Malware Analysis Report

2025-08-10 12:13

Sample ID 240527-ybkdmsge97
Target mixamo_converter.rar
SHA256 1f81a317f062224d12686f4a3edf5e2487ea82f4f2e82e9e5e48d8f573bc8352
Tags
discovery persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

1f81a317f062224d12686f4a3edf5e2487ea82f4f2e82e9e5e48d8f573bc8352

Threat Level: Likely malicious

The file mixamo_converter.rar was found to be: Likely malicious.

Malicious Activity Summary

discovery persistence

Downloads MZ/PE file

Sets file execution options in registry

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Registers COM server for autorun

Checks installed software on the system

Checks system information in the registry

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-27 19:36

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-27 19:36

Reported

2024-05-27 19:40

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\mixamo_converter\Mixamo_Converter.exe"

Signatures

Downloads MZ/PE file

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\mixamo_converter\Mixamo_Converter.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mixamo_converter\Mixamo_Converter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mixamo_converter\Mixamo_Converter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mixamo_converter\Mixamo_Converter.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Registers COM server for autorun

persistence
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A

Checks installed software on the system

discovery

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\nl.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\sr-Cyrl-BA.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\gd.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Trust Protection Lists\Sigma\Entities C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Trust Protection Lists\Sigma\Fingerprinting C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\es.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Trust Protection Lists\manifest.json C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Trust Protection Lists\Sigma\Other C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Trust Protection Lists\Mu\Advertising C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\identity_proxy\win10\identity_helper.Sparse.Internal.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\ga.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\identity_proxy\win10\identity_helper.Sparse.Canary.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\msedge_pwa_launcher.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Trust Protection Lists\Sigma\LICENSE C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\dxil.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\fil.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Locales\nn.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_km.dll C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\VisualElements\Logo.png C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\VisualElements\SmallLogo.png C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\mk.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\ms.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\zh-CN.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\identity_proxy\win11\identity_helper.Sparse.Stable.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_ka.dll C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_ca-Es-VALENCIA.dll C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Trust Protection Lists\Mu\Content C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\vi.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\identity_proxy\win11\identity_helper.Sparse.Internal.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\WidevineCdm\manifest.json C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Trust Protection Lists\Sigma\Fingerprinting C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_gu.dll C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Trust Protection Lists\Sigma\Advertising C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\or.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\sr-Latn-RS.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\sr.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\MEIPreload\manifest.json C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Trust Protection Lists\Mu\Cryptomining C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\ur.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\identity_proxy\win11\identity_helper.Sparse.Internal.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\sr-Latn-RS.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_it.dll C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Locales\bg.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Locales\da.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Locales\es.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Locales\ms.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Extensions\external_extensions.json C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\mojo_core.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\onramp.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source3396_540880020\msedge_7z.data C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Trust Protection Lists\Mu\Entities C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\eu.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Locales\cs.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_ta.dll C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\lo.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\PdfPreview\PdfPreviewHandler.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\resources.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\vccorlib140.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\augloop_client.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files\MsEdgeCrashpad\metadata C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Locales\lo.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.67\Locales\am.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\lastrun = "0" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\MicrosoftEdgeUpdateOnDemand.exe\"" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\MICROSOFTEDGEUPDATE.EXE C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ELEVATION C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VersionIndependentProgID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\CurVer\ = "MicrosoftEdgeUpdate.Update3COMClassService.1.0" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D22D5B4-96F3-4061-8EE5-72D35A140205}\InprocHandler32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D22D5B4-96F3-4061-8EE5-72D35A140205}\InprocHandler32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\CLSID\ = "{08D832B9-D2FD-481F-98CF-904D00DF63CC}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\PROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\PROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\PROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4620 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\mixamo_converter\Mixamo_Converter.exe C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe
PID 4620 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\mixamo_converter\Mixamo_Converter.exe C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe
PID 4620 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\mixamo_converter\Mixamo_Converter.exe C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe
PID 3956 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe
PID 3956 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe
PID 3956 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe
PID 2044 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2044 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2044 wrote to memory of 4108 N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2044 wrote to memory of 3496 N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2044 wrote to memory of 3496 N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2044 wrote to memory of 3496 N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3496 wrote to memory of 3084 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 3496 wrote to memory of 3084 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 3496 wrote to memory of 1348 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 3496 wrote to memory of 1348 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 3496 wrote to memory of 632 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 3496 wrote to memory of 632 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 2044 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2044 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2044 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2044 wrote to memory of 1700 N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2044 wrote to memory of 1700 N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2044 wrote to memory of 1700 N/A C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 660 wrote to memory of 1324 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 660 wrote to memory of 1324 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 660 wrote to memory of 1324 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 660 wrote to memory of 1864 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\MicrosoftEdge_X64_125.0.2535.67.exe
PID 660 wrote to memory of 1864 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\MicrosoftEdge_X64_125.0.2535.67.exe
PID 1864 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\MicrosoftEdge_X64_125.0.2535.67.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe
PID 1864 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\MicrosoftEdge_X64_125.0.2535.67.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe
PID 3396 wrote to memory of 2536 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe
PID 3396 wrote to memory of 2536 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe
PID 660 wrote to memory of 1632 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 660 wrote to memory of 1632 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 660 wrote to memory of 1632 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Processes

C:\Users\Admin\AppData\Local\Temp\mixamo_converter\Mixamo_Converter.exe

"C:\Users\Admin\AppData\Local\Temp\mixamo_converter\Mixamo_Converter.exe"

C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe

"C:\Users\Admin\AppData\Local\Temp\mixamo_converter\redist\MicrosoftEdgeWebview2Setup.exe"

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTUuNzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNTUuNzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTYxMUQ0QTctQkI5RS00QkJFLTlBNzctQTY0RTZDMjk0NDk3fSIgdXNlcmlkPSJ7NUFCQUYyRkUtOUZDMC00NTgzLTlDOUYtMjI0MkE1MzM1NjYyfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0JBMTdFNjA3LTk3NkItNDIzNC05QUMzLUU3MTZCODAwRTNEQ30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4NS4yOSIgbmV4dHZlcnNpb249IjEuMy4xNTUuNzciIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNjEwIi8-PC9hcHA-PC9yZXF1ZXN0Pg

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{9611D4A7-BB9E-4BBE-9A77-A64E6C294497}"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTUuNzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNTUuNzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTYxMUQ0QTctQkI5RS00QkJFLTlBNzctQTY0RTZDMjk0NDk3fSIgdXNlcmlkPSJ7NUFCQUYyRkUtOUZDMC00NTgzLTlDOUYtMjI0MkE1MzM1NjYyfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0FGQ0ZEOENBLTk3NjEtNDlFNy05MUJDLThFNTkyQjJBODREM30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMzEiIGluc3RhbGxkYXRlPSItNCIgaW5zdGFsbGRhdGV0aW1lPSIxNzE0MTM1OTIxIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iNSIvPjwvYXBwPjwvcmVxdWVzdD4

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\MicrosoftEdge_X64_125.0.2535.67.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\MicrosoftEdge_X64_125.0.2535.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\MicrosoftEdge_X64_125.0.2535.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B38AD1C9-5551-49AE-9917-9F8E4D238C83}\EDGEMITMP_FF930.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.67 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff77d154b18,0x7ff77d154b24,0x7ff77d154b30

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTUuNzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNTUuNzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTYxMUQ0QTctQkI5RS00QkJFLTlBNzctQTY0RTZDMjk0NDk3fSIgdXNlcmlkPSJ7NUFCQUYyRkUtOUZDMC00NTgzLTlDOUYtMjI0MkE1MzM1NjYyfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezgwNDMzQUVELUJBODktNEZDNi04RjdELUU5NzE3QTgwOUJDOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI1LjAuMjUzNS42NyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wNzA4ZTc3MC01MWEwLTRkMDAtYTJmMy1kNzM2ZGI4NTg2ZTc_UDE9MTcxNzQ0MzQ4NiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1Rbjh5RGRCZFZvMGpnSVBrUk85QUkzVkJpUlFyUW5ZJTJmWHIzTiUyZjBiaTNtQldjeW9JY0lZemQzNjZOdEQycDBreWlPWklyeFJYYnR1M1RrRXhCb3RjUlElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGRvd25sb2FkZWQ9IjE3MzgwODU5MiIgdG90YWw9IjE3MzgwODU5MiIgZG93bmxvYWRfdGltZV9tcz0iODMxMTciLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjEwMzIiIGRvd25sb2FkX3RpbWVfbXM9Ijg5Mzk4IiBkb3dubG9hZGVkPSIxNzM4MDg1OTIiIHRvdGFsPSIxNzM4MDg1OTIiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ0NzE0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg

Network

Country Destination Domain Proto
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 msedge.api.cdp.microsoft.com udp
US 20.114.58.89:443 msedge.api.cdp.microsoft.com tcp
US 8.8.8.8:53 89.58.114.20.in-addr.arpa udp
US 8.8.8.8:53 msedge.f.tlu.dl.delivery.mp.microsoft.com udp
US 199.232.210.172:80 msedge.f.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/4620-0-0x00000000752BE000-0x00000000752BF000-memory.dmp

memory/4620-1-0x0000000000920000-0x0000000000C06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Costura\A8B9A660CFA6587BAC554743F880F697\32\webview2loader.dll

MD5 e2a10346ba7b74f8c79afc419ed470d5
SHA1 3ced830ffa621ce122169433b224c3df7fed0f3f
SHA256 79885ef79591964477c09afd51c4f1981a4904601c23247975b9f84cb5d7b84b
SHA512 da58cba7be5bd12048cdd4f31d2835b8db5bbe93ea178941ff1af4cd6712175a0aab2945415d016648399838d80e6e33215d12a25867a4b0102356230ba22803

C:\Users\Admin\AppData\Local\Temp\Costura\A8B9A660CFA6587BAC554743F880F697\32\newtonsoft.json.dll

MD5 081d9558bbb7adce142da153b2d5577a
SHA1 7d0ad03fbda1c24f883116b940717e596073ae96
SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
SHA512 2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

memory/4620-11-0x0000000005E10000-0x00000000063B4000-memory.dmp

memory/4620-12-0x0000000005900000-0x0000000005992000-memory.dmp

memory/4620-13-0x0000000005AA0000-0x0000000005AAA000-memory.dmp

memory/4620-15-0x0000000005B50000-0x0000000005B80000-memory.dmp

memory/4620-14-0x00000000752B0000-0x0000000075A60000-memory.dmp

memory/4620-17-0x00000000752B0000-0x0000000075A60000-memory.dmp

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdate.exe

MD5 0032498af2ebc50357cb31f1024c87fb
SHA1 9818522c47ec379ff7bddf92ea72cd831691d094
SHA256 c6bdf041b02561700c71c6275df4704a52d1fed4ba6a1bec98a602c6c325d6e7
SHA512 f83fc43ca54e87a67d949666ca8c30721f372312042be978b01dcdccd530ce5db4d3d9d6ddc934a92c079825b91fd988f362cd481dd87fa09ddf2cfac85c05c3

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdate.dll

MD5 00670be258aacf4ca0c01ca980e96354
SHA1 4ed09d74b4eb0cb5b95ab37e341025fb7081287c
SHA256 0cb9d6c4fd45a3ba0f8e8c450e90beeee40e57b092906b841805fd3a24da4402
SHA512 79a8e1c944d7e38087668db4052f604b4aabd605f7628e2b2fab8526a8001152b2b9e2e6d15f41e701df24e2e44077b0561b88f64de01ac5366a4d9e696cede1

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_en.dll

MD5 c4e594d01bdcefcb1b71f06697e13c89
SHA1 26a90b0912332fde26451e2efbbed6bd8c4bd02c
SHA256 a1be434cb4d92a01fa3b43c1967f254be29dcaa25ceeb6cb13fed711f90b81ff
SHA512 1d0a1cfc7c8e10bc6b2cc9dcf6db0e204877439fa4cde26e6b1464cedb35676e67416956ca1b2873a10f0ab00a6049d000097c254ede77b06b1f329c34f17d0c

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_bn-IN.dll

MD5 583c93b26e5dcd4bab07f7d303ebf5c3
SHA1 439e6d4762c2a3593512ff103a8ff32110fd0da3
SHA256 c0bb2e9167995db0d8f1f69a202ba00529e2ead8daeb29fcb99d42b0613efb2f
SHA512 aafbc518e596969d20327a2b860b63013b1d5bb7c89faacff0ba95a9f6bb160dffd5a0058475ec1ba2c5d07cfd8cd4a0cffe4bb89bd4bb74b3e5981d6beec414

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_ca.dll

MD5 c2cc0764c763cd30ab629173ad2c9fdd
SHA1 0e681669c04e102a4b031378b38c2645dd42bb3e
SHA256 f3b266910a5bc6f738c154cb6a754cb55df05ad7f01cd6d61cd6e0cc8927455e
SHA512 f54ac389ea62f4c4af5cfd727be094d43976c53a84a1df4313fa5c81bdd9f7038ec9b13832abda95d6f496956383708b3828f41e4b746ebf645dbc343f6568e6

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_bg.dll

MD5 9fbe7d6ef07bd3af76a9fc97dfd90e95
SHA1 300ea110b9ec0ef6c754950ff4dd59dbfc9f2b23
SHA256 fef5f9a3ac4626f756b28f6304dc5e5e50bff553930ff35d6b8429ee494b4313
SHA512 0df3f0af13d5ed4291ba179846a741149807e073c767b90ab5fd50449879429de6dd2b43954b3a52d3cc77ef4c98dc9efcd594c17784b48c97bf5bdccc90cc97

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_bs.dll

MD5 c359759bc31042b62167a40c7c0203b0
SHA1 21140ceadd92ab23835c0e7a8f2e2fb95d0ccbdf
SHA256 43fe0258ad799cae8bb20f23c20d74fbbb4b650b97b1b5b737d1d1728556d897
SHA512 1d5837ef553223ac09e93df362da460002fb4f9eccc19120c4fb8c29cd453139a3cef54e9514217ac2d862a423d7a82f3e3d9b09f00c611cb16f19dfbe90979f

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_bn.dll

MD5 fef17d66629715ae8ce4ab00464152ca
SHA1 f62db519180eaaec0d62f56bf1dabcf353583aa6
SHA256 2ee6f8216f4953f3101de9578b392e2de94d59a79d08cbdd327b3d433f2b70ee
SHA512 98b2647b3bbb2476371fbf9329fad70934bcc7e1f958e925bbfca17a7083e47a5561db986d260025c339b051f7f00bcaaff938ff351032b95075bcc589b7255c

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_az.dll

MD5 da1dd46046721726b57bab405c7b7c49
SHA1 f42267672f7112d772feee601d2add8346a0a89d
SHA256 d699ca97e2bc94f0ecc95b2ccefed201786535e7ada3fd6ccb543f42cfc273b8
SHA512 b71909c7df499a702b199b87a96d7f25fcc82a0dcbe1138e900b3f386a6204d1b95e37941f32f61a0a558ce2b514f938b0029c55da0e4955229863d8b4b40061

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_as.dll

MD5 30a0dfc5374347d838199254ef2b27e1
SHA1 739c8197c111eededbdfb8e1940e63188bd8c5be
SHA256 92cc3b354e786d428ab3bb43c77119b81a2960b00bd9d99550639a8b5c0428b6
SHA512 b8611af4595eea99fb45653f6419235368075664721c467753cedd3b71507a28e0d6c5fb2c4b3e01db56d4842c043b14e20ac1ae7c225e7d678c77befdfccd1d

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_am.dll

MD5 5b981b86b65935bae5fe5805660c7302
SHA1 1107f5a6b8bb4ed1e95f621fbb7b236d6a57e11c
SHA256 bd380d64f5b9dd6bd979a78e912f1a3d2a7c08eda3418abc85d67c43c8477264
SHA512 d00f6d92f0efa0c89ee042abcb8b583097cd173d80b8009fc9dcda98a25c73edab970d607b4993831577812335db49dd3d76dba64a4cd6adc7b57494f0f78766

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_ar.dll

MD5 5e9ba26ad6068d5b12ee2ebd74d66c03
SHA1 2081cb86bbc6e20965b147f4178990f4c9ba52e7
SHA256 6fc47a7fefb2ea88371b5e1ea84b24faaff6d4ccb503e6d9903b8301d16715e6
SHA512 ab2eb6ae054cc107b83d877fc44dd62380c4098fbb805033c1d1f87d7172384c4cb7482d1f8931ad5f5b7dd181f6239748497e4b5866c2f406c310c6837028c4

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_af.dll

MD5 0d8ca15cd08112472d8f725b9d26f400
SHA1 6082361001436a4d2c45babb755601a19bc58a10
SHA256 a36ec679129d8fa6e3f56b37c88e7d3406bb4d6d74e559e5a272ac8f34a812f4
SHA512 8ec03222c8a023fba580a309a487e4d9535cded212ce47aaf3d7f4cda250c99ce25417330e0508b0a306e0ba14f9451cda0a31c550fdf0ec92c192792af1e23b

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\EdgeUpdate.dat

MD5 369bbc37cff290adb8963dc5e518b9b8
SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\NOTICE.TXT

MD5 6dd5bf0743f2366a0bdd37e302783bcd
SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeComRegisterShellARM64.exe

MD5 cf9a26b458293978a908536927ec327d
SHA1 e8b293e3799f352921c7f430648c21f79e47b052
SHA256 4faa7cd71e234433f684c3d70efbfb1ada8d4172fc55caf78c0705e5646b0ba9
SHA512 54447d830595fd5e4cb8ff60e78916b676f983033397932fc0ff402cc310771d9e448cebdb1bcae6e0dd3d90c8968df01171ac52a1e14a36eda950f67909e714

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

MD5 cbb1acbff5a8ce79804e687be8e3e75e
SHA1 0bb50f813e08ff13d637a8f4ee66e4c0f1fb01ca
SHA256 6d483505a0c9fd508ef48323099e2c64fce025e4b018df1d80d60aa00d8fb004
SHA512 7f4a8df19f94c74b1898109804f4ec596abe32ff59d35279e58b139cf3210f6faa2697eca422435a193f4f2f90535187fcd233a018a54a0cfc426ced25de5ce8

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\MicrosoftEdgeUpdateCore.exe

MD5 f70b0fc2f46f5e7082817a11c39e3c54
SHA1 9939591b236bdd16ea02e79eb11a2d6fefe2af44
SHA256 f6e636cfe7c53c120d834756f52ab407f1c5dc97c27a14e557f24c176e86d87f
SHA512 b8bde38507eb84725aad9b7ffa33eae462fe6c7779f7ba650453b10bc9b52128198c4e29a568b0ba865fe266c19af81efc3f62a7ffd68e38e9d403d71b1afd79

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

MD5 5928df4290e3b6e8676a5aac6ddbbc31
SHA1 d83b71bc4b37c3b228b113239506f89761a55f7b
SHA256 ac5f350f4dc790f61135186c113bb2b8a78f26dab322ddb86b0e3403ab960721
SHA512 90113cfe50355d6df04382ee69db6ddad1651e771d0182e28d0d3de3d1d5a2f10d22d5de2b54e12bff1fa5d478513c881e9cfceb2b471746fa870516aa3d0e69

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_es.dll

MD5 0444405f398facffb9ac93c90bd61a80
SHA1 1fe865393a4a9967966ed4310f342280b6c9487c
SHA256 83a11402bb26ef3a58c1bdf550a34faf76758a8a84b423a6f0a94a9692fb584b
SHA512 a5df3e52a4169acb1c89b060e09fe5e6c18fdbd0c597c8b55e843895dc8433f5804613dfd2f4a16d656593effe62a8821742b6226abaffe9c2480b9b9da0de25

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_fa.dll

MD5 8ac4c8e4072943915105e358f3b53193
SHA1 0badce4b142c3ee14ac906bf6be7d19f4af46641
SHA256 abe601ab7930302cd675f3ad1582b9fea3837166e74f23f24765eabb7ae86d1f
SHA512 267795330e1b10e29d4a7e54af14f3f621a612eb9b2bbd336cb2eec3e4feee29baa9e87c08136cafda891a3729aec4669cf55684d27f950695195bc20ee752ef

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_fr.dll

MD5 5b460959d67d7c7dee8966c7593e2d9e
SHA1 bd4e1eb217d319f9367a3134d488eb57ef7456f4
SHA256 7c8218e882f0b19291f8088fc1a0e9d8f793465b80b84c282558e19ee349efd1
SHA512 c15c161b1cf16e8549675523ab2ba5086e5e090cf7a837f2aef6bbcce201505f9ff2478c774261ddb9f8ff563f8fb41dec0c6d8eee43841ea1fa0455e9b11136

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_fil.dll

MD5 c020597034e8e3f1a06744195ac08468
SHA1 67a9485915cfbac21d4ca172f685448e89bde928
SHA256 6ee5908725a1780779a72022a1e0d9bca32a2f027907e7ec1b12a964221dfb96
SHA512 d8ee3eb3f810b35dac344828cb920fe5fd0a1c8a17ee72b5a9b7e253b054b7bb43b65d2f1fc4232aac4364597c6fe8cce68e9f2867038661b1421343234a4824

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_fi.dll

MD5 0b6513b1eeb7193ec6561ee4c82f0315
SHA1 fb5a8b42698aa4250179e5070422fd8adbfa9e6e
SHA256 46c2c90780924935d4213ece24151f07e63d6c1dca4d99ac0542967a56ee9f03
SHA512 37dbba2e969534dea488a64aed6b9a3e2ccb079b36865dd00f5e60f87699f60e7626ff85861aef2d52398fd95cda1637e39a47e037e26dd6feb26268fbc40ad6

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_eu.dll

MD5 b12325fe45848101245c164385c62205
SHA1 a3c8d6938978c30c23534515bcdf45bb27eba40b
SHA256 0fad2dc2ec7c313cace9afac3e645ed0b0d34df468a6f51450b15ab71793c3c4
SHA512 1f5e63aa4061f9b1ea9f7fd3e092d8d978df6c34416e4139f7a7eacf8976ef8a5dc1b89a69e276e6e02d7b15f4ab50a2b958c98585563cd51a582561f1f6ad93

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_et.dll

MD5 657c0184668515f256a8011c162f0bc1
SHA1 ef56129d4edaffd59342ac2e94be2c570f44d23b
SHA256 453597b38cb5e06b4596d8ad3763b08cbcd806fbcab0228179b40c065a7523fa
SHA512 9340c5eebab4376b7fafd32985ce625f808311ab58d028c246095804c8022bf6e7e7dbc366974e5b80bb4117558ec566c1d40839ae451277d97cf8626693b223

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_el.dll

MD5 62a99787a2c037f72588c10af0a4f97b
SHA1 376981b7ab0da3a63dd324fb679046c1e2fa2542
SHA256 b2b41c07abdc47d8670ae0f0c109450de99e95888cc2a1589bb526ab5c6204dd
SHA512 23c9eae2398adc8ebd15ae8067d528650612d2ed7afc3378bf7bf86453139ae1ec77283f15c1872f553e9461cfef4a5b0b4e7111b86124f628f19ab1e4cf6251

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_de.dll

MD5 24068ddcee174136374b56b4148678af
SHA1 604ed94670081d22a50436076d813f3f09d71e10
SHA256 8480fd2d3c59530bcb1fa9a07de57f354d4222155d928d1784cad51dce9e30e2
SHA512 f8969cd5d3d34c2b1b1be9cc62d5e33cd7798ceced2ecb173c4c01fea3fdf72eac91bb533a7b2ccee6fcae5ae00c56c5f945de70c003ff30838c62a211a837fc

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_da.dll

MD5 764d47b36dc060e15414e850c974b983
SHA1 4cd0ef1c6a951c50844e441a3673de505aa38004
SHA256 3fa89372d50cee57a316e279bb092287fad67ec1f47cc8f75178a985f43b5cd8
SHA512 9017d3ddc85a919fd1ad5ae182c2e4f1194eeadea98f185a158b5c424b7730f30f10b18ca902cbbbc83d6567033d79327c7b1efa89d36b55b9066a8785530984

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_cy.dll

MD5 909c5c6afa14ee9756a4291077f2359b
SHA1 819e5e4f3197a6f45b5ce461ebda5b8dcf5a9a8f
SHA256 7b0b45ab3f199a316d33be841867e0e5219db63174efb5e6d9866816a3faf770
SHA512 a7b75854111e769dbfc0fef86e6561aff12b883c34cd91d15a2f209c68d76412670e9ca732ca159bab42176a4c3f1d9707f8e9db5e21143c15d13eafa1381d54

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_cs.dll

MD5 ebe48b47180b491688ec519a8d9bef73
SHA1 bd98b11dbaef493968d999c22e2e35fdadcc51b2
SHA256 02aae7715ad305977f316b9c80989ec63371c4c3e813b64252fe5f92143201d3
SHA512 7b2b7204505d73ce66ad070bd31a7790dc56ef071bd233b7be3eb1ecf82a9cc30a605c0524c707d10a9828849de69a7169f8af5b7ea1c4da797deba89bcafc20

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_es-419.dll

MD5 a3a5c7c28cdbe9ff4df338f6f9718944
SHA1 4c73b46b2076a16f8b21257865ce8b3d9ca94263
SHA256 c2eda53aad3225b73496c9eec5f933d902dc9a3e7c90530f77b5bbfa269ae09a
SHA512 1db7979e99b207f7c31a5db1cdcb76f6738c622c9c9146ae07a232c40f3dd2232f031c295d802bd3472006cd384ae7739ad6afd47fc31984b2101c6a2a0ecf8e

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_ga.dll

MD5 807d3b85c91a3a78d857724f6d4df8f5
SHA1 64fccdca9e003186890c336dc5667455b8055c71
SHA256 2a00e20da2ce93516d077fb52db7149b162e5a6b9fbc4b8f7ad442d3e51d3c8c
SHA512 66ce1ce09d055676c919f36e31d944e7c4d5bcae0b6343d22b6fd8880602b326f9fa610e7e120daddc99fafa5c8a1818d428fdc6fd206f755e81a56f73b463d0

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_gd.dll

MD5 0cb26946b22b67acbd2348d25baf1f11
SHA1 9b74999efbe944089ef779d04d92579b82b4683f
SHA256 fe58df1b17fde8184475607bbb4367911c1ca9fdac79f256c001eaed0acb6b0a
SHA512 87e9cda95c6cad7f6efcf71068e9ac6c4e73858062079d4d264e7bd2f1e4126948e0d2ab57c9be7ff9f21fa59eeacab477bb455ab06f547aa3c5270fe1192b66

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_hi.dll

MD5 8088a0a302b58718eacc92fb787c74f4
SHA1 61dbe98e235723d82d7daacfbf3b0512976798e6
SHA256 bf81c79c7a6f20e7c5d28d4384129d9d5a61c1df5fcf1e249802e3c979c9d7c0
SHA512 41877350e92d46792f78984158557ef3cf78b7def79eb3b917e896e30c7865591406bd0245dc12220275bf4977aa25352e77eec037c46aa713e01a36d070ecfb

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_ka.dll

MD5 df96e9023cdb8cb827703e1fb9c592de
SHA1 eda83f777bc404c3bcc0c3eb7a12d5561238ac28
SHA256 415ab15b6a48176f3bcd09672de89ecd39684a482c9ee0d45bce366fb3450d43
SHA512 23698883a68259ffb36dd932f6b74a2257e8499336a66a41fe0b2a98d6e866a90f4e071f5d41a3942d3e4884a6dd7488b458879f8379fdeb4676edf593226e43

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_ja.dll

MD5 02ef894b4b4b6d8c071fffff05f810ec
SHA1 4c36f9c8a4f5e22726f87402826b69cd29087a9f
SHA256 d0b824b90377e1912c349923d3cfc63018bf96f96ad6a46b0fabf5897fb248cc
SHA512 99dc3dbb5eded5cb369fa080bb03299e816a51d541069d93982b85f68bd1ff116483d51339d530cc475015510e9186d9794aae0caa389cbc97a63cea2e39dcac

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_kk.dll

MD5 9022a388f56e7f59270dbd0ec1e36583
SHA1 9a3103a02938bf873e0398c404b3b6efb27f60d5
SHA256 2e54385d95fcbfd998d5d83ac408c0a45af2329930678bc822544a46fd7390fa
SHA512 68455fd649d03927eb484b515838c2c5fb24eb8ae1adec80e60f83c5e150bf701b9adb43972e5a9050603af68cdbded152150c5dda5d90b04e2a942d053a7c62

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_ko.dll

MD5 7a79d9fb7cb385c79c5cd7fee302d9d2
SHA1 0c2ec8d27c8faaed1a184929e92dccd1182b0e32
SHA256 9463457928689d87aa7a52cf5a205bb8bc67c0f94eeeed681715125582cbc2df
SHA512 224a3a960577afdbe47bfb42fa6059314ae16cf26686421603d1276bfa3bdcf58a9a26fc6dca298f9ff2f6e190a3008edf8a614d28cc354a8bc253b65b180d95

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_lo.dll

MD5 20125fa0aa6057fe9483195d98b53b6a
SHA1 b90a5dcd8e65be58c4c8d6276aa1364f4d0d7e1d
SHA256 a909ffd028323697edc04d824a9de5e4e69f26fb6c8e9c11b0e311bf5b940d17
SHA512 460c0ebb18336391c25a60e99ea0927b36833ca2c91de6fc9cf3f32ac90e7e45527d95f668c03a859d91024ae7ae5372719ebba2e2c7745091b768407e2e4f9b

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_lb.dll

MD5 7e830cc3d425a9d58f47b67f0c0284eb
SHA1 e7535444087b1c43f2414385bf77a59afd4ffb28
SHA256 3a99e182cfbae7e5909a7b35408db26ca16d987aeb5f068d0961933a5a4a7a5d
SHA512 90995fcb27bd58b9c0d6b08418eb66405ff5287ab9a4b27d08a5183efb54828fd3a9acbabb7aa146a6eb0cfb0c9aa5ce9f32451a35a9e0f5064850cc305f5dc3

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_kok.dll

MD5 ec003a7505d58aa0ec231415267c97ef
SHA1 43f4ce1a7c859b571042f2f23cc6a758ed806c95
SHA256 eb324b717e98ab6f47eaa65a7ba9e0e7ef9c7563fd05613ec149eab121edf86f
SHA512 20f61759938ed69df7b40628587915dea21e2ded3c9901ca9334b6add5f21995afd8d90ce7e290b6b51b9418395f526acca90f8071b6564f85a08d1253031bfc

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_kn.dll

MD5 5ff19e69a260367c9f4e667d283da5d7
SHA1 e54c111fb7a02baadec488c358297a877aaeccd3
SHA256 c5fe72e4bf6ec76ba7f4d14374a2b15873de9a5815227ffb303a0b165dfe790e
SHA512 17a4f5a6e927146dfb3690d8e5cae29bb898299953734b1c1d8391c38106dfa96dca0246dff83b2bfabf9840661828fa7131df74a69b1ccd1470ce01f07fb99f

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_km.dll

MD5 a351a85e384b65bb7b5260eda1aac709
SHA1 9446d97d7d32deef18a9e1c62167747aa316fb35
SHA256 48423fa045bd50175e297cd0642335aafa57d16ce4eaba59734f12f88d2d526d
SHA512 0dab0dd012c53426feb07ba55dac3d8fbb718e1146b8cc495278b3a432277ecb454d181f48013cc86ee9e26d722c5e070d418a0dc86f9594e0c9a017126ccd94

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_iw.dll

MD5 0ec86b4b2f37b6d19b7f884852730da0
SHA1 d39e6b0e1fda1e26b873ca635266b87bf41667fa
SHA256 637178fef36bcca7ac50b10091731d86d0b73892d60b98531d21614fed28dc30
SHA512 f49f9db37fbc1c47bf614ef391205a1a7da29045dec4f15ecfe38472c62264e5d107181d55b27f471b626fae7b6328ce05e8e60bc61ede271fc4c47804c0a4eb

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_it.dll

MD5 cdd173c3f540c2fa198c84657804d969
SHA1 2278b71961c16c366760c972467d57e11354eb22
SHA256 c381989587679bd6e6b90632bfe57c20c987127fe5743dea3ef278745faaaff7
SHA512 01fc2e45183932c5b3029f3ee625d6c5fc4449f5f7cff11a963aeaa241fa2a510ba455dc4a408a9a0b0b0f127407983395545d0f8875d9a13ef1f368ddbd15f3

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_is.dll

MD5 74d1be37b419bc050be7107d5320b8fe
SHA1 98d9868042a4671b0a9f5abc17289ce42a685077
SHA256 5a379b8d3b188c8f321c4f58c9589a1e8e53dddfadd493fbea84bd14532d8c4e
SHA512 e26e0c72b14b835abdecc0185eb4a0c664ab749ab75b178fae687538bfa6607896674900403ce38e5aa594f6e78f1c4bc3c61db49a568fc89c0242c8605af62a

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_id.dll

MD5 41ac4e817c88a1fc008a43e25c4d71a3
SHA1 ffce205ffb01a54f96b0191b7c15dc3cd769e337
SHA256 d4009d52a419b3870036dac6f40202f3670530d574829ad55616d7a00808d9d3
SHA512 4d867b4ef9f33d93b67497ab52b826a31c130bb385734a5fc6278aa3b93346cf148713b36fb2eaa0b8f1196109b7975c45cf40ae3a69c1f109a9da2e42d3e0d8

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_hu.dll

MD5 2f8083b85f9c4f588cb8843e21077198
SHA1 b21d1cdfaaa7b93064659614b3f27c8b4d5ce5ae
SHA256 9de51be04b9b01664132c174bc2567fb2fe15ee4b74a6e68c2c7e8c8808ab184
SHA512 296a6ce20a253c7e77ce94dbf46ec96b305df153915f96e338df21fc140bedcb9d4ba29b7faaf280a0dc607a870ee96254de9dc469c071c90fdd8c499ee8ef5b

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_gl.dll

MD5 0a3eea473ed114af963258dfeac97381
SHA1 55fd6a61fb35eea2a34a831448b4f3a9b7d1fde2
SHA256 7ce39b48849e3e33e78e9a39cc84665c33677ad248de27680c67305b4e6fa87d
SHA512 8849621aa87728b0fcca0aed5e598019630f91b609214c043d9e7eaec53a39bd95c8cd77e7eb5382ec8231df5f4742a7f59e031d8efb4643ebb4f27bccba0cab

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_hr.dll

MD5 af2042a5338884a7b07ac78fb14091c8
SHA1 99c545e0ebbfb382918955519f88fc1a68aba125
SHA256 31143a690e4c51859e18b4f9221468042e705817d52170ada0dc1d508c455cb7
SHA512 5b00c5730c0233c196043b05ab4462c79b30d181ae7cdafe18713be881e09538b4f58cfa5c0a8c17f31a1b9459100dea3ae1adbee42d77f407b94fb25ed4575a

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_gu.dll

MD5 d75d2279ebc522f7b88d8e388b55a6bd
SHA1 ae532f5cf3630fd164458ee2b9178805c93064d9
SHA256 dc9e53b4d5b7cc6ea74effe897b6958b5991ddfbc60baf3ff5af74fc71fc138b
SHA512 741fb93967b31091905df55899c33303e80b1273187e296a10e4b85d7f93f53bca55e3f76ef5031d63716615e4c258b11efe19355874cda3624db39b0770039a

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_fr-CA.dll

MD5 4df8d16f45846075e652ca9b701faaff
SHA1 a605eaa6cf9fd4ff2e46aae331d48cbda1e50102
SHA256 03d31c89ff1512a0671390151d0f30015fa445ba45364cbc4dd6fcef07198d37
SHA512 3ef64490fce1702632557a7ddc24363620ca272e8b61e48c1f2b74374db83b52a59f156cdb019e0205d0d6096ec9fd73a15183eed2e3e0b8d8acc9b96e3e0690

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_en-GB.dll

MD5 8816264aa944a8f17e3080af13badfe5
SHA1 a200bdac7ddd6e52dff02530bdb6bcaa7c0ec271
SHA256 6d059098bdc372b4cf14b3bde4832ff2c68e4012fe5bf6bfdc08a39c5f746178
SHA512 89eb5ce3df70977d257f8524df8fa3f3f45432e7d9000db371f228f0d574b7dd844682eda7cd8a511d44bcfc4731dfad053db86ad5570abbb6d9a7db103e9bfa

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_lt.dll

MD5 91c5d6031932f5d0cfb2778d08d6f63c
SHA1 9ae092d7b0b189eb24a2d4282f6598577a39eace
SHA256 afae45e481b705702da9b8c6b1cc32aef6e1c5df3a876dc8ad8b75fbca8a16ef
SHA512 aeb8675a78a48069224d0ce13ef69d2211b96d6e9c7fe75d0560bce03091ef9efdfb085cc616097072dd952e605e73e2493d6b38b03e01e7f8e85987b0e680b6

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_lv.dll

MD5 47de5673add4c9043d0890e27afb273e
SHA1 efddeede2791e5ab1e57c3afd4399b0a439b7497
SHA256 6d3918c43a0eee94053e38c9b45dbf572af62ebd076c1317a5af8db10868ee34
SHA512 0a61f73b67aee5f980dedf14bad2df4cde19d0cbee83c76932a3936e5d2a9b66c131bb367d74e030ca453a4772d2beb5f72e79f6f3c0bfb9cc4856c3ba26de4a

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_mk.dll

MD5 56ad0075951eb0e86c590270e4705bcd
SHA1 d9700d6916b67ce17580b1f4352e2f1d8b3c7847
SHA256 80d6ef7486242fd3c32edaf0873d33bde6760211bb7250b8c2fd10bca7bf48fd
SHA512 4c3631d0a5ec92429227d0c1368eb3d62563dea99987cfb1becb5adabd957a73fc31d8d9d2ce1e47c02c516f5b59e4168c00f83037630bd554ad0db61d5cbba2

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_ml.dll

MD5 c593e9b76e715577aaf0bcdfb95851b3
SHA1 ddc41ffd24dda7963616aa9ab1e01147734c0556
SHA256 8c38ed4b49392aebc5b2ccfaa539cc12a58f63ea978beb1fdc95a99ab96eb1d6
SHA512 f5b7d40fea7db346125f22030189ab22d4abf85de38db0045c803a32b4e8cd65288d757bf8fb321d49df83c783662d7b10a89dceea2ae5504c161662fa2fd366

C:\Program Files (x86)\Microsoft\Temp\EU5B3F.tmp\msedgeupdateres_mi.dll

MD5 041dae466e6b239074777761a0367443
SHA1 6c24a6998ebec33166eafbe96a48b35eba37b687
SHA256 e223da37b28d7f5a810c5bec7c4f75ca510543da39149c29d46186a262ac7dee
SHA512 2a065e8ac98745975fae07c59458beb00538241ae6db4d6fb4ea060534be34d9cf4aca7a693201c966af08153b4933997c38ed365165ad8822e8284d4e21152a

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

MD5 54ecce8a0a4541af0c6ca682650df2f5
SHA1 61706fc5b5014af8909a6e626c2959910b9b89eb
SHA256 83e2e4fa4d03072cab48dc80b9699a1649d3334cbfbcb5e2955d74c3f72b5f0d
SHA512 eff54f206b7e7d797e5f02631b712169f754a7c619c6a2bf55a725d53dbf969d5f6de158445141300b05e3afc4dc7a0c0025369f42ffe3a99baa649cf76e5b40

memory/2044-208-0x0000000000E00000-0x0000000000E37000-memory.dmp

memory/2044-209-0x00000000757F0000-0x0000000075A68000-memory.dmp

memory/2044-213-0x00000000757F0000-0x0000000075A68000-memory.dmp

C:\Program Files\MsEdgeCrashpad\settings.dat

MD5 3b0c95630574be78dcf916aa9e3c9c3d
SHA1 7e63fd118665988377266ca660feb740b171cfde
SHA256 e0b44be73436a071dd37bf09948c35a56b030783126e0d99be27d53257362025
SHA512 f5554a82dccca5e9cf585a9d0904dcfb571db07f505ac62279f83b0fa1049286ed993627022c33e674e534ea5dadf688a73686151aa72668a6b5f5e992173e33

C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.67\Installer\setup.exe

MD5 6aafb8c6ce355a80514a2f3abc13a9ad
SHA1 2db9a7dde9086dd415ee41b4b109a3311f088c8c
SHA256 adbd1a10981cccd00918d924ec93a9d6f29d16190691f6984b199f9a42cc0cb6
SHA512 c9f23c68b7385d8edfdbff7b80a6064ac8eb879384796e7f54b094155feb32a86836c4a910c323128a4a6b3b15b7fbe1a9b0b56153ff0e71c96dce7776b0f848

memory/2044-276-0x0000000000E00000-0x0000000000E37000-memory.dmp