Overview

overview

8

Static

static

1

JJSploit_7...US.msi

windows7-x64

8

JJSploit_7...US.msi

windows10-2004-x64

8

Analysis

  • max time kernel
    776s
  • max time network
    773s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/05/2024, 06:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    JJSploit_7.3.0_x86_en-US.msi
  • Size 5.8MB
  • Sample240519-g6kt8aed53
  • SHA256 1985fdbec700334fbb2c907f37a102930744e6b3e9198c25f516eae9f6854e9b
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
adwarediscoveryevasionexecutionpersistencespywarestealertrojan

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
    persistence
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 24 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 49 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 6 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\JJSploit_7.3.0_x86_en-US.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4928
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F0D148BFFDB959A4DB7D032C5DAC8BF0 C
      2⤵
      • Loads dropped DLL
      PID:540
      • C:\Program Files (x86)\JJSploit\JJSploit.exe
        "C:\Program Files (x86)\JJSploit\JJSploit.exe"
        3⤵
        • Checks whether UAC is enabled
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        PID:4876
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /C start https://www.youtube.com/@Omnidev_
          4⤵
            PID:3840
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@Omnidev_
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1076
          • C:\Windows\SysWOW64\cmd.exe
            "cmd" /C start https://www.youtube.com/@WeAreDevsExploits
            4⤵
              PID:1756
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@WeAreDevsExploits
                5⤵
                • Checks whether UAC is enabled
                • Checks computer location settings
                • Checks system information in the registry
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • System policy modification
                PID:2168
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.51 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x308,0x7ff8ace74ef8,0x7ff8ace74f04,0x7ff8ace74f10
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4384
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2024,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2784
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2100,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3728
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2484,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1388
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3344,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2280
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3352,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4476
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4052,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:3336
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3512,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:2
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:1424
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3872,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:5940
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5644,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:6096
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5876,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:5684
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5904,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:6124
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=6020,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:2584
                • C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.51\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.51\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --field-trial-handle=6304,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:5664
                • C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.51\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.51\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --field-trial-handle=6304,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:2796
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=6308,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:5868
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=6336,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:6096
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6652,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:5512
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6648,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:5316
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=6628,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:5916
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=6860,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:4172
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6476,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:5960
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=7212,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:5720
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5612,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:7096
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4636,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:6292
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=4576,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
                  6⤵
                  • Executes dropped EXE
                  PID:6180
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --field-trial-handle=6408,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
                  6⤵
                    PID:5832
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --field-trial-handle=6880,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
                    6⤵
                      PID:5800
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4660,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
                      6⤵
                        PID:6488
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4608,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
                        6⤵
                          PID:6860
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6904,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:8
                          6⤵
                            PID:5812
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=4740,i,9404829511200443038,16530143578590596029,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:8
                            6⤵
                              PID:5540
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=JJSploit.exe --webview-exe-version=7.3.0 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --mojo-named-platform-channel-pipe=4876.1892.5941481575686689
                          4⤵
                          • Checks computer location settings
                          • Checks system information in the registry
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Enumerates system info in registry
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • System policy modification
                          PID:3232
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=125.0.2535.51 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff8ace74ef8,0x7ff8ace74f04,0x7ff8ace74f10
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:3772
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=7.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1776,i,8082292975187019731,1838652175811547448,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:4524
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=7.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1944,i,8082292975187019731,1838652175811547448,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:3
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:3872
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=7.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2076,i,8082292975187019731,1838652175811547448,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:8
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:768
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.51\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=7.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3308,i,8082292975187019731,1838652175811547448,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
                            5⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:2712
                    • C:\Windows\system32\srtasks.exe
                      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                      2⤵
                        PID:3084
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait
                        2⤵
                        • Blocklisted process makes network request
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2680
                        • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
                          "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install
                          3⤵
                          • Drops file in Program Files directory
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:3152
                          • C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\MicrosoftEdgeUpdate.exe
                            "C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                            4⤵
                            • Sets file execution options in registry
                            • Checks computer location settings
                            • Checks system information in the registry
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:1948
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Modifies registry class
                              PID:3240
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:4476
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                6⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Registers COM server for autorun
                                • Modifies registry class
                                PID:1960
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                6⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Registers COM server for autorun
                                • Modifies registry class
                                PID:4196
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                6⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Registers COM server for autorun
                                • Modifies registry class
                                PID:3612
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUNGQzAwQzktMThEQS00MzBGLTkxRUQtNDU0RkRBRTM4RUIxfSIgdXNlcmlkPSJ7NzE2M0ZDRDItOEYyNy00NTAwLTlGRTItNzhCMkFGQ0ZBMjM0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0NjFCQTdCNi03NzlDLTRBMUEtQkI5Ny0xNzM5QUUyRUY2REF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xODcuMzciIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcxNjI1OTI3NzEiIGluc3RhbGxfdGltZV9tcz0iNjg4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                              5⤵
                              • Checks system information in the registry
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:1232
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{ACFC00C9-18DA-430F-91ED-454FDAE38EB1}" /silent
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:1488
                    • C:\Windows\system32\vssvc.exe
                      C:\Windows\system32\vssvc.exe
                      1⤵
                      • Checks SCSI registry key(s)
                      PID:2932
                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                      1⤵
                      • Checks system information in the registry
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Modifies data under HKEY_USERS
                      • Suspicious use of WriteProcessMemory
                      PID:1512
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUNGQzAwQzktMThEQS00MzBGLTkxRUQtNDU0RkRBRTM4RUIxfSIgdXNlcmlkPSJ7NzE2M0ZDRDItOEYyNy00NTAwLTlGRTItNzhCMkFGQ0ZBMjM0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NjI4MjNBNTMtQTgwMi00QzhELTgyMUYtQjA0QzVERUJGOEIwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0R4T2JqSEdhK25SYTJhdEMzd28rSUVwQzc4K1pZZUFVYmtYcERDMmNqN1U9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxMCIgaW5zdGFsbGRhdGV0aW1lPSIxNzE1MTY1MjIxIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNTk2NjI5ODQ0NDE3NDg3Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDA2OCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzE2NjgxMTY2MyIvPjwvYXBwPjwvcmVxdWVzdD4
                        2⤵
                        • Checks system information in the registry
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:4932
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FCA75BE1-2F50-4E5E-B631-CDA42F27B46D}\MicrosoftEdge_X64_125.0.2535.51.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FCA75BE1-2F50-4E5E-B631-CDA42F27B46D}\MicrosoftEdge_X64_125.0.2535.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4904
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FCA75BE1-2F50-4E5E-B631-CDA42F27B46D}\EDGEMITMP_E89C2.tmp\setup.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FCA75BE1-2F50-4E5E-B631-CDA42F27B46D}\EDGEMITMP_E89C2.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FCA75BE1-2F50-4E5E-B631-CDA42F27B46D}\MicrosoftEdge_X64_125.0.2535.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                          3⤵
                          • Drops file in Program Files directory
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:2364
                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FCA75BE1-2F50-4E5E-B631-CDA42F27B46D}\EDGEMITMP_E89C2.tmp\setup.exe
                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FCA75BE1-2F50-4E5E-B631-CDA42F27B46D}\EDGEMITMP_E89C2.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FCA75BE1-2F50-4E5E-B631-CDA42F27B46D}\EDGEMITMP_E89C2.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.51 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x7ff72f664b18,0x7ff72f664b24,0x7ff72f664b30
                            4⤵
                            • Drops file in Program Files directory
                            • Executes dropped EXE
                            PID:2912
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUNGQzAwQzktMThEQS00MzBGLTkxRUQtNDU0RkRBRTM4RUIxfSIgdXNlcmlkPSJ7NzE2M0ZDRDItOEYyNy00NTAwLTlGRTItNzhCMkFGQ0ZBMjM0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyNTVFNzZCNC1BQ0M3LTQ1NUQtODc5QS0xRTlEN0I5MURGRUR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI1LjAuMjUzNS41MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzE3ODY4Njk3NCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcxNzg2ODY5NzQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NTk0MDA3MTU4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy80YmUwNTlkNi1hOGFiLTQ1ZDQtYTEwNS01MTE1MDQ1Y2E4ZDA_UDE9MTcxNjcwNTY5NSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1sdmhIYkgzaWN1QzFnRzFPM0J6U0Nhalhlb3Z5cHMlMmZJJTJmSm1mRk5iNXlCcTI4d0d2Z0owN0dHVFJlRGxaNFd5aWdTcnpJOWxLSVpiWjBlS1E3WWpYVWclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM2NDIyODgiIHRvdGFsPSIxNzM2NDIyODgiIGRvd25sb2FkX3RpbWVfbXM9IjM1MTEwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzU5NDAwNzE1OCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc2MDgwNjk2MzYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjgwNDM2OTQ4MTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI3OTciIGRvd25sb2FkX3RpbWVfbXM9IjQxNTAxIiBkb3dubG9hZGVkPSIxNzM2NDIyODgiIHRvdGFsPSIxNzM2NDIyODgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQzNTYzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                        2⤵
                        • Checks system information in the registry
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:4336
                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
                      1⤵
                      • Checks system information in the registry
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3592
                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                      1⤵
                      • Checks system information in the registry
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Modifies data under HKEY_USERS
                      • Suspicious use of WriteProcessMemory
                      PID:1252
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D23C0F7E-E301-4CDD-9CC7-320C23CE10E6}\BGAUpdate.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D23C0F7E-E301-4CDD-9CC7-320C23CE10E6}\BGAUpdate.exe" --edgeupdate-client --system-level
                        2⤵
                        • Adds Run key to start application
                        • Executes dropped EXE
                        PID:1232
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjVGNTVBM0QtMkRGRi00N0E5LTg2QkEtNDNCRUYzMTE3MDc3fSIgdXNlcmlkPSJ7NzE2M0ZDRDItOEYyNy00NTAwLTlGRTItNzhCMkFGQ0ZBMjM0fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsxMjcxNkI3RS0xMzMwLTRGRTQtOTQ2MC00QkZCMjU4QTU0NDV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RDZqeFBlVW1LZmg4eXR5NkYwN1l4TTFlWkRIL1RWNkZRVDJmZkRpWnl3dz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7MUZBQjhDRkUtOTg2MC00MTVDLUE2Q0EtQUE3RDEyMDIxOTQwfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMi4wLjAuMzQiIGxhbmc9IiIgYnJhbmQ9IkVVRkkiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDE1NjAzODU4OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMTU2MDM4NTg4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNjk2OTc1ODY3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNWYxOTU2MTItMzg0YS00OGVhLTg0MDgtYjRlZGU5ZGM1NmJiP1AxPTE3MTY3MDU5OTMmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZVBqOUNNRFk2eVZsck1kOCUyYk1NMSUyYk9SJTJiTU1zTUxJUHo5bUZUdSUyZldySWJhcHphM2VyUjRpJTJmSlJTczJYTzN5YkpJdTQxdXVJQ1lGV0dGbGxZajUyRnVnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjE1Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTA2OTY5NzU4NjciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzVmMTk1NjEyLTM4NGEtNDhlYS04NDA4LWI0ZWRlOWRjNTZiYj9QMT0xNzE2NzA1OTkzJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWVQajlDTURZNnlWbHJNZDglMmJNTTElMmJPUiUyYk1Nc01MSVB6OW1GVHUlMmZXckliYXB6YTNlclI0aSUyZkpSU3MyWE8zeWJKSXU0MXV1SUNZRldHRmxsWWo1MkZ1ZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE4MDQ0NDQ4IiB0b3RhbD0iMTgwNDQ0NDgiIGRvd25sb2FkX3RpbWVfbXM9IjQ5NzAzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTA2OTcyODgzNDgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDcwMzM4MjMwNiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNzA3NDQ0NTUwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMjgyIiBkb3dubG9hZF90aW1lX21zPSI1NDAzMSIgZG93bmxvYWRlZD0iMTgwNDQ0NDgiIHRvdGFsPSIxODA0NDQ0OCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDA2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                        2⤵
                        • Checks system information in the registry
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Modifies data under HKEY_USERS
                        PID:4948
                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                      1⤵
                      • Checks system information in the registry
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:4076
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4D6EB0C-AD2B-4442-A515-A07DA62B3078}\MicrosoftEdge_X64_125.0.2535.51.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4D6EB0C-AD2B-4442-A515-A07DA62B3078}\MicrosoftEdge_X64_125.0.2535.51.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2492
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4D6EB0C-AD2B-4442-A515-A07DA62B3078}\EDGEMITMP_4937F.tmp\setup.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4D6EB0C-AD2B-4442-A515-A07DA62B3078}\EDGEMITMP_4937F.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4D6EB0C-AD2B-4442-A515-A07DA62B3078}\MicrosoftEdge_X64_125.0.2535.51.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                          3⤵
                          • Installs/modifies Browser Helper Object
                          • Modifies Installed Components in the registry
                          • Drops file in Program Files directory
                          • Executes dropped EXE
                          • Registers COM server for autorun
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:4080
                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4D6EB0C-AD2B-4442-A515-A07DA62B3078}\EDGEMITMP_4937F.tmp\setup.exe
                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4D6EB0C-AD2B-4442-A515-A07DA62B3078}\EDGEMITMP_4937F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4D6EB0C-AD2B-4442-A515-A07DA62B3078}\EDGEMITMP_4937F.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.51 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff699264b18,0x7ff699264b24,0x7ff699264b30
                            4⤵
                            • Executes dropped EXE
                            PID:4220
                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4D6EB0C-AD2B-4442-A515-A07DA62B3078}\EDGEMITMP_4937F.tmp\setup.exe
                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4D6EB0C-AD2B-4442-A515-A07DA62B3078}\EDGEMITMP_4937F.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                            4⤵
                            • Drops file in System32 directory
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of WriteProcessMemory
                            PID:3896
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4D6EB0C-AD2B-4442-A515-A07DA62B3078}\EDGEMITMP_4937F.tmp\setup.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4D6EB0C-AD2B-4442-A515-A07DA62B3078}\EDGEMITMP_4937F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4D6EB0C-AD2B-4442-A515-A07DA62B3078}\EDGEMITMP_4937F.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.51 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff699264b18,0x7ff699264b24,0x7ff699264b30
                              5⤵
                              • Executes dropped EXE
                              PID:1928
                          • C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.51\Installer\setup.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.51\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                            4⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4592
                            • C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.51\Installer\setup.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.51\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.51\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.51 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff76f444b18,0x7ff76f444b24,0x7ff76f444b30
                              5⤵
                              • Drops file in Program Files directory
                              • Executes dropped EXE
                              PID:1212
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODU0MDY3RjctQjg3Ny00MTYyLUE2N0EtMzQ1QUQyMUM3RUJDfSIgdXNlcmlkPSJ7NzE2M0ZDRDItOEYyNy00NTAwLTlGRTItNzhCMkFGQ0ZBMjM0fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntEMjdBQkZEMy05RDQzLTQ0NzEtQkQ3Mi01NzgzMkMzQzk1MDl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RDZqeFBlVW1LZmg4eXR5NkYwN1l4TTFlWkRIL1RWNkZRVDJmZkRpWnl3dz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny4zNyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJJc09uSW50ZXJ2YWxDb21tYW5kc0FsbG93ZWQ9LXRhcmdldF9kZXY7UHJvZHVjdHNUb1JlZ2lzdGVyPSU3QjFGQUI4Q0ZFLTk4NjAtNDE1Qy1BNkNBLUFBN0QxMjAyMTk0MCU3RCIgaW5zdGFsbGFnZT0iMTAiIGNvaG9ydD0icnJmQDAuNjMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMTEiIHJkPSI2MzM3IiBwaW5nX2ZyZXNobmVzcz0iezFCRkI3MjdCLUYzOTMtNEUxNC05OTY2LTk0QjMyODQ0NjI4OH0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjciIG5leHR2ZXJzaW9uPSIxMjUuMC4yNTM1LjUxIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjEwIiBpc19waW5uZWRfc3lzdGVtPSJ0cnVlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNTk2NDE3MjkwNDI2NjQwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDc0NDk0NDYxOSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDc0NTEwMDgzMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDc3MTM1MTE2MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDc4NDYzMjMxMyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTExNDQ5NDQ1OTciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIyOTciIGRvd25sb2FkZWQ9IjE3MzY0MjI4OCIgdG90YWw9IjE3MzY0MjI4OCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjIiIGluc3RhbGxfdGltZV9tcz0iMzYwMzEiLz48cGluZyBhY3RpdmU9IjEiIGE9IjExIiByPSIxMSIgYWQ9IjYzMzciIHJkPSI2MzM3IiBwaW5nX2ZyZXNobmVzcz0ie0JEMDFCOEUzLTM3RTItNDYzQS04OUMzLTI4MEM5MTE0NjM3NX0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTI1LjAuMjUzNS41MSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2MzQyIiBjb2hvcnQ9InJyZkAwLjUyIj48dXBkYXRlY2hlY2svPjxwaW5nIHI9Ii0xIiByZD0iLTEiIHBpbmdfZnJlc2huZXNzPSJ7OThERDUwMTItRjlGMS00QTlFLTk3RUMtRkQ1MjIyRkU5QzFEfSIvPjwvYXBwPjwvcmVxdWVzdD4
                        2⤵
                        • Checks system information in the registry
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1948
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
                      1⤵
                        PID:2732
                      • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
                        "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
                        1⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3392
                      • C:\Windows\system32\wwahost.exe
                        "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        PID:4704
                      • C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.51\elevation_service.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.51\elevation_service.exe"
                        1⤵
                        • Executes dropped EXE
                        PID:5260
                      • C:\Windows\system32\AUDIODG.EXE
                        C:\Windows\system32\AUDIODG.EXE 0x470 0x504
                        1⤵
                          PID:5828

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              e5b24db.rbs
                              • Path C:\Config.Msi\e5b24db.rbs
                              • Size 22KB
                              • SHA256 e56658211b32c6eac4bfe0138a6036afa0b4037184b803136c9f441734d03184
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              JJSploit.exe
                              • Path C:\Program Files (x86)\JJSploit\JJSploit.exe
                              • Size 9.9MB
                              • SHA256 2a19e43202cef88fdabb63be7811cb4214ed455aeac227ea6a86b19d60a9d14d
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              setup.exe
                              • Path C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.51\Installer\setup.exe
                              • Size 6.9MB
                              • SHA256 1a3d50530e998787561309b08a797f10fe97833e5a6c1f5b35a26b9068d8c3e8
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              BGAUpdate.exe
                              • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{1FAB8CFE-9860-415C-A6CA-AA7D12021940}\2.0.0.34\BGAUpdate.exe
                              • Size 17.2MB
                              • SHA256 d3c12e642d4b032e2592c2ba6e0ed703a7e43fb424b7c3ab5b2e51b53d1d433b
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              SETUP.EX_
                              • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4D6EB0C-AD2B-4442-A515-A07DA62B3078}\EDGEMITMP_4937F.tmp\SETUP.EX_
                              • Size 2.8MB
                              • SHA256 17a00157a757420a5cbeef48ffc3585bc7794823cd607c640256d67079a982f5
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              EdgeUpdate.dat
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\EdgeUpdate.dat
                              • Size 12KB
                              • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MicrosoftEdgeComRegisterShellARM64.exe
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\MicrosoftEdgeComRegisterShellARM64.exe
                              • Size 179KB
                              • SHA256 ccdcbabb2dd8a0701bcc7cb3342ffe1b7bb633300de782c8cd0cb706894db709
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MicrosoftEdgeUpdate.exe
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\MicrosoftEdgeUpdate.exe
                              • Size 201KB
                              • SHA256 f9819b0b98e30da8b8f7c08191234ccf0bf03a33b7fd41fe93f120f974a8990a
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MicrosoftEdgeUpdateComRegisterShell64.exe
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
                              • Size 212KB
                              • SHA256 aa3304fccb73b3c8f3b50f6bd539bb6293fa4393b6cfc56174878b1eb352eb61
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MicrosoftEdgeUpdateCore.exe
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\MicrosoftEdgeUpdateCore.exe
                              • Size 258KB
                              • SHA256 24b93e5e53c2fae8d6430da172bf79fd3a6a6d38c5ca9d3a844494f2b7bc01ae
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              NOTICE.TXT
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\NOTICE.TXT
                              • Size 4KB
                              • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdate.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdate.dll
                              • Size 2.1MB
                              • SHA256 4ac4272afebc63cd0bc85a5a901403570e5ba8ecb867febffcb005efc7d65837
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_af.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_af.dll
                              • Size 29KB
                              • SHA256 6c0aab9da650ff49e668f6048e7cca45d908f566e9b1ad1a2736db2abcb6a540
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_am.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_am.dll
                              • Size 24KB
                              • SHA256 1bfc89c8a6c558f70edab1a24585960276fe1c08c5f363855062e13503daf7de
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_ar.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_ar.dll
                              • Size 26KB
                              • SHA256 e7a94d29115f6b575c9dce9a0d649e38058e369bfa32b4f510efeca30bb85388
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_as.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_as.dll
                              • Size 29KB
                              • SHA256 6ea80179f119d72f00940dffa2b0fe11c8559052d22837d035d57cf0fa923caa
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_az.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_az.dll
                              • Size 29KB
                              • SHA256 3cb6ba05195e7aee536d3734f7631f0fc47bd5f483c1bf6c646f57c008cd0ed3
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_bg.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_bg.dll
                              • Size 29KB
                              • SHA256 0be36d4264d8ac8af871c1ebc448672137bfb894cb0b91a07dab20743d2f344c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_bn-IN.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_bn-IN.dll
                              • Size 29KB
                              • SHA256 a248073ed5a436a921745aa78f3c039e8ac0c360372644c1f78c36737e78f87e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_bn.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_bn.dll
                              • Size 29KB
                              • SHA256 75951874d4a4624d5a054fada852f046add3d57424986bfdc2a1c3bfc66be484
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_bs.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_bs.dll
                              • Size 29KB
                              • SHA256 42c14d538d82c44d0ea2b4424548269cf7dc9063d5c56c3e12a7a4f575a37f6e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_ca-Es-VALENCIA.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
                              • Size 30KB
                              • SHA256 88f78ff99301af50ebaff945557092113f27201738aad2cf9ee24d416023617a
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_ca.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_ca.dll
                              • Size 30KB
                              • SHA256 ebeb21625556564644993a2eb2ab10a1f4a0507c175933343025c4d0ed5b3933
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_cs.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_cs.dll
                              • Size 28KB
                              • SHA256 b4f889351006556944447c9c6bd3f5591442296ba9f57948eae09a6828fbc0bb
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_cy.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_cy.dll
                              • Size 28KB
                              • SHA256 e732991010f68800ad14718687e29df53ee763264facf87db8c08eab874309ce
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_da.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_da.dll
                              • Size 29KB
                              • SHA256 30ae20bd4527f98e16af09566d67e3163d05be72a6021d9b54c493a1934f7792
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_de.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_de.dll
                              • Size 31KB
                              • SHA256 edd1374957acefc691ebbc448c74636f5a5efcb91630d901ac1f323a91f55904
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_el.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_el.dll
                              • Size 31KB
                              • SHA256 32a516ba9e696a37815e0870c42ec9deddeab24d6c66b9020afc4b28ab5d0de8
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_en-GB.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_en-GB.dll
                              • Size 27KB
                              • SHA256 0bd45524f17fcc436eb62803f42ddcb9ab4ddf9de6d6338a8d90da8ecda699aa
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_en.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_en.dll
                              • Size 27KB
                              • SHA256 387385234ff48a0faef8935ea7dbaab58acb85594bb9cd67b6b66da8e2c15941
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_es-419.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_es-419.dll
                              • Size 29KB
                              • SHA256 a370d7198985602c8d1858d1b39aa57c62ae3463ddf99f03304b04c8dd3ce381
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_es.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_es.dll
                              • Size 29KB
                              • SHA256 a043288bb0006a2e9de1e10e2aed56bdd195ce93681dd63af8e86a4ba6932224
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_et.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_et.dll
                              • Size 28KB
                              • SHA256 541d96a5dd7aa5382547917d7426722f2a82f5cbf40fe457459b7b2b22e6f06c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_eu.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_eu.dll
                              • Size 29KB
                              • SHA256 21f2a1440e2277a3f1814a67e758ba2efa30f64653c8efc727f2ebcb92d3b85e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_fa.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_fa.dll
                              • Size 28KB
                              • SHA256 6c938d3deb6eb18ed7406ac64eb97070b08764442f738fee98665db6b8397927
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_fi.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_fi.dll
                              • Size 28KB
                              • SHA256 0cf505cfd900a334226b4709520ea5a8f47ad8e4fa700bd4c82e00edb01d9f87
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_fil.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_fil.dll
                              • Size 29KB
                              • SHA256 91ff7f63741c15c775b765b062be8f40950cc57bb006e93d89bef6f472de748c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_fr-CA.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_fr-CA.dll
                              • Size 30KB
                              • SHA256 277f8b8dc5158bf84c7aac8a6a12ee1b9168edcc68666d20e20f214f871c652e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_fr.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_fr.dll
                              • Size 30KB
                              • SHA256 4a3fd5525b8e7a84165a4699e8ce0d104bb59b3f4bf5d715b6428555d32d492f
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_ga.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_ga.dll
                              • Size 29KB
                              • SHA256 1ab0953411b0c744023ef5e4ea17608c8772ae55e6a3fff62549ab1b2bebbea7
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_gd.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_gd.dll
                              • Size 30KB
                              • SHA256 076e55afeb3032e06c8e5c0c98b65b41b13e90b501bde5028d8d0dae0adab441
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_gl.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_gl.dll
                              • Size 29KB
                              • SHA256 1c3873c582b343ff0960e1a2463db72eea88d19f79e95647bf9f6e7adc3013a7
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_gu.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_gu.dll
                              • Size 29KB
                              • SHA256 e30c0968c0697dc59a373064ddae9bb4b206098ef7ef4553445341c16314a033
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_hi.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_hi.dll
                              • Size 29KB
                              • SHA256 36ba2c1da17821dcfb83eb5a232fd6252dd4c3713c197d3aa8aec1ca60125d8d
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_hr.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_hr.dll
                              • Size 29KB
                              • SHA256 8c0f964ea755e1c8229b17673884f7b53f63b626ba3fbb0c9fe1b0f5a00d7c45
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_hu.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_hu.dll
                              • Size 29KB
                              • SHA256 ff398da62816181d321178edf1ba67ae505851cf6a4e5376dbb2719154463d38
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_id.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_id.dll
                              • Size 28KB
                              • SHA256 4ea354fe6800360b1af32d503d519809c880c9fb96f9b8e8e6cbd53de671c18c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_is.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_is.dll
                              • Size 28KB
                              • SHA256 d515ed955ebf704ec80649b61d35e92f2622c371025de8f2613c460515b642a2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_it.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_it.dll
                              • Size 30KB
                              • SHA256 7b6dd7955e7e9c235cee987cffeb906390e7ffee57bf735f0aff36209933906f
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_iw.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_iw.dll
                              • Size 25KB
                              • SHA256 f3691eb9347aa0bb8b60e5dc8a4281141a82b88da9338866301cbb8bc026fecb
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_ja.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_ja.dll
                              • Size 24KB
                              • SHA256 cc365d352297d2ac78cb93379000b4e5affd6c650ebab6504d7028fce524935e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_ka.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_ka.dll
                              • Size 29KB
                              • SHA256 30ce2b7c6267161b356e297f5536abf5beff6b95052af10d0041e6c479309bd1
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_kk.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_kk.dll
                              • Size 28KB
                              • SHA256 541c864b2daeb81b4a280f1dbdbab1f3a22aa42b93bf29b632f53ab09bbded07
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_km.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_km.dll
                              • Size 27KB
                              • SHA256 5f5f4b01c659afed2e394de7539c6c7de394252c8c7df447f76a53bf5df98f79
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_kn.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_kn.dll
                              • Size 29KB
                              • SHA256 297935c0721fe3e35d007e2df4bdcad94033584da953f4428d04c8924c1b8416
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_ko.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_ko.dll
                              • Size 23KB
                              • SHA256 0627fe52f076ceb509c28a0b1313ee3cde9374cf62838332046b8f7db791251b
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_kok.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_kok.dll
                              • Size 28KB
                              • SHA256 54156bcd957fd10400b353a3f68cde2545598f754c7aa35abd659cd31d6ea4d2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_lb.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_lb.dll
                              • Size 30KB
                              • SHA256 df61de11911c41bf081e70bea9b850596b2331981a58c916fd1eb19b00af6f38
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_lo.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_lo.dll
                              • Size 27KB
                              • SHA256 f3fd224b2d26c6e1a27a3ecf76221dc734b04beda90f226fbcad8c69ff2a5a37
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_lt.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_lt.dll
                              • Size 28KB
                              • SHA256 cf9a85e1bfcb7be8f18da235eba13324f4855b2fd3d8aa2adbe87233283a8764
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_lv.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_lv.dll
                              • Size 29KB
                              • SHA256 1b34ffa7532ec11c26694ca5ed8ea261b6fc192f65302d8e029b821dfbe30dcf
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msedgeupdateres_mi.dll
                              • Path C:\Program Files (x86)\Microsoft\Temp\EU391D.tmp\msedgeupdateres_mi.dll
                              • Size 28KB
                              • SHA256 49e4a819ecd7aa40af4eee96800e423e34b3624bb30f9b674318cff5d983da33
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              settings.dat
                              • Path C:\Program Files\MsEdgeCrashpad\settings.dat
                              • Size 280B
                              • SHA256 642a722fc1c9001dacd055c50f2301610fd60dd534cdc8257442a8033bbf359d
                              • MD5 SHA1 SHA512
                              Submit Download

                              MicrosoftEdgeUpdate.log
                              • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                              • Size 107KB
                              • SHA256 2007407406ad6eeaf612814456c46b282b64c33efc83005a34d9e6bf6deb6f19
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              JJSploit.lnk
                              • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk
                              • Size 2KB
                              • SHA256 e2002b936de353f23d7238e4b49cc45e718e999013c2d276bcff16f0f6ecbe2a
                              • MD5 SHA1 SHA512
                              Submit Download

                              JJSploit.lnk~RFe5b273b.TMP
                              • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk~RFe5b273b.TMP
                              • Size 1KB
                              • SHA256 7cae66532964c235d411d5773590eb1bedb6a2f778e0d4c04ea9d2d710a685e2
                              • MD5 SHA1 SHA512
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 0223313fc57b126502708dbaadd674614c418fda90ad03459e8c7d1694c4986c
                              • MD5 SHA1 SHA512
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 a822cf44acaa63457ecbeacd6b3a35d07868c437119721a92843ff479a766524
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                              • Size 552B
                              • SHA256 70183c929cbd07e40d7990bad0cffc3023c0caa7e0073da4421512423de97144
                              • MD5 SHA1 SHA512
                              Submit Download

                              data_0
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_0
                              • Size 8KB
                              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              data_2
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_2
                              • Size 8KB
                              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              data_3
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_3
                              • Size 8KB
                              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              62d049ac-bc7e-478b-99c2-07b531692339.tmp
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\62d049ac-bc7e-478b-99c2-07b531692339.tmp
                              • Size 2B
                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                              • MD5 SHA1 SHA512
                              Submit Download

                              content.js
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
                              • Size 9KB
                              • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              000003.log
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
                              • Size 52KB
                              • SHA256 d18c7e30625260d015c7a20b92151b877181ade3fadd737162bf3a41a56c3252
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              LOG
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
                              • Size 351B
                              • SHA256 69b971d3c0115ade345af91d63f98e7418791ad4cba41a3ee9422a21c814c6ac
                              • MD5 SHA1 SHA512
                              Submit Download

                              MANIFEST-000001
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
                              • Size 23B
                              • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                              • MD5 SHA1 SHA512
                              Submit Download

                              Network Persistent State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                              • Size 6KB
                              • SHA256 b837ca21e4f8c8f165f1658221fa2889bab589168ff294ac5651a8ccf98ce881
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              TransportSecurity
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                              • Size 859B
                              • SHA256 72cdf3cdd5f915d8e79efa6ccb3376fa13b4848d14fd74e126b7d580de0f1dcf
                              • MD5 SHA1 SHA512
                              Submit Download

                              TransportSecurity
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                              • Size 859B
                              • SHA256 7186c32d7f69b39bdaf6b80a95f111d98f0c215a34bbeb7cf018d68b0745aabb
                              • MD5 SHA1 SHA512
                              Submit Download

                              TransportSecurity~RFe6246b8.TMP
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RFe6246b8.TMP
                              • Size 525B
                              • SHA256 7d73cb0536122e6d3df2be911e2f1bb4ebee6a3b0e9ee1c73ad1f9aeca3adf58
                              • MD5 SHA1 SHA512
                              Submit Download

                              Preferences
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              • Size 15KB
                              • SHA256 d96ea3e57948ba4f1c62db954f4dcb22c9393d3d757d3ca3ce2e2a5276e1739f
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Secure Preferences
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                              • Size 35KB
                              • SHA256 f39d78c717a83cf99cdc7ec99cd7c8937fac295d389cbeba19919cf14dbb7fa2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              index
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4621db51-4632-4ba7-aa17-edad6d08d1ab\index
                              • Size 24B
                              • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4621db51-4632-4ba7-aa17-edad6d08d1ab\index-dir\the-real-index
                              • Size 2KB
                              • SHA256 5bd4e5dc041cb276e3c3f258dc9f1258c7e04a6b7b8f683f1ac93f585cc92ec6
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index~RFe62c57d.TMP
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4621db51-4632-4ba7-aa17-edad6d08d1ab\index-dir\the-real-index~RFe62c57d.TMP
                              • Size 48B
                              • SHA256 f2b180bfa5d299a211f6c9e6967265a116b7fae3a4ac4020bfcfe813ce9103ec
                              • MD5 SHA1 SHA512
                              Submit Download

                              093389ebade69a14_0
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f73b999c-cd95-4455-a5ca-8bc9a9a25b7c\093389ebade69a14_0
                              • Size 2KB
                              • SHA256 bf54a6cfe391dc3971d29ab865afc70d0741f88025d4e39ff784e0d215d66b0a
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f73b999c-cd95-4455-a5ca-8bc9a9a25b7c\index-dir\the-real-index
                              • Size 624B
                              • SHA256 8a37492d6cb41c4c8cccb0a9a4859500307450b7ddda494ec932cbfb97922b69
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index~RFe627f2d.TMP
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f73b999c-cd95-4455-a5ca-8bc9a9a25b7c\index-dir\the-real-index~RFe627f2d.TMP
                              • Size 48B
                              • SHA256 a9df39bcfb31484b75f96183446dc598ebaa94eafddb0cc161bc937073c2e629
                              • MD5 SHA1 SHA512
                              Submit Download

                              index.txt
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                              • Size 176B
                              • SHA256 70c6710fa9cc9e5732b72d2fb4a0a7c73427e3d233c7a7099ead787c8328eb09
                              • MD5 SHA1 SHA512
                              Submit Download

                              index.txt
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                              • Size 112B
                              • SHA256 8cc6045ae65cfd29e887565331a23702abf822efa3016afd2e08cb82537302b9
                              • MD5 SHA1 SHA512
                              Submit Download

                              index.txt
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                              • Size 185B
                              • SHA256 7886eb88a64d0f5915a96f3a64fc50e0d7fa6b75b166dad79a54c0d3190b8c53
                              • MD5 SHA1 SHA512
                              Submit Download

                              index.txt
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                              • Size 183B
                              • SHA256 1a98344bc0f41057b8689d04162bb1e02a02811a1b4a73cdaa4dcdc2e57f0745
                              • MD5 SHA1 SHA512
                              Submit Download

                              index.txt
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                              • Size 247B
                              • SHA256 e520bc8ef357c7e42ab6b4eb1b02634dcdd131d46acd8a13b3cd8236bbf29d1b
                              • MD5 SHA1 SHA512
                              Submit Download

                              index.txt
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                              • Size 183B
                              • SHA256 10bc68f1927ded7393696aee3a2cfebf404b1e10c7e0b063fb111bdcecc78a61
                              • MD5 SHA1 SHA512
                              Submit Download

                              index.txt~RFe6223ce.TMP
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe6223ce.TMP
                              • Size 119B
                              • SHA256 d1e23d3a0702d4b9286fcf16070869fadae6654b8dd0af3851d924367ee33c23
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                              • Size 96B
                              • SHA256 f643b459bd572854a0e37e9236696f2dd907b855baac352363e873facd2ac3ac
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index~RFe627559.TMP
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe627559.TMP
                              • Size 48B
                              • SHA256 e71ab37a6e06622c3935c7a0bd9a6462b9eeab16e47a65bac268d573c9b6cd7a
                              • MD5 SHA1 SHA512
                              Submit Download

                              data_1
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
                              • Size 264KB
                              • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              • Size 4KB
                              • SHA256 f120797d3b8557dd6d8dfabb56d537cb2e29d45311072fc084c628018998ad21
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              • Size 7KB
                              • SHA256 65bbbd8486de7b3a420896e3856fba409f7a66618c934d0556799ad2cec5fa39
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              • Size 5KB
                              • SHA256 752acdccab2e7839e8a5651616d2a44d742a8bca5a83fa0f052314c70cc50e13
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              • Size 29KB
                              • SHA256 5bb9e5500da1d9919893319aa39e6fcea35a973fcbbc89b87511802087ba9e6c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              • Size 6KB
                              • SHA256 ba885d12efe48d68789000bb3be9f842cf0373e3dec21a866b419857ff4be44f
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              a1b64197-032d-4ffe-b968-946a4f380cae.tmp
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a1b64197-032d-4ffe-b968-946a4f380cae.tmp
                              • Size 7KB
                              • SHA256 3041e7c6c134c33fc9fa3eb453bf4792904ea208129083a914804901947cfe1f
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                              • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                              • Size 2KB
                              • SHA256 22979789f5d8ab180329209574333a55ac8e9cf672a595f869385f40c5d6b54f
                              • MD5 SHA1 SHA512
                              Submit Download

                              ThirdPartyNotice.html.~tmp
                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.~tmp
                              • Size 104KB
                              • SHA256 003e619884dbc527e20f0aa8487daf5d7eed91d53ef6366a58c5493aaf1ce046
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MSIF406.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\MSIF406.tmp
                              • Size 113KB
                              • SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MicrosoftEdgeWebview2Setup.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
                              • Size 1.5MB
                              • SHA256 4cfffb2178202505422fc9612d3418ed1ee58d72a22fdde34d5ec4010285c874
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              __PSScriptPolicyTest_jcys3yvs.eyp.ps1
                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jcys3yvs.eyp.ps1
                              • Size 60B
                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                              • MD5 SHA1 SHA512
                              Submit Download

                              adbf4a16-3032-4657-adac-e3c0ed80c1fd.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\adbf4a16-3032-4657-adac-e3c0ed80c1fd.tmp
                              • Size 99KB
                              • SHA256 506e1674928b76193ce69e72bae0e0eec9484337eee6e241267678c49a5623c4
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              d0d81ac5-4e62-499e-8b46-61a19cd506f9.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\d0d81ac5-4e62-499e-8b46-61a19cd506f9.tmp
                              • Size 10KB
                              • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              db4d4633-c2b5-4458-8ff0-12a3c1bc942a.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\db4d4633-c2b5-4458-8ff0-12a3c1bc942a.tmp
                              • Size 1B
                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                              • MD5 SHA1 SHA512
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 22a401733c47b6cc9b2dfc91ca962f216b5587ad0065837610a67900301401a6
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                              • Size 48B
                              • SHA256 35edb5fee6ed161d8e52e015edefa117e3b760b9f68bda928c40c9f6bd653811
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                              • Size 120B
                              • SHA256 865b509832e8bd5889067d26359c5e20cd74f5791036bc007b7628ff9b8e8dd9
                              • MD5 SHA1 SHA512
                              Submit Download

                              CURRENT
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Local Storage\leveldb\CURRENT
                              • Size 16B
                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                              • MD5 SHA1 SHA512
                              Submit Download

                              MANIFEST-000001
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001
                              • Size 41B
                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                              • MD5 SHA1 SHA512
                              Submit Download

                              Network Persistent State
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
                              • Size 1KB
                              • SHA256 7f22ddf133b5dffc0003749297e4b56535ae274eac1ed97338dfa97d95134c7c
                              • MD5 SHA1 SHA512
                              Submit Download

                              Network Persistent State~RFe62fac6.TMP
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe62fac6.TMP
                              • Size 59B
                              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                              • MD5 SHA1 SHA512
                              Submit Download

                              SCT Auditing Pending Reports
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
                              • Size 2B
                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                              • MD5 SHA1 SHA512
                              Submit Download

                              f3db3b76-0d6a-4466-9a1a-2a4ebe20352f.tmp
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\f3db3b76-0d6a-4466-9a1a-2a4ebe20352f.tmp
                              • Size 6KB
                              • SHA256 bfc236f78ab6a79e42d2f3ea38e261cc7f0e1784c5ce6a082eba25bf21592760
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
                              • Size 1KB
                              • SHA256 ce651e57a34fc781af2b7ba806093791d8d510e4c34a64dd3ec6d15af2d4aca9
                              • MD5 SHA1 SHA512
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
                              • Size 2KB
                              • SHA256 1e1d363eb2774cf737de7dc30f61f98e5cf8e2645cdcc5b59ccc2b45be2286a7
                              • MD5 SHA1 SHA512
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
                              • Size 3KB
                              • SHA256 3549ffe92005129a9ea5e8378c1b975ce0ad98692a525db6ec0d7a59235735da
                              • MD5 SHA1 SHA512
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
                              • Size 16KB
                              • SHA256 91771e6a2a9569a9c497365bf10371b5fe42b792a01475686c8122428b3da254
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
                              • Size 16KB
                              • SHA256 add24a25467fe7fc5f45ccc75c1a439d5925783c3c66bb379d1c925d1d46c678
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Local State~RFe61e08c.TMP
                              • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe61e08c.TMP
                              • Size 1KB
                              • SHA256 6f41b24c8d5dd6495e511d038883643c787b5928957131191a84db43b2c5370b
                              • MD5 SHA1 SHA512
                              Submit Download

                              e5b24da.msi
                              • Path C:\Windows\Installer\e5b24da.msi
                              • Size 5.8MB
                              • SHA256 1985fdbec700334fbb2c907f37a102930744e6b3e9198c25f516eae9f6854e9b
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              memory/768-896-0x00007FF8CD210000-0x00007FF8CD211000-memory.dmp
                              Download

                              memory/768-897-0x00007FF8CCEB0000-0x00007FF8CCEB1000-memory.dmp
                              Download

                              memory/1948-265-0x00000000003B0000-0x00000000003E5000-memory.dmp
                              Download

                              memory/1948-266-0x0000000074270000-0x000000007448F000-memory.dmp
                              Download

                              memory/1948-272-0x0000000074270000-0x000000007448F000-memory.dmp
                              Download

                              memory/1948-327-0x00000000003B0000-0x00000000003E5000-memory.dmp
                              Download

                              memory/2680-57-0x0000017E24D40000-0x0000017E24D62000-memory.dmp
                              Download

                              memory/2712-942-0x00007FF8CBE60000-0x00007FF8CBE61000-memory.dmp
                              Download

                              memory/3392-501-0x0000026322C30000-0x0000026322E79000-memory.dmp
                              Download

                              memory/3392-496-0x0000026308470000-0x000002630847E000-memory.dmp
                              Download

                              memory/3392-499-0x0000026322990000-0x000002632299A000-memory.dmp
                              Download

                              memory/3392-500-0x00000263229C0000-0x00000263229C8000-memory.dmp
                              Download

                              memory/4524-895-0x00007FF8CBE60000-0x00007FF8CBE61000-memory.dmp
                              Download