c3ff654a5d646b05b0f2bbd561c9755523da906faf5159fa681beddce2a5edab

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2023, 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The+BPR.msi
Size

11.8MB
MD5

6c18d2ef58254ef7ed313615a4d22313
SHA1

b3378cd5fdb3e39ec2efa56f8f734528dd60edc0
SHA256

c3ff654a5d646b05b0f2bbd561c9755523da906faf5159fa681beddce2a5edab
SHA512

fe211b2ed86e3c8d5503ffe182b904707b4885e7af3b98df50d78d65b98b6aa1d976e9949b80e583746baf9b96e186740fab569888888bec61822cbfb6e22e2f
SSDEEP

196608:2lXHnh3zskdvgnaF9Rhc0kvOvscawFA6pwi26tJYtli52uwp37kEsKt:2lXB31d8mRhcYkNepxrtylxdz

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	748	msiexec.exe
7	748	msiexec.exe
9	748	msiexec.exe

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Executes dropped EXE 22 IoCs

pid	Process
1352	TheBPRService.exe
4632	MSI1125.tmp
1452	MicrosoftEdgeUpdate.exe
5088	MicrosoftEdgeUpdate.exe
3856	MicrosoftEdgeUpdate.exe
3060	MicrosoftEdgeUpdateComRegisterShell64.exe
4016	MicrosoftEdgeUpdateComRegisterShell64.exe
4376	MicrosoftEdgeUpdateComRegisterShell64.exe
2324	MicrosoftEdgeUpdate.exe
1604	MicrosoftEdgeUpdate.exe
4812	MicrosoftEdgeUpdate.exe
3944	MicrosoftEdgeUpdate.exe
1340	MicrosoftEdge_X64_116.0.1938.62.exe
4488	setup.exe
2496	MicrosoftEdgeUpdate.exe
3856	The BPR.exe
3832	msedgewebview2.exe
4960	msedgewebview2.exe
2696	msedgewebview2.exe
4048	msedgewebview2.exe
2744	msedgewebview2.exe
1784	msedgewebview2.exe

Loads dropped DLL 56 IoCs

pid	Process
4508	MsiExec.exe
4508	MsiExec.exe
1352	TheBPRService.exe
1352	TheBPRService.exe
1452	MicrosoftEdgeUpdate.exe
5088	MicrosoftEdgeUpdate.exe
3856	MicrosoftEdgeUpdate.exe
3060	MicrosoftEdgeUpdateComRegisterShell64.exe
3856	MicrosoftEdgeUpdate.exe
4016	MicrosoftEdgeUpdateComRegisterShell64.exe
3856	MicrosoftEdgeUpdate.exe
4376	MicrosoftEdgeUpdateComRegisterShell64.exe
3856	MicrosoftEdgeUpdate.exe
2324	MicrosoftEdgeUpdate.exe
1604	MicrosoftEdgeUpdate.exe
4812	MicrosoftEdgeUpdate.exe
4812	MicrosoftEdgeUpdate.exe
1604	MicrosoftEdgeUpdate.exe
3944	MicrosoftEdgeUpdate.exe
2496	MicrosoftEdgeUpdate.exe
4508	MsiExec.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3832	msedgewebview2.exe
4960	msedgewebview2.exe
3832	msedgewebview2.exe
3856	The BPR.exe
3856	The BPR.exe
4048	msedgewebview2.exe
4048	msedgewebview2.exe
2696	msedgewebview2.exe
2744	msedgewebview2.exe
2696	msedgewebview2.exe
2744	msedgewebview2.exe
3832	msedgewebview2.exe
2696	msedgewebview2.exe
2696	msedgewebview2.exe
2696	msedgewebview2.exe
2696	msedgewebview2.exe
1784	msedgewebview2.exe
1784	msedgewebview2.exe
1784	msedgewebview2.exe

Registers COM server for autorun 1 TTPs 33 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85503227-BB57-4913-BD2D-B3D43F5C03B6}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85503227-BB57-4913-BD2D-B3D43F5C03B6}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85503227-BB57-4913-BD2D-B3D43F5C03B6}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85503227-BB57-4913-BD2D-B3D43F5C03B6}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85503227-BB57-4913-BD2D-B3D43F5C03B6}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85503227-BB57-4913-BD2D-B3D43F5C03B6}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85503227-BB57-4913-BD2D-B3D43F5C03B6}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85503227-BB57-4913-BD2D-B3D43F5C03B6}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85503227-BB57-4913-BD2D-B3D43F5C03B6}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\The BPR = "C:\\Program Files (x86)\\The BPR\\The BPR.exe /minimise"	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\ug.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Trust Protection Lists\Mu\Entities	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\eu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\Locales\pl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\EdgeWebView.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\fr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\is.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\psmachine_64.dll	MSI1125.tmp
File created	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Trust Protection Lists\Sigma\Content	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\20230703135613040_4488.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\msedge.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\Trust Protection Lists\Mu\Entities	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\concrt140.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Extensions\external_extensions.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_ug.dll	MSI1125.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\EBWebView\x86\EmbeddedBrowserWebView.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\VisualElements\SmallLogo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\Locales\fr-CA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\Locales\nl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_en.dll	MSI1125.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_vi.dll	MSI1125.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_as.dll	MSI1125.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\Locales\sr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_fr.dll	MSI1125.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_is.dll	MSI1125.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\hr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_kk.dll	MSI1125.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\EdgeWebView.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\Locales\ka.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\dwritemin.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\msedge.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\kok.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\uk.pak	setup.exe
File created	C:\Program Files (x86)\The BPR\FontAwesome.WPF.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_hu.dll	MSI1125.tmp
File created	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\it.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\Trust Protection Lists\Sigma\Fingerprinting	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\Locales\ca.pak	setup.exe
File created	C:\Program Files (x86)\The BPR\Hardcodet.NotifyIcon.Wpf.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\msedgewebview2.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\oneds.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_sr-Cyrl-RS.dll	MSI1125.tmp
File created	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\qu.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Trust Protection Lists\Sigma\Other	setup.exe
File created	C:\Program Files (x86)\The BPR\The BPR.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_kn.dll	MSI1125.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\VisualElements\Logo.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Trust Protection Lists\Sigma\Staging	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\as.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\az.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_th.dll	MSI1125.tmp
File created	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\cy.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\hi.pak	setup.exe
File created	C:\Program Files (x86)\The BPR\FlaUI.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\vk_swiftshader_icd.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\Locales\gd.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\Locales\gl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\Locales\lv.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\psuser_arm64.dll	MSI1125.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_es.dll	MSI1125.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\VisualElements\SmallLogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Locales\sv.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\Trust Protection Lists\Mu\Cryptomining	setup.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{565AA690-D9DF-43E2-B9D9-C42F6E4D3740}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e57f3c8.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI213E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7EE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFCE0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF52D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{565AA690-D9DF-43E2-B9D9-C42F6E4D3740}	msiexec.exe
File opened for modification	C:\Windows\Installer\{565AA690-D9DF-43E2-B9D9-C42F6E4D3740}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1125.tmp	msiexec.exe
File created	C:\Windows\Installer\e57f3c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57f3c6.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3992	1816	WerFault.exe	116

Kills process with taskkill 1 IoCs

evasion

pid	Process
2812	taskkill.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	TheBPRService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BA3C8F8-C960-456B-90E5-9D6468CD1B6C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\096AA565FD9D2E349B9D4CF2E6D47304\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\ = "Update3COMClass"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CoreClass"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{85503227-BB57-4913-BD2D-B3D43F5C03B6}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{85503227-BB57-4913-BD2D-B3D43F5C03B6}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\87654321432143212143111111111111	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85503227-BB57-4913-BD2D-B3D43F5C03B6}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{85503227-BB57-4913-BD2D-B3D43F5C03B6}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\CLSID\ = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{85503227-BB57-4913-BD2D-B3D43F5C03B6}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\MicrosoftEdgeUpdateBroker.exe\""	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\CLSID\ = "{08D832B9-D2FD-481F-98CF-904D00DF63CC}"	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4508	MsiExec.exe
4508	MsiExec.exe
4508	MsiExec.exe
4508	MsiExec.exe
1664	msiexec.exe
1664	msiexec.exe
1452	MicrosoftEdgeUpdate.exe
1452	MicrosoftEdgeUpdate.exe
1452	MicrosoftEdgeUpdate.exe
1452	MicrosoftEdgeUpdate.exe
1452	MicrosoftEdgeUpdate.exe
1452	MicrosoftEdgeUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3832	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	748	msiexec.exe
Token: SeIncreaseQuotaPrivilege	748	msiexec.exe
Token: SeSecurityPrivilege	1664	msiexec.exe
Token: SeCreateTokenPrivilege	748	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	748	msiexec.exe
Token: SeLockMemoryPrivilege	748	msiexec.exe
Token: SeIncreaseQuotaPrivilege	748	msiexec.exe
Token: SeMachineAccountPrivilege	748	msiexec.exe
Token: SeTcbPrivilege	748	msiexec.exe
Token: SeSecurityPrivilege	748	msiexec.exe
Token: SeTakeOwnershipPrivilege	748	msiexec.exe
Token: SeLoadDriverPrivilege	748	msiexec.exe
Token: SeSystemProfilePrivilege	748	msiexec.exe
Token: SeSystemtimePrivilege	748	msiexec.exe
Token: SeProfSingleProcessPrivilege	748	msiexec.exe
Token: SeIncBasePriorityPrivilege	748	msiexec.exe
Token: SeCreatePagefilePrivilege	748	msiexec.exe
Token: SeCreatePermanentPrivilege	748	msiexec.exe
Token: SeBackupPrivilege	748	msiexec.exe
Token: SeRestorePrivilege	748	msiexec.exe
Token: SeShutdownPrivilege	748	msiexec.exe
Token: SeDebugPrivilege	748	msiexec.exe
Token: SeAuditPrivilege	748	msiexec.exe
Token: SeSystemEnvironmentPrivilege	748	msiexec.exe
Token: SeChangeNotifyPrivilege	748	msiexec.exe
Token: SeRemoteShutdownPrivilege	748	msiexec.exe
Token: SeUndockPrivilege	748	msiexec.exe
Token: SeSyncAgentPrivilege	748	msiexec.exe
Token: SeEnableDelegationPrivilege	748	msiexec.exe
Token: SeManageVolumePrivilege	748	msiexec.exe
Token: SeImpersonatePrivilege	748	msiexec.exe
Token: SeCreateGlobalPrivilege	748	msiexec.exe
Token: SeBackupPrivilege	220	vssvc.exe
Token: SeRestorePrivilege	220	vssvc.exe
Token: SeAuditPrivilege	220	vssvc.exe
Token: SeBackupPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeDebugPrivilege	2812	taskkill.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeDebugPrivilege	1352	TheBPRService.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe
Token: SeTakeOwnershipPrivilege	1664	msiexec.exe
Token: SeRestorePrivilege	1664	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
748	msiexec.exe
748	msiexec.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3832	msedgewebview2.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe
3856	The BPR.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 4656	1664	msiexec.exe	94
PID 1664 wrote to memory of 4656	1664	msiexec.exe	94
PID 1664 wrote to memory of 4508	1664	msiexec.exe	97
PID 1664 wrote to memory of 4508	1664	msiexec.exe	97
PID 1664 wrote to memory of 4508	1664	msiexec.exe	97
PID 4508 wrote to memory of 2812	4508	MsiExec.exe	98
PID 4508 wrote to memory of 2812	4508	MsiExec.exe	98
PID 4508 wrote to memory of 2812	4508	MsiExec.exe	98
PID 1664 wrote to memory of 4632	1664	msiexec.exe	102
PID 1664 wrote to memory of 4632	1664	msiexec.exe	102
PID 1664 wrote to memory of 4632	1664	msiexec.exe	102
PID 4632 wrote to memory of 1452	4632	MSI1125.tmp	103
PID 4632 wrote to memory of 1452	4632	MSI1125.tmp	103
PID 4632 wrote to memory of 1452	4632	MSI1125.tmp	103
PID 1452 wrote to memory of 5088	1452	MicrosoftEdgeUpdate.exe	104
PID 1452 wrote to memory of 5088	1452	MicrosoftEdgeUpdate.exe	104
PID 1452 wrote to memory of 5088	1452	MicrosoftEdgeUpdate.exe	104
PID 1452 wrote to memory of 3856	1452	MicrosoftEdgeUpdate.exe	105
PID 1452 wrote to memory of 3856	1452	MicrosoftEdgeUpdate.exe	105
PID 1452 wrote to memory of 3856	1452	MicrosoftEdgeUpdate.exe	105
PID 3856 wrote to memory of 3060	3856	MicrosoftEdgeUpdate.exe	106
PID 3856 wrote to memory of 3060	3856	MicrosoftEdgeUpdate.exe	106
PID 3856 wrote to memory of 4016	3856	MicrosoftEdgeUpdate.exe	107
PID 3856 wrote to memory of 4016	3856	MicrosoftEdgeUpdate.exe	107
PID 3856 wrote to memory of 4376	3856	MicrosoftEdgeUpdate.exe	108
PID 3856 wrote to memory of 4376	3856	MicrosoftEdgeUpdate.exe	108
PID 1452 wrote to memory of 2324	1452	MicrosoftEdgeUpdate.exe	109
PID 1452 wrote to memory of 2324	1452	MicrosoftEdgeUpdate.exe	109
PID 1452 wrote to memory of 2324	1452	MicrosoftEdgeUpdate.exe	109
PID 1452 wrote to memory of 1604	1452	MicrosoftEdgeUpdate.exe	110
PID 1452 wrote to memory of 1604	1452	MicrosoftEdgeUpdate.exe	110
PID 1452 wrote to memory of 1604	1452	MicrosoftEdgeUpdate.exe	110
PID 4812 wrote to memory of 3944	4812	MicrosoftEdgeUpdate.exe	112
PID 4812 wrote to memory of 3944	4812	MicrosoftEdgeUpdate.exe	112
PID 4812 wrote to memory of 3944	4812	MicrosoftEdgeUpdate.exe	112
PID 4812 wrote to memory of 1340	4812	MicrosoftEdgeUpdate.exe	115
PID 4812 wrote to memory of 1340	4812	MicrosoftEdgeUpdate.exe	115
PID 1340 wrote to memory of 4488	1340	MicrosoftEdge_X64_116.0.1938.62.exe	117
PID 1340 wrote to memory of 4488	1340	MicrosoftEdge_X64_116.0.1938.62.exe	117
PID 4812 wrote to memory of 2496	4812	MicrosoftEdgeUpdate.exe	121
PID 4812 wrote to memory of 2496	4812	MicrosoftEdgeUpdate.exe	121
PID 4812 wrote to memory of 2496	4812	MicrosoftEdgeUpdate.exe	121
PID 1664 wrote to memory of 3856	1664	msiexec.exe	122
PID 1664 wrote to memory of 3856	1664	msiexec.exe	122
PID 1664 wrote to memory of 3856	1664	msiexec.exe	122
PID 3856 wrote to memory of 3832	3856	The BPR.exe	124
PID 3856 wrote to memory of 3832	3856	The BPR.exe	124
PID 3832 wrote to memory of 4960	3832	msedgewebview2.exe	125
PID 3832 wrote to memory of 4960	3832	msedgewebview2.exe	125
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126
PID 3832 wrote to memory of 2696	3832	msedgewebview2.exe	126

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\The+BPR.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:748

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4656
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5A45579D4F38C9B3D8DEDFBCB55C1145
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\\System32\taskkill.exe" /F /IM "The BPR.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- C:\Windows\Installer\MSI1125.tmp
  "C:\Windows\Installer\MSI1125.tmp" /silent /install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:5088
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3856
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.29\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:3060
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.29\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4016
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.29\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4376
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzUuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDFFNkIyNzItNURBNS00QkE0LTgzMDUtMDQxM0RDMkRFMjIwfSIgdXNlcmlkPSJ7MUY0NTlERTMtRTdFRC00NEVCLUE1NEYtNEI4MEVGMENEQ0UzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5RDZEOTFERi1FNzQzLTQwMkYtQUIyMS05QTg2MTMxQkVGNDd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTc1LjI5IiBuZXh0dmVyc2lvbj0iMS4zLjE3NS4yOSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTEzNDI2ODY0MCIgaW5zdGFsbF90aW1lX21zPSIyMDQ3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2324
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{01E6B272-5DA5-4BA4-8305-0413DC2DE220}" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1604
- C:\Program Files (x86)\The BPR\The BPR.exe
  "C:\Program Files (x86)\The BPR\The BPR.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="The BPR.exe" --webview-exe-version=4.0.19.190 --user-data-dir="C:\Users\Admin\AppData\Roaming\The BPR\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3856.3104.14200902924824839405
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3832
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\The BPR\EBWebView" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=116.0.5845.111 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=116.0.1938.62 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffae14f7240,0x7ffae14f7250,0x7ffae14f7260
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4960
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\The BPR\EBWebView" --webview-exe-name="The BPR.exe" --webview-exe-version=4.0.19.190 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1852 --field-trial-handle=1856,i,17266449441825248184,5436971263659749220,262144 --enable-features=MojoIpcz --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2696
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\The BPR\EBWebView" --webview-exe-name="The BPR.exe" --webview-exe-version=4.0.19.190 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2424 --field-trial-handle=1856,i,17266449441825248184,5436971263659749220,262144 --enable-features=MojoIpcz --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2744
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\The BPR\EBWebView" --webview-exe-name="The BPR.exe" --webview-exe-version=4.0.19.190 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=1888 --field-trial-handle=1856,i,17266449441825248184,5436971263659749220,262144 --enable-features=MojoIpcz --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4048
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.62\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\The BPR\EBWebView" --webview-exe-name="The BPR.exe" --webview-exe-version=4.0.19.190 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3336 --field-trial-handle=1856,i,17266449441825248184,5436971263659749220,262144 --enable-features=MojoIpcz --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1784

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:220

C:\Program Files (x86)\The BPR\TheBPRService.exe
"C:\Program Files (x86)\The BPR\TheBPRService.exe" /start TheBPRService
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzUuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDFFNkIyNzItNURBNS00QkE0LTgzMDUtMDQxM0RDMkRFMjIwfSIgdXNlcmlkPSJ7MUY0NTlERTMtRTdFRC00NEVCLUE1NEYtNEI4MEVGMENEQ0UzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyN0ExRjYxMS1BOEQ4LTQyRjEtQkU4Mi1BMDQxRTFFRTBCQTF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbmV4dHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE0NzM5MzIyOSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3944
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D5D77451-69E8-43DA-AC75-5FB65FE7B264}\MicrosoftEdge_X64_116.0.1938.62.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D5D77451-69E8-43DA-AC75-5FB65FE7B264}\MicrosoftEdge_X64_116.0.1938.62.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D5D77451-69E8-43DA-AC75-5FB65FE7B264}\EDGEMITMP_2F152.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D5D77451-69E8-43DA-AC75-5FB65FE7B264}\EDGEMITMP_2F152.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D5D77451-69E8-43DA-AC75-5FB65FE7B264}\MicrosoftEdge_X64_116.0.1938.62.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4488
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzUuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDFFNkIyNzItNURBNS00QkE0LTgzMDUtMDQxM0RDMkRFMjIwfSIgdXNlcmlkPSJ7MUY0NTlERTMtRTdFRC00NEVCLUE1NEYtNEI4MEVGMENEQ0UzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntENTAwNTIzMi1EQkNFLTQ3ODgtOUY3Qi0zNDBDOEJFM0FGOUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMTYuMC4xOTM4LjYyIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTU5MTExOTA5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE1OTU4MDcyOSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzMzU1MTgyNDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzg5NjJkODZhLWYzMjctNGUzMC05NDc0LWNkYzE3NDg3YzYwNz9QMT0xNjkzOTIxMzAxJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWFtUzF3eUh6RHV4Z0NaWkhmYnJxSWYlMmI3U3hPUUZpZzN5cUt3M3JUc1ZFQTZ4SU1BTzJRU1dxSFVKU2E3T3FORklkYUhOMEpIJTJmd1Y1VmpHcTBMQ3YlMmJRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTUyNjk2Mzc2IiB0b3RhbD0iMTUyNjk2Mzc2IiBkb3dubG9hZF90aW1lX21zPSI5NzY1Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTMzNTgzMDM4NCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzNTMzMzA5ODUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3NzMyMTE0MDEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzNzUiIGRvd25sb2FkX3RpbWVfbXM9IjE3NTk1IiBkb3dubG9hZGVkPSIxNTI2OTYzNzYiIHRvdGFsPSIxNTI2OTYzNzYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQxOTg4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:2496

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 1816 -ip 1816
1⤵
PID:4668

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1816 -s 2292
1⤵
- Program crash
PID:3992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.62\Installer\setup.exe

Filesize
3.5MB

MD5
5f19d7f0488c00a18480a828f4f0d8b4

SHA1
d8970a332d12f2bb51776cdd9e14993f62805449

SHA256
89dc96f1582a50779a6331f29ae4e1a43d48766c98cc772391a8d04a603e5420

SHA512
68cef1eb92dd1ddeff0af781528ed0dcd5ac6aa934f185db2fb7d64f50a4935976794abb3e0605233fc2293b7f0172069afb9231a59248571e0f909a98d97197

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\116.0.1938.62\MicrosoftEdge_X64_116.0.1938.62.exe

Filesize
145.6MB

MD5
854ce0a353cc8f3478b8ec15dcc6c06d

SHA1
5aa4115c8dbbcdf592f7170164b47604506c8862

SHA256
769ad0c37c4fa4940be3656df38fdd059e8bec5eb7c57d2f45cad8a360605a17

SHA512
0f1dabca2e0b933df7fca47970bfe8ba2c164bc2351c3d20e41b7f2836d52765fa05a1a865d2cf3a11a750d17f7e48cff0af52dc3f30c1573a586bad76e3410e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
cfad69d55cbb9ceeffaccdd176e19f7a

SHA1
076f72b145f761d23d533ed981ae059fa61339d2

SHA256
a238fc18a787d5f21a4942690029e0240597c7fc0d7dbb401063486387b7bf7c

SHA512
6a125ee8d46c444bfbd92967d46c7c127da7904fa9f9505528cd479ea169ce4c9026400e5b59e136fc0a2c8e2de64a53eb4e7cc8ddbdb5f541df47ed401f04a5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
daada62a6b54ec575220c7745bedf20f

SHA1
69089725280a1f9fd9dd15c3cdfde57f1231dd49

SHA256
31b6cccd8b69ecdf4f171cf9fa3fed12526b4de483ef9481e843264a9c173a61

SHA512
7e166145502f46948bccf95921477867df57a9dc5fe3f8e6f5e85f3907bf0d9fa8c59c97447f67dcc71e4e218602482ec4c1138cc9da84d3bd7ca87cbe07348e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
cfad69d55cbb9ceeffaccdd176e19f7a

SHA1
076f72b145f761d23d533ed981ae059fa61339d2

SHA256
a238fc18a787d5f21a4942690029e0240597c7fc0d7dbb401063486387b7bf7c

SHA512
6a125ee8d46c444bfbd92967d46c7c127da7904fa9f9505528cd479ea169ce4c9026400e5b59e136fc0a2c8e2de64a53eb4e7cc8ddbdb5f541df47ed401f04a5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
cfad69d55cbb9ceeffaccdd176e19f7a

SHA1
076f72b145f761d23d533ed981ae059fa61339d2

SHA256
a238fc18a787d5f21a4942690029e0240597c7fc0d7dbb401063486387b7bf7c

SHA512
6a125ee8d46c444bfbd92967d46c7c127da7904fa9f9505528cd479ea169ce4c9026400e5b59e136fc0a2c8e2de64a53eb4e7cc8ddbdb5f541df47ed401f04a5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
79d33cc2d0e0991846307af5135f19de

SHA1
7f7c48ad1da5e71ffa3e6e6b2611a84a51a16f3d

SHA256
5ad9879adffd90fcd5130599eb990248df4561e7fd913521c182c49daa2666a6

SHA512
eb1ca3dc0711f52d98ba2818e33b946c02f86a7f30fc26240ebc8f0720a915374b9704d0222fcb42d010b45a9a6655dcc13fe51f984bce7e9793fe46d6e70d87

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
091020f03d39b049fbcbf76857e7f503

SHA1
b61a5756d1a06a60f0d1b6e9f97716b19d32a484

SHA256
170ddf64b90b4fb3bc569113f746ea46d474f7fa55d85a47f14e07ce95ac1e85

SHA512
1f6e5b89ddd10a135af7cca2e035ead8619f795689d0e5bf1a587eadd89389ad1086be5d821ce8b9b5e8a5e2ed908945f4425b0c86adbd3945f874c32d655109

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
fe453156c03a6f223c2b9fd4436eab4f

SHA1
a9812efd18fc8b4b4ef93429c9555d4c0e27e939

SHA256
960034ebf4e93f488adc52f93a0b186b9eb88619418ccf66bafd4872770e5c56

SHA512
2a25c7b194aa3e05860b9346e50a39be914d230c668d8411f6a2a3607a28f0d86ccc9db118c64b70d4d78322b0a39e5d190b6fa22d9d32afb0247e750d572e4c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
fe453156c03a6f223c2b9fd4436eab4f

SHA1
a9812efd18fc8b4b4ef93429c9555d4c0e27e939

SHA256
960034ebf4e93f488adc52f93a0b186b9eb88619418ccf66bafd4872770e5c56

SHA512
2a25c7b194aa3e05860b9346e50a39be914d230c668d8411f6a2a3607a28f0d86ccc9db118c64b70d4d78322b0a39e5d190b6fa22d9d32afb0247e750d572e4c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
4cec13e07d17b661ecbbfa4f56601e12

SHA1
aa9ae58250b7753847c6460dc05f5daf3bd858c3

SHA256
5a8ed430cdb16d6f32ec0e0ab344dae7c012994c348cdce8b881dc4173851d41

SHA512
35564e36f4ae7fe6d00a6c2620a4e9210dedef24bbc4ab305cac58e6672f252ed09d26f9a22b0a47e3e3b3834ff04694cee5b31f821c958f1694987ec516df93

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
bbbecdd9ca70522678c71267483a893b

SHA1
7031f53a5caf739c6cc8818459146c0c1ff050d6

SHA256
e5a983528a86aeaa2a4eda7e82db4fe1694a48bebc99a928dafddcbccc45061c

SHA512
c4af1ff64d9de5322f10406aefe66717b006c1b671fe60b8ef58007357eff05ee7f04fb4e7e57559060b7c75df491cf144da22a0906590459b782d6b3eeeed95

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
f753412c30232cc91ffefd45956dc12d

SHA1
34aadf2c9bc6aea3c3b3ab2b891fd7c91e29d2f1

SHA256
912a3ca7a4b611034525f9ab5111b745df05dbd8f2e15d4d9de5c1e5d52b1520

SHA512
e38e0e8dff76f49aa5cdbdbd77a21325e7448c8e84cccab31373740a7d70f75d741e3ff5d79bcaa7fbb7dfcb01f92814515d2c56689afb0590863fdbdf3ca5e9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
a55c212c8283dbdc776af18a939c70db

SHA1
8a9a3f417cd6b819681201a8a450a3d8679fafa9

SHA256
840d51edcd5c2cb4bff412a909494c9e8c73e99fedf4651f4f3231111abaa7d0

SHA512
7d3474c577bfc27f69aabe5a3512adc8b0e742797f8d39adf344ca9ee2b778357b0af2bbcd6199e79df71e0d1fd35d69ff4a55b54abd3921bdfe84933d7fdd79

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
464557ed8bfbe347a3d549c975f4550a

SHA1
3e3332f4418c498abef3ffd073a5ca3503bea713

SHA256
4be8f54c52103a8a7d3d6b746d9f1f9beda673987a15f8646d9dd29c39830555

SHA512
8846662a38224687d4bbbbf8fcdc4da0fb273316b16c88367f77ade887070ab6b5df0abe67898b4b62095ff11c2460927420f6c0cc83daa87546277664be3a48

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
7b87a195692db37f5e003a34f906b206

SHA1
a0906f62b8e758a9438cfbdaa2091ed709fb4876

SHA256
610a4b79e0c1712d529de7d51f572fc7bd36a2fb0a9376eb78ed787dac9d6ee1

SHA512
938856db033c5e545347e13cab66d4a19879fa1906db04aa66efa1b28d03794d7711397b5bd6379c992498bb904d9016659e0d33ab79fce2c72e4786ac60c682

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
11deafe353b91ffa4b97b11cedc4cf2f

SHA1
8d01ba078cef88d55b0d0b0a3047835260f9eac9

SHA256
41e015d17b6620865d4cf08ce3859b9c48213c6f6b3082547935914646798d69

SHA512
cad9c3a8507b337d6ba8eaad576cb7caf6e0f8bfaa8982828c5ea5e09ceec3c0e2688f16befa7fa6cdd904bf46efc4a9b9f3539a2c799c1984b8b3238a62d550

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
6bf441c7934aed93562a51a259e8797a

SHA1
91231b594e1c4d71a211080cc65dcefe22023d54

SHA256
f6409fb67b919343e3ced35f37a679c6eb68a1fb297c8fd3ce2ccc5f1c4622ab

SHA512
66f79e6b71854d86e21084b67b7fcfb4dd7230b25fb1c7c91ddc79682497902effa949ce97a2ae6622fb131c54a98a13453081e4fd773144367f4e9d55e444ef

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
835edda869b96197a194e2ff9dfe3385

SHA1
387b7e94bfc1299baa6801923a6f422af594b9d0

SHA256
90b2285a219a248327977ebcc9083a829346dd4e03e6e3726910db1f12dea43a

SHA512
e32db2609782214c96947014cc48edb9b2ecd9ac6857166fcef044aba47cce84696e67c3c40f5995bc6d558b50a93daaed1eeb22d833eea8355ebb9d36fa26d5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
47cc63b041960ee31f116a0bf9231c3e

SHA1
b759e38f93ba670032604cd86d53fbd2419cfe57

SHA256
2b4182f2867eb27a7e5b04b934b76cfb3f54fe4f47e5774494000874fb19f180

SHA512
2be494a7a17b04770a1d7cf36d0b0c41ae4182494346d8361490a62b32b636bf0d19837f299cbc9c0b4b3d8a3ef9e6532ca1046d5d8465f4019856002a78d394

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
1ee784ccec7de0ebbaa62e60a617b06b

SHA1
1f2922e1f55126f57b53b5de529af5fc92f00362

SHA256
586ce366238d5f409f620fc0063c53dd7bf6777d7b21b24098de10bf4eeff536

SHA512
f030ff2ffe62a354f9a410bf99ba759092709b255a1474bc966317bd9150a32dd219c90271feb61f6540c29adb79d38202360fe2574e9f48ab097a786a55437a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
26bc8bd32fcd206e63fc1acca181fba1

SHA1
1f5d2d16cd1ec69816b0d0b5d48710fa18a23ee9

SHA256
fd4dee69e4a84e169c2170f257073da681986848e3697e83debc3ce50197d40c

SHA512
4305fb6fd980686d3b43b6eb3298747acb76e188cbc17642b780315f1c27db82c0e29c64ddfe7bd24faaf2b1785f8eac238295ee593b373124ed4157361fd9ee

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
b0b7b8833fb0caa927d8ed943fced24b

SHA1
a662f2f5832e069a4e7b4397823f713de62355a1

SHA256
a5dcc81269a36af2acfcff696a2c33defdf8b408b075b7a945c99fd709a9ac06

SHA512
a33619bdac69e9c4160fd8e8d8fd723582ef0ef223ec22244c98e38213437d33b47f12e760b8fe210e88e059a84465a3b4028bec4ea5f6aea111f78111b19089

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
bee2a241825641230fa53b6c93eb4dbd

SHA1
470ac27b056773be2fc3977921b4205d73c72060

SHA256
c8259c4f89169eb2985cbe9d08237d5ee21d141668316aa856e8bd3e45796b26

SHA512
28dd43e6b3498c9d9d8c828d3e30ce201c23fa4c658a44289cefdca4832166e94302e2bc7a312fa14a982bb7c456d525ecefc5cc66f92d77300b371c49e49589

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
cf67092063b8f6f4b58b34350c5de8f4

SHA1
1066488c4d6bc9d8f0419ca22a0a8eedf991d2ce

SHA256
b74d1512d68d5eb0c003f95a67a45a5b00541d632b87f906ffe420c352dd20fd

SHA512
9688f5fff4761615c92f783ca9a747fe9c14a654e75211d15a95a0bdb69fd0d91cb2b94ffad428245ced3886fa9e0097770d261cf7b3eb887879e6ea8bd15ee9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
ad530063b28b10b31723c25d49dd3825

SHA1
f048fcfd567d788b27d09f537c29cbc5cfffb272

SHA256
7891e81f7bcf9fd8bd3ac3bde9a5712c4ec239719bdfd52ae270503516a45b3d

SHA512
2e83acf683f43329c2ebdcd42764ebc3c48a57363eb2cd33d13c6a2bd001c04925d53c8f676f850ad8fd282003d546f7ae073672abf5e94305cfd38d87afaf6e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
874f1d117415c1860b25c0af6ce47b53

SHA1
1b9b10a29f3fb683d80546edc7e090e6ecc59a3d

SHA256
69cacfe109095eb35695db5dd3af7bf2eae62076ac63c8dca25da70c05a45960

SHA512
8fa4ddbce6ee284ef6718b54253b85e06cebedfb9fc7b5aee0c1a5510fb69b2f765ca685ff38e9e8b54c71f4c500a704fe058487d1957d9beefca9e225b12d4c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
3b6cc9d8797beedf5bf7881358cb8049

SHA1
4a7204e2cb8d20317443b003df32da026aa20244

SHA256
ab7ee167a94a025ea67bed31d1014721b8dd83204ad677fbe83dc9d66ef6df7d

SHA512
4f4e1526f2d502237c341c1b5a307f12fd779dfab69939ee6620cb4ffe6acd221c9bf022793495deb6ac42a7669f4fe9e2f5880a468c7e861ef283c15603b2bb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
5dff1114890ca82cd45f67fecb39589a

SHA1
b94cf4c680a6adb4b212d0463bf0442d5cbd0d07

SHA256
4881145d05f5496a6d60591eb90aa55404b8d89810b9e589a4a40d85a9b64024

SHA512
e90a6d0bf5ae380149e2d8b2a000107d234eefa2c91d5059430f74c6b98169c06acfc4985a27dbca54c3671d4c104585c8d0dd8b838f8415b3d5f1c70ad7edb7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_es.dll

Filesize
28KB

MD5
bf88dd3967c92ccad357715dae767e64

SHA1
dcf8e5bdc481a7f49154fc4aa61fda2886b9397d

SHA256
ca74086f0fcca80f54b0596727b6251baa0127f0ccf1be2465aa067ac65ee8eb

SHA512
6337a57a7458531eedbabfbe6ca1001c33d13943e22dd7f40f986cc8a8f75331c47c85ad8e4b76f12b2e42e7c7d045f79e08af420ee5e80a811e6912caf6e3c2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
763e6253cdb870d31b09941b970e9fd8

SHA1
1794f2174b2304b974b78e22c0f838e408206375

SHA256
fce0380b8de9b8da9a23872d51375e870fdeb0a0c936aa7f5b928ec29cb24b89

SHA512
220c19813bc1ca189189537fd1af952a9c51b7c5c9f84968b6f37e0d929e6912df3b53676dd9d76d115087ca9bc82807f58125d99f8a484a1006917cc60026f8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
9bc2401b0117a9eb52e6e0352b70710f

SHA1
e9464af5bf221d08681e53977c5914a1564baf60

SHA256
81813064b8591a7b31e0abde388674241940f972d0b6f9b4ef778dbf9015924e

SHA512
13b9e335e4325ef06638073b09c84370a99dc54724dfc0bfbe9d51da45d0631dcc587753a83b6f5bd64c832db8e6841061a46e242caf790b10313c6931a0cee7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
9a627a92e325d46f311ce1a6a3a89b14

SHA1
c8c840228c7165e29769416671fc4ea53c2bc92e

SHA256
ab79ee9500a7ad67f7f975b3b35e6934f7a2ff4df3436ef6fcebbcd2f1ac094f

SHA512
4d9787f1710293cf3df4f82831bde6d64947098c3eb8e00d108fc431881cccc56e435fa9e5858e753ba0468169b0b514ef5afc1471af6bd7b72a42da2dc7b462

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
2dded7e065e9d261f967c7f298c42dfb

SHA1
ff5c5241392f89076e5d15105277ce80a0a5fdae

SHA256
ab2363fe35adff72b1e55065ba4207d46e00ce6d777e6047562be984efdbc258

SHA512
9f3ab285084705ff516f1f9970a4556b63b23348217f16955139d61807eb536e32e24eddde33848953723320e60a126bbe2d8b45d666f62f5a9e9dc88ef62dd1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
f65a6c09bb1f54270428f5e6fab5539f

SHA1
93cf85382719b1504bc068716f98c9f43134df9d

SHA256
c7108064951fde4f07bdc224ae5943d3c2d64f0b222b9cc4913cc57470b4abf4

SHA512
59954af15fef82b6eaba5d568ad5e18c3c56bdbee9b50f827178d226daceb1cd4c9721dc8306f1182df481d6c744d5db7e947bba6d8f24bf67f8c454d77002d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
a524885489da2db13df6b88c75c6ff27

SHA1
ae8f5d3246e52988d320c498954239e7b9bfd5d4

SHA256
81f7c40a10e28ddf7100794573d89dde8ba45353f5a4f3944c15e7bf7520ac60

SHA512
1f498c3223e1b4572e726ccfc00f3b52951375fbccbc08a2747f0b64ccf76c624bc42fccbaec8e5547ee07d1a348226b66eb86e36497e943fd53ddc141350491

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
62ef057e21dc30ee3129874451b7870f

SHA1
15f609cb2297479ef06d1c08bf07ded6524f396b

SHA256
e55ea3fb222a247a6aacd5c721968993507d133f3b07b6e3913be26da7e4b3ff

SHA512
d6b37d9b4d0bf4a7030ccb2e3a4dcc8407cf35b68948cb0177e7d53fe6277066d423fcc8b33ec2127faeba9261106896e7b83bd31be6498453d1cbf8072c8e46

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_ga.dll

Filesize
28KB

MD5
ab13f041e3ad6e67f087c131236da3af

SHA1
697ddd32053fe3687c1a502ff83a923a1fec1cc5

SHA256
14d7d6b480e411c79805b89a23a2166e80e025c9a4678f6bd41f359b7532180b

SHA512
86b189c6bf34b0005d1c2cfd14fd7b2ab1f63d076ea69439d80ea6e414a96903567f891eb0d5ad6e68da2321d5e3fd365bf3436bcc0e28b986cd7fae49f1e460

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
4fa69715e2d57263970995e0c6543197

SHA1
f53159a7d06dc54e2d1675f629baced6c7390ae6

SHA256
484de3c4087dab573489bcba4099e1a1f2726cb4c8f41b288b68ef565e8ca63f

SHA512
926576266dd12d7c58eed8eeac4e71ff476fb6e86686edcd70dca5ca3254777bb49428c8f500f7499d376fd19d43452ea8618eefef9ab81e40b348a393c3f91b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_gl.dll

Filesize
28KB

MD5
de038208d4149e32b172369e4bb580dc

SHA1
55bb0c1587a2bbf107d2f4dfdb0fac429f37ae20

SHA256
7dce24a446f72ffeaf6eefb2fadf2fe63365ae371b6082ab5b3454fc5ccf4779

SHA512
c2da7e01c0e49b8f02cbc2e676b3feb5ae9d77c3b76b64f55745437748de70753a221eccea1a7b20b6ca558eb0ce66a5b50dabdf141ed3be5a594bf0776d2b62

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_gu.dll

Filesize
28KB

MD5
dd1c9192f145ace15099df2969bb8988

SHA1
edc9b590f0f986ee38b27c84f04de35da93f8087

SHA256
d217225ed6cb25dc8098b566b54215f9a4e7b9edb78df86cf71007a09b4d441a

SHA512
2ff119e4a839161664858a4a9f4ccef6d0af61ed1dd0a490c93edd97a7287ddc8903bf1f46e49ce784973e1688f0ccfeb200434344d7f4ca2075c97d22ac7ee4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_hi.dll

Filesize
28KB

MD5
8823cb3d65aaf14041c7f8a426396773

SHA1
f59e02593754519c29e7b5167005eb6e5d93fc3f

SHA256
18425c0fed1f0d32583ca64d8b109afbaa19aeeb6a8842b5fc517c88332a02fc

SHA512
a2f1a3522bebd5dbba19c82d760037f97005735741117e2cfefae0f9fd3cb58d7b4283e3ff6545995fa2e053fa688614d2c74ad55d36c3d23f8cd6f139a4c893

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
507a6e0d782172fe1991d1b7da3ea3f2

SHA1
1e7ac383050a1d0d1bb668ef46acc5c6e28e3220

SHA256
1e7a1efecc5fe2df48f60d3979ae18147d0ddc676c9465e7c476228aa6a3bb0f

SHA512
20c5e3e8c778a96bf5652e53423e1d54cf8a711f3b97e3ea78b759006553e5d48a6032e37af413519829be215ffa25b2bd26f010b7d48b73eafe9767bf38b2a9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
82d0d63685ba3b51e87935838da4eefa

SHA1
80e5ed937ac1a43d54f90e9514641a02e9c0a6cc

SHA256
4f70b8f6ac2836a9aa4373b7183cab5334d29d4548ee4ddf84d971bf92b843cd

SHA512
c2895e640055a163ef05956b1fca172156be6b93a1a4393c37ce7fc315eef868d8f131cf61207eb6ab7e34a8e58429057ad33c59c850691cb173b98e59183f79

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU121C.tmp\msedgeupdateres_id.dll

Filesize
27KB

MD5
8cbacd52afc1b5a5d4a1f4047d32cdd4

SHA1
e307b985daddcfa1dcac7c0e5b40dfc5527056e8

SHA256
b45a03c25d95b3f7aee31e66e2fc402c59578004afdf282fbc4124f1e131311b

SHA512
740d279a325fb0e79da4577b2ca23e05549c66e9643c14abc3169da4bebf753cd2bb7ddad5a1ea181a49053d77e74c0b107c9d514fef1c387d489c2a3d0fe6c6

Download Submit
C:\Program Files (x86)\The BPR\Newtonsoft.Json.dll

Filesize
686KB

MD5
b9e0bab5c344b88ab1ff8d5427801ed6

SHA1
3b3b1eb060990305fac74670787e676816faead5

SHA256
827c417c12c5b28d28284fc919f0d1e271dadaf45022f5640234fa66cd12414e

SHA512
b7de36e3ae63e7d50fa6119986224682703092f03c2519d4642245463300d6c933631d5a1873f8b2d2bab1b319d9c2b4feaf74e598865a47a9d1f6aa28290197

Download Submit
C:\Program Files (x86)\The BPR\Newtonsoft.Json.dll

Filesize
686KB

MD5
b9e0bab5c344b88ab1ff8d5427801ed6

SHA1
3b3b1eb060990305fac74670787e676816faead5

SHA256
827c417c12c5b28d28284fc919f0d1e271dadaf45022f5640234fa66cd12414e

SHA512
b7de36e3ae63e7d50fa6119986224682703092f03c2519d4642245463300d6c933631d5a1873f8b2d2bab1b319d9c2b4feaf74e598865a47a9d1f6aa28290197

Download Submit
C:\Program Files (x86)\The BPR\Newtonsoft.Json.dll

Filesize
686KB

MD5
b9e0bab5c344b88ab1ff8d5427801ed6

SHA1
3b3b1eb060990305fac74670787e676816faead5

SHA256
827c417c12c5b28d28284fc919f0d1e271dadaf45022f5640234fa66cd12414e

SHA512
b7de36e3ae63e7d50fa6119986224682703092f03c2519d4642245463300d6c933631d5a1873f8b2d2bab1b319d9c2b4feaf74e598865a47a9d1f6aa28290197

Download Submit
C:\Program Files (x86)\The BPR\The BPR.exe

Filesize
4.2MB

MD5
9d8f151e53cd19d6d76a4f1a45bd2ccd

SHA1
7e26ce0c30e0a5e654cca80743a0aebc6e94a7e5

SHA256
2900d0e7204a38ebb65eedb7357db8aefd0527787738a87f12ad84d9f0534137

SHA512
f1b26756f72e1339ef7a3df0b0e13205851c93794f7321668ba64588ab70c7f57d0f91889e42acbf7d5e51a90df13dd78c24d775f6b5d0eb9601f48e390b1999

Download Submit
C:\Program Files (x86)\The BPR\TheBPRService.exe

Filesize
27KB

MD5
dce55d3591d309ea42ca94b30532ffa3

SHA1
ba64968e0e8cc91fa298fe8108bf61168e35fb2a

SHA256
1c4594ca41dceb90e1435eddd6254af49c228998c3d27b5c3670247d24ba5d2e

SHA512
38c9f27891e32d5288d7faa3debf3bcc8950239478f663ba57daf8e0eeaec4c1d7633cc235c66f77a8590f8e15cc3cd128bdffc2b0eb98d5cb2b73463725aa6b

Download Submit
C:\Program Files (x86)\The BPR\TheBPRService.exe

Filesize
27KB

MD5
dce55d3591d309ea42ca94b30532ffa3

SHA1
ba64968e0e8cc91fa298fe8108bf61168e35fb2a

SHA256
1c4594ca41dceb90e1435eddd6254af49c228998c3d27b5c3670247d24ba5d2e

SHA512
38c9f27891e32d5288d7faa3debf3bcc8950239478f663ba57daf8e0eeaec4c1d7633cc235c66f77a8590f8e15cc3cd128bdffc2b0eb98d5cb2b73463725aa6b

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
121KB

MD5
5dab0d4bee93bb68de285fa9c6e6f7ea

SHA1
4c9367b65aa0214bef52f0b56cd62abf1fe849a2

SHA256
14082b4578ad166393af85869bcc0e9205e7c4ae20196d080d2adc3962a78293

SHA512
011b961c18f24aadf6d7c78012c980495b3015f01377be6c1db32f306befd229457b80232054e7032023a9585125866cd56e43c011fd2680f2419cae01285c38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_79CFD3DF2894C4BFDA2ADFD6675FA18B

Filesize
2KB

MD5
dfce822557f6ff05615242546c381d31

SHA1
be998301034266968b96fb8de8716cbd256f960a

SHA256
7ab8ec96c66434cea57cb05611141eb3f486015c6b31d3e095dbc1984e3cc77c

SHA512
bd81a74ef573b7c21421845a255b8d06fd14e3e16e9d639a4460fd4967b6f1943c371a7fc5b459d46d428d4e1bf2fe9acab7b7c3a8bc97a50ae18d658c0c2dc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D11549FC90445E1CE90F96A21958A17_10CB794FE9A249117F4005C9B6FF585D

Filesize
509B

MD5
bfd022e7a777e8041ce24800c4355122

SHA1
afb12d2061b5ca23dab577741480617f76623330

SHA256
c8d620d97481d0be0ff8a667b50fb6848a88e3e56b280c0edd3143b9eb742888

SHA512
afc286b691695bd4fed28c94de259c923bafa8459f9d8df4cb9307dcef54a8d0ace454cd18bf16a124b152e21c0684bb7ff44227c36cb7b7ca6c76ed347543aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

Filesize
1KB

MD5
cdf8656737b5e64cbfda822f1f3fbbef

SHA1
caae804d81335629ec018a068466dd5a3a17d1fd

SHA256
4e93059c137d94b28f4f79e6f97fc1007efa7067ef008a6ba5e874a46e6e6fde

SHA512
73543470cf87c62f4c10258aa4e3e6936f6109245adf1095e3f3ccf7ed4affadbb1373a63c0d1ec16bce867e2d8f081029ac0c208a1caffaab197b3eedf545e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_79CFD3DF2894C4BFDA2ADFD6675FA18B

Filesize
490B

MD5
917648a95f388f905e87675a10363aba

SHA1
a95c25a5d052089b8ba5ef45ffdd670d93b28aa6

SHA256
7184ae14b4e6923ce994e39cd1ad8f2f3a66f6c484f56be11a095fe6f37f45ae

SHA512
7f672be8ff11b5bd4757f7b0e4691cc8acfb7333f336022f63826e1aa4620681ce5fc2ab36c6deed5a0b78aafc46a20085eca0e14147b1b1c4cc03118093ccd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D11549FC90445E1CE90F96A21958A17_10CB794FE9A249117F4005C9B6FF585D

Filesize
486B

MD5
233865be54e5552bf2ec06bbe900d01c

SHA1
f6e407aaf13ceeb3f4733d67dd5d3ee463a30bef

SHA256
e9f9d320b50e4b100f84274ed3e4cce8e1b72d1b7c53465974e49d208f63177b

SHA512
425ae6e8c5e218a8a9d6b7279175149b73b0aea6feb4657bd78fda8d689cc7ff18f4559aaf1a9d606d2e48f9be5b45867fb97261714789603253bc96f69896de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

Filesize
486B

MD5
8f27b9ada3ce3e92196678d9355ba1e4

SHA1
2c79ad150f970c758288762e2d5b1ae453b4d687

SHA256
dbc106765ca3392a165e1d8e24c1e7851ebce2389d466bd7d5f61fee22458f10

SHA512
1610c95b2a9c88ba128bd96b499f32a855f6a64dae24a1217895de8b8ae687f08aa5bde499dd7b24469d5fc2924acdd8962d279570371f0b1553432b8bb26d46

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
61a0c5c1b282b5b9013a5a7ed1016cb9

SHA1
7dac59f3eea794a69f243587255dd3c6f96caa35

SHA256
af34c55869dc32d2f07b974b99116128eddd1683c8a75d58434ad52205be6a54

SHA512
c96f1528370c755760fac803e22a6b6ee4d3f10f5471c431c09115fa2e2286aabd0b24f2dfaa43abec68b4e4613e8e96b0c7c869a0082a489192da113b4a189c

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
5a1cc5a6b2b467e9630320aedb634929

SHA1
19d89c0667466ad348ddb6ff70bedf931e41a6f6

SHA256
532b49972f7b0eb6586ff05d547e07a5096dd02a4be8e228d0be1f10806db29b

SHA512
ef06b7484160348f50d35b24c7917ec45771b2c2fb2cabcde2a9711cec2af8dc24343d05f1ad7186931545b9035f09f60c0f13ff328340bbb29888b3d429f7a0

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Default\7d828878-4e53-41e8-bd5a-6e7fc665e7bf.tmp

Filesize
5KB

MD5
fad985e351a2ef7339e80d467b0ee30a

SHA1
a1d2fe06ef978c7334ea788d499eacf64eb0e292

SHA256
40d15ffad42abfbf2477a6bdef07fcec807c232533d0cc7432f74b9960581acb

SHA512
15f3a04e8a0ee1ef033d4f99424629651d24af8b8c47075c3a9435b504e0b8f49ddd42e3b5d95ed1a6d4a24bd5f4dc5b9fb4c516cb86a02bdde14a5e86592ec3

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
17e4c1b8e64204666416b508a350418e

SHA1
7c1d53f6749c38833d32010696b408143538ce7f

SHA256
bcd560829a3777fc2f668bf1cbc5c481e912f1cf70543c3681f05c4553e61023

SHA512
8234286e4c8c85de104386048b2cfc1aa9b6a1e4b4177a2f21f0d87f10113e48e4953b428ed184888bd6bd8c8710eebdf013aba2f32313b698854853e74230e7

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe599aa0.TMP

Filesize
48B

MD5
9d51c4e4cd7e9d2f8ab745b0c4191ffe

SHA1
3b10c6251db72ebfd7af8bf04883379a25f90664

SHA256
6b8a561839aa8c86177f4e523f57098f141c0a23f678b2b4fb79eacf8d6427a8

SHA512
7b31fbd0a42b388d0511b32be43ce0c4becd8115328ada8847e6667819c31c77de780b4cc061d9780a611000a8816cbbf8fe9d2df9861c5e410612517541bd0f

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Default\Extension Rules\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
e30a7871939346a9c76bb7fadc398d0d

SHA1
7c862bf88ab53d5727a7e035c65fd3c31bb98ba8

SHA256
b0ac0ac058a18d41297c779029754a36d896ce8b523c7737ca84c051ea6934e6

SHA512
154194b9d62bfce27620191de8c3edc4cf1938731870f3f5f74b73146d995fa7ea46be21257f2c8fd5284f7ab2f2cfdd65ffd2166a331b8c68d08805448327ae

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe599d6f.TMP

Filesize
48B

MD5
0687483d8f1d0bbefef9b7e2caeeafaf

SHA1
4c507bc8db114e535e193be018a40b31cea81bee

SHA256
20a38d8d23bf8f72b44b4a02bfc631a12533c9a6898b69ba2bd31345c8d43430

SHA512
78305031cf5b07cd3fd87aeee9679d3bd02671244dd070c9345ea23626560d979c31cbc7a90b81137d86c000af90d9590801e09ccb80504b6397c08504554560

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Local State

Filesize
2KB

MD5
5104b93c7fa8e64214c42e5d201d4570

SHA1
6aa8bf0fca374dc35236fefb0dedf8e9ff9572c2

SHA256
01507c6e30be73314006f8a59874be63c47f14035f5c8156cc4c5b7b1198857c

SHA512
a4f8be7d2c292357e0c3be09e134e343976598cce1afdf60b516d0dc4f40480850dbac38ea5d2da16c9f5486dae857a5cc8515afdf3057e6aec0457658a40e50

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Local State

Filesize
15KB

MD5
005afb0f8d921781617c69307f67582d

SHA1
af13a92e5ef35fefd5ca6c9ef091f640062ca331

SHA256
7b3798a300f08a1346a4cc5606a18fb12e3281c4c60b742136ee51a11e8f6bb3

SHA512
1fa17a228ad874a56a93e02b7f370ddc4a8b81b71c5966857c0335662ca12df049e293c344938149a4707e560eb3ea3ebd54214765a52aea06fe5c27df980b8f

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Local State

Filesize
15KB

MD5
c3476cd28f22988f0de5a9e42f740186

SHA1
b1974a72082ac35aedc30d69706c29301ff86f29

SHA256
8e1b037cd72530a623b0f18ffbd56663a124618636181e610e59afaeaa0f4ffa

SHA512
e59edb92fc9e80def89496fe941a350b6eaaf644c55758cdbae055dc5496a5e9095b25cf488dfe715af817d5aa5f4a26443d2ad0fb06899570e2b0e7fab96e9b

Download Submit
C:\Users\Admin\AppData\Roaming\The BPR\EBWebView\Local State~RFe593f51.TMP

Filesize
1KB

MD5
bf2eda640dd08b9dfdd4dcf3a656373b

SHA1
307c0c36b1e3306db57dfe488b5405705619674f

SHA256
b42fee434246a5b74e3f8cf597471ead0dd141bc66a56a32c5fd584ff079396e

SHA512
342f2e68505e81d4590ab397a1cacd32495fdefc6879c486b321a401dc1e1243f10acf762b0cfbf90517f223ed86cbb78573573804eaabd2d5925e91ab134d94

Download Submit
C:\Windows\Installer\MSI1125.tmp

Filesize
1.5MB

MD5
8f40e559a798f91fd8accf0e35b801c1

SHA1
72b3aee65acdeaece3be5b0087627d36e35597c8

SHA256
372fd3deb515af9534164d1aa91c5143c8feeb5f06ced7be00a708fc7b2bfaa3

SHA512
29fa4745e357c9627d8404a6fa3c78191fa10e8da80f74a2f84cd05140305598ac0bc228709e0acceb222d47ca2db3d632709bdfe47d62be3cabe6d87e0c1799

Download Submit
C:\Windows\Installer\MSI1125.tmp

Filesize
1.5MB

MD5
8f40e559a798f91fd8accf0e35b801c1

SHA1
72b3aee65acdeaece3be5b0087627d36e35597c8

SHA256
372fd3deb515af9534164d1aa91c5143c8feeb5f06ced7be00a708fc7b2bfaa3

SHA512
29fa4745e357c9627d8404a6fa3c78191fa10e8da80f74a2f84cd05140305598ac0bc228709e0acceb222d47ca2db3d632709bdfe47d62be3cabe6d87e0c1799

Download Submit
C:\Windows\Installer\MSI213E.tmp

Filesize
202KB

MD5
d773d9bd091e712df7560f576da53de8

SHA1
165cfbdce1811883360112441f7237b287cf0691

SHA256
e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

SHA512
15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

Download Submit
C:\Windows\Installer\MSIF52D.tmp

Filesize
202KB

MD5
d773d9bd091e712df7560f576da53de8

SHA1
165cfbdce1811883360112441f7237b287cf0691

SHA256
e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

SHA512
15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

Download Submit
C:\Windows\Installer\MSIF52D.tmp

Filesize
202KB

MD5
d773d9bd091e712df7560f576da53de8

SHA1
165cfbdce1811883360112441f7237b287cf0691

SHA256
e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

SHA512
15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

Download Submit
C:\Windows\Installer\MSIF7EE.tmp

Filesize
202KB

MD5
d773d9bd091e712df7560f576da53de8

SHA1
165cfbdce1811883360112441f7237b287cf0691

SHA256
e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

SHA512
15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

Download Submit
C:\Windows\Installer\MSIF7EE.tmp

Filesize
202KB

MD5
d773d9bd091e712df7560f576da53de8

SHA1
165cfbdce1811883360112441f7237b287cf0691

SHA256
e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

SHA512
15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

Download Submit
C:\Windows\Installer\e57f3c6.msi

Filesize
11.8MB

MD5
6c18d2ef58254ef7ed313615a4d22313

SHA1
b3378cd5fdb3e39ec2efa56f8f734528dd60edc0

SHA256
c3ff654a5d646b05b0f2bbd561c9755523da906faf5159fa681beddce2a5edab

SHA512
fe211b2ed86e3c8d5503ffe182b904707b4885e7af3b98df50d78d65b98b6aa1d976e9949b80e583746baf9b96e186740fab569888888bec61822cbfb6e22e2f

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
c1433820862651c33a81659de149cfe4

SHA1
e73770c0f28f4e1ba00680a94da3aa67204faac5

SHA256
c793672a945d6e30ebe67e8164d0fa1716ea87e149db2155a70d0b30846cb96f

SHA512
d776e6235f20f357dd8726f83da54e2aad60913a974a7fb4ba7ef34c627cbd14015b8cfafd440890925468cc7d8ef048e45dfba9fe4e3b7c3f3791b66a7c62ff

Download Submit
\??\Volume{ec0ccd79-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7d9fcaa2-9ec2-4a44-af7f-10f1a86b2af2}_OnDiskSnapshotProp

Filesize
5KB

MD5
e1cf04713f5b2cee3c9370a83f209171

SHA1
46fae960bba16f5f028a8c9f5f0ca2e4aee7321e

SHA256
f4c66d66865ff037a0739e9a12066751403cfa5051c91c9c8319649c9a5de1e8

SHA512
f1ebdecc177ca190adb6c9cf9659be9cb0619c737c174a575681e3683a42e9d78e43b5c5949130217a9a264aa3132c7ac1d4bd41a5374c247dab5e1ac1b2719c

Download Submit
memory/1352-263-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/1352-96-0x0000000004090000-0x00000000040B2000-memory.dmp

Filesize
136KB

Download
memory/1352-91-0x0000000003DE0000-0x0000000003E90000-memory.dmp

Filesize
704KB

Download
memory/1352-86-0x0000000003A20000-0x0000000003A30000-memory.dmp

Filesize
64KB

Download
memory/1352-85-0x0000000003800000-0x0000000003822000-memory.dmp

Filesize
136KB

Download
memory/1352-84-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/1352-83-0x0000000000330000-0x000000000033A000-memory.dmp

Filesize
40KB

Download
memory/1352-276-0x0000000003A20000-0x0000000003A30000-memory.dmp

Filesize
64KB

Download
memory/1784-414-0x00007FFB002B0000-0x00007FFB002B1000-memory.dmp

Filesize
4KB

Download
memory/2696-380-0x00007FFB002B0000-0x00007FFB002B1000-memory.dmp

Filesize
4KB

Download
memory/2744-398-0x00007FFAFF300000-0x00007FFAFF301000-memory.dmp

Filesize
4KB

Download
memory/2744-395-0x00007FFAFF2F0000-0x00007FFAFF2F1000-memory.dmp

Filesize
4KB

Download
memory/3856-360-0x000000000B630000-0x000000000B668000-memory.dmp

Filesize
224KB

Download
memory/3856-328-0x0000000000D10000-0x000000000114A000-memory.dmp

Filesize
4.2MB

Download
memory/3856-336-0x0000000005CF0000-0x0000000005D46000-memory.dmp

Filesize
344KB

Download
memory/3856-335-0x0000000005A10000-0x0000000005A1A000-memory.dmp

Filesize
40KB

Download
memory/3856-362-0x000000000B600000-0x000000000B60C000-memory.dmp

Filesize
48KB

Download
memory/3856-361-0x000000000AFD0000-0x000000000AFDE000-memory.dmp

Filesize
56KB

Download
memory/3856-334-0x0000000005BF0000-0x0000000005C00000-memory.dmp

Filesize
64KB

Download
memory/3856-339-0x00000000069E0000-0x0000000006A28000-memory.dmp

Filesize
288KB

Download
memory/3856-331-0x0000000005AC0000-0x0000000005B52000-memory.dmp

Filesize
584KB

Download
memory/3856-408-0x0000000005BF0000-0x0000000005C00000-memory.dmp

Filesize
64KB

Download
memory/3856-359-0x0000000005BF0000-0x0000000005C00000-memory.dmp

Filesize
64KB

Download
memory/3856-330-0x0000000006070000-0x0000000006614000-memory.dmp

Filesize
5.6MB

Download
memory/3856-329-0x0000000005A20000-0x0000000005ABC000-memory.dmp

Filesize
624KB

Download
memory/3856-337-0x0000000005BE0000-0x0000000005BEE000-memory.dmp

Filesize
56KB

Download
memory/3856-327-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/3856-507-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/3856-560-0x0000000005BF0000-0x0000000005C00000-memory.dmp

Filesize
64KB

Download
memory/3856-561-0x0000000005BF0000-0x0000000005C00000-memory.dmp

Filesize
64KB

Download
memory/3856-566-0x000000001D6D0000-0x000000001DBFC000-memory.dmp

Filesize
5.2MB

Download
memory/3856-567-0x0000000005BF0000-0x0000000005C00000-memory.dmp

Filesize
64KB

Download
memory/3856-338-0x0000000005BF0000-0x0000000005C00000-memory.dmp

Filesize
64KB

Download
memory/3856-583-0x0000000005BF0000-0x0000000005C00000-memory.dmp

Filesize
64KB

Download
memory/3856-348-0x000000000AFE0000-0x000000000AFE8000-memory.dmp

Filesize
32KB

Download
memory/3856-347-0x000000000AC50000-0x000000000AC58000-memory.dmp

Filesize
32KB

Download
memory/3856-343-0x0000000007FF0000-0x000000000809C000-memory.dmp

Filesize
688KB

Download
memory/3856-342-0x00000000080C0000-0x0000000008242000-memory.dmp

Filesize
1.5MB

Download
memory/3856-341-0x0000000007170000-0x0000000007180000-memory.dmp

Filesize
64KB

Download
memory/3856-340-0x00000000069B0000-0x00000000069CE000-memory.dmp

Filesize
120KB

Download