032
            • Size 133KB
            • SHA256 162aaab39576d3779b65c355d3fb22cb7131cb3a3dd6d4de22df9a5dcad19c28
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2247795a-8101-41e7-9b08-3fb40ece318c.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Code Cache\js\index-dir\2247795a-8101-41e7-9b08-3fb40ece318c.tmp
            • Size 48B
            • SHA256 276334ab798e8775817c473816bf8e5de5c5bfd15622aad425bd2ba5dde5bc67
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Code Cache\js\index-dir\the-real-index
            • Size 2KB
            • SHA256 b37af42fc7e60e080b816b362f8607e9173556706c28f66595d75126f0fa68d8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Preferences
            • Size 17KB
            • SHA256 13ea0a3462bfaa298fd02874ea34b6a75cec6b4c25f8951a0a3b57c79af66728
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Secure Preferences
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Secure Preferences
            • Size 41KB
            • SHA256 be42bb5678c6237c35702d2170943106f1664c215eaa0796ccb2761f3992c9e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            db1ef3e0-a48c-4b3d-b8ed-58b2d22084cf.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a9556c67-7f77-4057-88bd-fb1179e59e20\index-dir\db1ef3e0-a48c-4b3d-b8ed-58b2d22084cf.tmp
            • Size 48B
            • SHA256 a594649e48019f1b84e570d8b337371fbb016c0c622f4b705e505bbd8785a866
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a9556c67-7f77-4057-88bd-fb1179e59e20\index-dir\the-real-index
            • Size 72B
            • SHA256 c797a921389c66e663d724467379294fd3653ab86c12492cbe99d4645c3f18c3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ad531c2a-e817-4794-90b5-e05c4bc345ba.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ad531c2a-e817-4794-90b5-e05c4bc345ba.tmp
            • Size 153B
            • SHA256 59a5b97118254b0653db87f2c033b47de43fc43e961f89ffc92359ab32ae2d08
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            6567e2ba-0eed-4d38-a484-415fe545361c.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fdd095c3-4d83-4d9b-a37b-e148344ba2d1\index-dir\6567e2ba-0eed-4d38-a484-415fe545361c.tmp
            • Size 48B
            • SHA256 fef22bc80e602b602741e87876a38b2a081ded7e1be594dd57f33afca958d580
            • MD5 SHA1 SHA512
            Submit Download

            temp-index
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fdd095c3-4d83-4d9b-a37b-e148344ba2d1\index-dir\temp-index
            • Size 3KB
            • SHA256 aa2b7be475e50aa4e76e8ee97def2378f0b5257e5452a992028f5408630d9aa6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            index.txt
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
            • Size 279B
            • SHA256 8de4d935c6007c791352012cec08dabe850a22558b04b5ea253e0bdb9be5cbd2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            index.txt
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
            • Size 375B
            • SHA256 373e88c341c65ebd04c5afc157d84ba3135ba9f78ccb5c7f199fe0a6555fdfd9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            index.txt
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
            • Size 371B
            • SHA256 9ae36c37a1b9b32081a15a3fd92cce0f6708a2f5d29e58ab5b562c7f3d5e69a8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            index
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Service Worker\ScriptCache\index
            • Size 24B
            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
            • MD5 SHA1 SHA512
            Submit Download

            cd312648-c74e-451e-b41b-3ac1d56902e6.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Service Worker\ScriptCache\index-dir\cd312648-c74e-451e-b41b-3ac1d56902e6.tmp
            • Size 72B
            • SHA256 7e0a17242a18845d5ff6593a99d620a46cd1721cbac32262a9deb312810c919f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
            • Size 96B
            • SHA256 e61b84f005b0650da6f8347d39595a59eabc1c3d47a4e96924a86775fdd3affe
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            5082d3b0-3094-4051-ae1e-cb43d2aa7770.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\5082d3b0-3094-4051-ae1e-cb43d2aa7770.tmp
            • Size 48B
            • SHA256 860737108f7f31db2d1b35c3c6225c1c1c0e1306de547a9aa7a55ec4f0728367
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
            • Size 72B
            • SHA256 2e0b2f8e2ff5878f9077ad40bf089cb0e608077278e69ee0bd181d9fcde21df0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnWebGPUCache\data_1
            • Size 264KB
            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            000001.dbtmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Sync Data\LevelDB\000001.dbtmp
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\Sync Data\LevelDB\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            d8803309-9bb9-450d-8131-e528caec482d.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Default\d8803309-9bb9-450d-8131-e528caec482d.tmp
            • Size 14KB
            • SHA256 748a5662d85c8fbaccdd531fa8248149f988479cbbc1c1579d5b59ba203059cb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Local State
            • Size 3KB
            • SHA256 86fa4f29c675815e3f39ac4be64c8987ee345bc525a685f2b3242695dbb45915
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Local State
            • Size 3KB
            • SHA256 9974374b7ee7d203683dc2c9d6d60efe58d5df0c8378bbd820ab58b15c126cc7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Local State
            • Size 12KB
            • SHA256 2633cf84fc439d0bd1bc8b5f1e924fd033a980d16b8a0b2d17ef667a68fd8852
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\Local State
            • Size 12KB
            • SHA256 1513c11a5d352a6b7c4cff8fe0a3a0db1c7eab39fff7904321f9557eeefd0312
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VariationsRuntimeSeedV2
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\VariationsRuntimeSeedV2
            • Size 462B
            • SHA256 7a079e164db692d44916703c5cbbdd8d802b8ce3934c47433bf44ad2614ac547
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            VariationsSeedV2
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\VariationsSeedV2
            • Size 766B
            • SHA256 4b715306ec4789053ff9db5d316c1f8ec81e4e2d7c64f5c3f4abab3f26f371b5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            VariationsSeedV2
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\VariationsSeedV2
            • Size 11B
            • SHA256 b4cc4174735c28360b9081be3c3d0552d8a4b3cdb54431ac00ed0d622bab6296
            • MD5 SHA1 SHA512
            Submit Download

            VariationsSeedV2
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\VariationsSeedV2
            • Size 4KB
            • SHA256 e40217e216c6e24712432f413b4c19f196350b272812590ef389ee50d41cb90e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            a5bcd9cf-9937-44ad-95fd-aba11fcfb55d.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\a5bcd9cf-9937-44ad-95fd-aba11fcfb55d.tmp
            • Size 19B
            • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
            • MD5 SHA1 SHA512
            Submit Download

            47fa34408608d683bcd1032f041dd80b8ed49a29023926161b12ece442d09331
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\component_crx_cache\47fa34408608d683bcd1032f041dd80b8ed49a29023926161b12ece442d09331
            • Size 12.4MB
            • SHA256 47fa34408608d683bcd1032f041dd80b8ed49a29023926161b12ece442d09331
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            77ab8c118fd534ab1cf48f984963d6d35ebf06580b0041ec7d594ce88561ad84
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\component_crx_cache\77ab8c118fd534ab1cf48f984963d6d35ebf06580b0041ec7d594ce88561ad84
            • Size 566KB
            • SHA256 77ab8c118fd534ab1cf48f984963d6d35ebf06580b0041ec7d594ce88561ad84
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            df5bb9f2afeb58b7c813d43eaa32cf6b240e346614ec52425bb5ff323450cd51
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\component_crx_cache\df5bb9f2afeb58b7c813d43eaa32cf6b240e346614ec52425bb5ff323450cd51
            • Size 20KB
            • SHA256 df5bb9f2afeb58b7c813d43eaa32cf6b240e346614ec52425bb5ff323450cd51
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata.json
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\component_crx_cache\metadata.json
            • Size 460B
            • SHA256 e3b20b210674757002880c0f0a80d1ef12b27df7ae964f2dc2c511e9f4de07cd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            e92d4e53-cd91-41e0-9e35-ac7576cc79b8.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\e92d4e53-cd91-41e0-9e35-ac7576cc79b8.tmp
            • Size 1KB
            • SHA256 45ac2d8440c2b657e83fe75c60094866225c560259ebbe7eec5134c590dd5ec1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata.json
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge Beta\User Data\extensions_crx_cache\metadata.json
            • Size 13B
            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
            • MD5 SHA1 SHA512
            Submit Download

            content_new.js
            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3344_911271067\CRX_INSTALL\content_new.js
            • Size 10KB
            • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            b83411b57700da9b.customDestinations-ms
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b83411b57700da9b.customDestinations-ms
            • Size 3KB
            • SHA256 f0ff0e2ad8453e07f20fa0453708beb5fd578c3fffccfb34824b263e188238f5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_M365_dark.png\1.7.43\asset
            • Size 2KB
            • SHA256 17c47f70c096c92fcf31044f34dd1836f454d2446a6c614e96789a9ca52d152a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_amazon_music_light.png\0.0.1\asset
            • Size 895B
            • SHA256 387caca784e5c384bbc89f61df3539ce87cc664a36b007a3a0ac827f5153082e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_apple_music.png\0.0.8\asset
            • Size 1KB
            • SHA256 4aa55139925ce8b958cc9961d7112af4cc9d44aa26a372f7b1576d4689ae67de
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_facebook_messenger.png\0.0.8\asset
            • Size 2KB
            • SHA256 dea15124575c62cbad5fc224e30876d8e8ccdfca8c6d52cb662bd9cff842330c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_fluent_office_hc.png\0.0.11\asset
            • Size 686B
            • SHA256 e7603a834c5bf04b669d8cb8fee1d518fb51d99752acbbcd735491cb6bafc976
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_gmail.png\0.0.7\asset
            • Size 1KB
            • SHA256 17dc41f2c23582ff8b0a7ee9c005845b303014ee73f1ccf9867e2357764edd35
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_instagram.png\0.0.8\asset
            • Size 2KB
            • SHA256 e703a9462776d31e2c2bd384607f7ed2fd7253f0e788db43bab725c71908acaf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_mstravel_logo_light.png\1.0.0\asset
            • Size 1KB
            • SHA256 c85c699eaa1cab3b2e2dac48bbe8a2d6adb73e6809643e3af9a3cfea0d912df4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_office.png\0.0.11\asset
            • Size 1KB
            • SHA256 d888d9ed781466463666a13b91d326a18b801c7dcd36163e25467e155fc3784a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_onenote_dark.png\1.4.13\asset
            • Size 861B
            • SHA256 fbded32c4291c0b5c97397d8aac5385256f237023beb21e90a6c8b7eb0e8aa68
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_outlook_dark.png\1.12.17\asset
            • Size 1KB
            • SHA256 1e08328bdb799d6e1ba7fc3cc4bd43ce6509a7c9ad2a61c5176bf7d5fd88e3d8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_settings_dark.png\1.1.18\asset
            • Size 1KB
            • SHA256 7ef95732ee6e615496d505b1696c6fa24e29d544e788c43db26e6ace8132d86e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_settings_hc.png\1.5.18\asset
            • Size 256B
            • SHA256 9fcd4bf1e7e327e9e66766959a0f697ba69378b09c1d0fc13e289e4e62f5178b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_settings_light.png\1.5.7\asset
            • Size 1KB
            • SHA256 f353ca269811e78272e9db7f79e5af00f73b8af4602129e4665dfe2d1da0b9d5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_spotify.png\0.0.6\asset
            • Size 1KB
            • SHA256 26781054eb1010667bd307cf420224744f25df24f45372187a07e55fb66c2dff
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_teams_dark.png\1.5.15\asset
            • Size 998B
            • SHA256 7204f78497cd59dfcec76dc185b204af293922a18e1722c5cbe47e3fabd2e118
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_1699838350\edge_hub_apps_youtube.png\0.0.4\asset
            • Size 451B
            • SHA256 04cc7a34de2de21261cfffde014cb4927bd2ead5c70bbdbccfd351fc23f3fe83
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata.json
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_83991638\domains_config_gz\2.0.0-DeepEEEnUsProductByRegexOnly\metadata.json
            • Size 197B
            • SHA256 40f7c1b268dedce3aa8c283fc59eac1210ddca9dbea81af80831569c63edced9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata.json
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_83991638\domains_config_gz\2.0.0-DeepEEEnUs\metadata.json
            • Size 179B
            • SHA256 2b956449ab63474af3e7ff1df21344f9288d0a38b7d3afdc9daaa3cecd610d22
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata.json
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_83991638\domains_config_gz\2.0.0\metadata.json
            • Size 168B
            • SHA256 fa3ddd74d9fe5418ff9f9298380be88675dd82a9ee5c0f76c36606bdd8635e71
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata.json
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_83991638\domains_config_gz\3.0.0-DeepEEEnUsProductByRegexOnly\metadata.json
            • Size 197B
            • SHA256 9763ab74a214a7326851ba924b467817c21df3c887b99564a33c11cf5caff2b1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_83991638\domains_config_gz\3.0.0-DeepEEEnUsRegexOnly\asset
            • Size 138KB
            • SHA256 05502eeaea0d5ecd45676fae4f17eb9a767b4d2217e8a61bd914e6d708a6db8d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata.json
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_83991638\domains_config_gz\3.0.0-DeepEEEnUsRegexOnly\metadata.json
            • Size 188B
            • SHA256 b1bc8c97678821181871b8e8b1d1cd77bf4dab99bfa845262b9c8503a316070b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata.json
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_83991638\domains_config_gz\3.0.0-DeepEEEnUs\metadata.json
            • Size 179B
            • SHA256 0416ba13c4eb83915d55181dff0c897dd431c5ed4b7fe1764b4c6e0b6a5d8435
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata.json
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_83991638\domains_config_gz\3.0.0-HeuristicClassifierOptimization\metadata.json
            • Size 200B
            • SHA256 fb5c89091f1035cdbd903ce7cfbcd578b2cef35e9a46f36afa5f19ceca078d18
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata.json
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_83991638\domains_config_gz\3.0.0\metadata.json
            • Size 168B
            • SHA256 dc4aa550e3a072fe4f96d1ba81f2d73d1c000e75096b40ef1b29a25a191261d6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            asset
            • Path C:\Windows\SystemTemp\msedge_chrome_Unpacker_BeginUnzipping3344_83991638\pre-release\domains_config_gz\2.0.0-DeepEEEnUsProductByRegexOnly\asset
            • Size 256KB
            • SHA256 2ddeeeb9f6088fa6d899f6e2a5271bdc0d526ed403905b1f5c4407fb75ce78f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/456-569-0x00007FF938C90000-0x00007FF938C91000-memory.dmp
            Download

            memory/456-568-0x00007FF9396C0000-0x00007FF9396C1000-memory.dmp
            Download

            memory/2900-304-0x000001B1C97B0000-0x000001B1C97C0000-memory.dmp
            Download

            memory/3852-183-0x0000000000160000-0x0000000000195000-memory.dmp
            Download

            memory/3852-233-0x0000000000160000-0x0000000000195000-memory.dmp
            Download

            memory/3852-192-0x0000000074C60000-0x0000000074EA7000-memory.dmp
            Download

            memory/3852-184-0x0000000074C60000-0x0000000074EA7000-memory.dmp
            Download

            memory/3932-299-0x00007FF939300000-0x00007FF939301000-memory.dmp
            Download

            memory/5792-339-0x00007FF939300000-0x00007FF939301000-memory.dmp
            Download