Malware Analysis Report

2024-07-28 11:03

Sample ID 240613-s2jbdayerl
Target e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d
SHA256 e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d
Tags
upx oss_ak discovery evasion persistence trojan
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d

Threat Level: Likely malicious

The file e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d was found to be: Likely malicious.

Malicious Activity Summary

upx oss_ak discovery evasion persistence trojan

detect oss ak

Sets file execution options in registry

Downloads MZ/PE file

Loads dropped DLL

Checks computer location settings

UPX packed file

Executes dropped EXE

Registers COM server for autorun

Checks installed software on the system

Checks whether UAC is enabled

Checks system information in the registry

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

System policy modification

Modifies registry class

Modifies data under HKEY_USERS

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Subvert Trust Controls
T1553
Install Root Certificate
T1553.004
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 15:37

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 15:37

Reported

2024-06-13 15:39

Platform

win7-20240508-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe"

Signatures

detect oss ak

oss_ak
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe

"C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 gitee.com udp
US 8.8.8.8:53 demo.tidesec.com udp

Files

memory/2064-0-0x0000000001020000-0x0000000004047000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\SMTP-user.txt

MD5 1bd45dc5fcd63654825aa693e0407326
SHA1 3a4567c70aba378d04bc4eff545c28ddc82fb5c4
SHA256 0ceaf90a3e635efcd84c5b45e7586db66136a9f4511cd4aea2072580667fbc25
SHA512 e20f89b18f88df404b63172f6bda7a03b8e63f47542ba09ba98e8255d84e3b68a8a03bcb67fdd4ace7833a786eb2ee1c896c946116aa893e95fb24306e36b6bf

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\Elasticsearch-pass.txt

MD5 c78d86e3ec6038f3e1ab6a7d0f4c449a
SHA1 6a0ac926e48e1947c5456fef1038c8c5328abb66
SHA256 6c09e4ebabb5b0752d17630700784aa637bd1db0e7d4540a1582bb93b36122fd
SHA512 907423e3a3990e53ce88cee61f45f8bc00c9c7684fedf1c5c25a63a2d57bf34f0a64abbb5b5f2849a99646912a64d7c7b4474b67bb26859a8fa680c928f5ffde

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\Webdav-pass.txt

MD5 4cf29adaad3ef5aeae5ae8113bb703d7
SHA1 e6f01ad6ee1c541a2c54897dce4afff3711f8d41
SHA256 fb5831d6c6b82ec8ae328aefc6a1af4e60427b541463190f97d9bd92ecd1b8f3
SHA512 d15ba884536294e8b720cf735a3edce7bc1583279969e2d160e8cf02e230e2caad6f1cc68cced4748af361b21aef995f57f1ddfdc5d75cc4fce4e9c14b30f2b2

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\RouterOS-user.txt

MD5 fb8a9623fd5b1d8c31228677d7b1aaa6
SHA1 8ae061dbdb1df384dcfb5a06684c0c6a9c361df6
SHA256 b73c856da26ebcc11a6325b6279190e36949766c7e02f95628e5a80c61b6d79d
SHA512 a05086e85ede707f89f8be9099175e011ecfef9fbc1a960d0a98f141476fb45ba6a71d500a1e988ef4712f65e31b2554bc8ff41e65ea83a147d5fa7300e3b9cc

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\Redis-user.txt

MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\POP3-pass.txt

MD5 5441e5159032a9a8c26448cc454b2370
SHA1 aa0f8c8ccbf13c489f3ef15afaedef8a469c0d71
SHA256 8f533fab5b00e5d5d41e135311c7bb0560dce9b7814daab23b11fd727ec6a235
SHA512 35bc6d0a5c518a5851d07369c67e6b755e559951a6fa7146f508c17615639d06ce2e60d714c968e1d933ead63063f48dbf0c0cd96a13ee62597fdc6fc246533e

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\LDAPS-pass.txt

MD5 d73991d50902727a3a89717188d8b82c
SHA1 7a9d18d4b8a1e11d11366ff221126cce27407490
SHA256 aa7f59e2247e8d87c8a534a3b911e256e412e85f3790511c9e070a5c0c4de57c
SHA512 b8c89e4721ca96a55a5c45f72ff03557701cb8a02b60f0ab4e4631f3cb18f09ae4986e08bb9475121e3a1d64b1badf273132e3b41628114d56e97d52a0efeb71

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\SNMP-pass.txt

MD5 688652a8bdc1e5236fe249b8329e151f
SHA1 820b082e4aba175d3dddfa5ef4ec0a73a49d6330
SHA256 adb16a26d84ac2ced75863678373025555c3a11b447c2cb06ac52a93d5d5e08d
SHA512 66b3a8269ad1b49b0139d0e880a80c07fbc98a23164307a2095d2e735cdd54524be6c68067a7f818aa7924551caa7028e7ea231386c956be83c8efb632f149aa

memory/2064-167-0x0000000001020000-0x0000000004047000-memory.dmp

memory/2064-168-0x0000000001020000-0x0000000004047000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 15:37

Reported

2024-06-13 15:39

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe"

Signatures

detect oss ak

oss_ak
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\MicrosoftEdge_X64_125.0.2535.92.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A

Registers COM server for autorun

persistence
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_hi.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_it.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_sq.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\identity_proxy\stable.identity_helper.exe.manifest C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Trust Protection Lists\Mu\CompatExceptions C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\da.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Trust Protection Lists\Mu\Cryptomining C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_pl.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\identity_proxy\win10\identity_helper.Sparse.Beta.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Trust Protection Lists\Mu\Other C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\af.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Trust Protection Lists\Sigma\Other C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_fr-CA.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\ga.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\lt.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\vi.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_ug.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\v8_context_snapshot.bin C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\vk_swiftshader_icd.json C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\v8_context_snapshot.bin C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Trust Protection Lists\Sigma\Fingerprinting C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\VisualElements\LogoDev.png C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\zh-CN.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\identity_proxy\resources.pri C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\mt.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\MEIPreload\manifest.json C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\show_third_party_software_licenses.bat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Trust Protection Lists\Sigma\Staging C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\sk.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\VisualElements\Logo.png C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_az.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\MEIPreload\preloaded_data.pb C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_th.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\identity_proxy\dev.identity_helper.exe.manifest C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Trust Protection Lists\Sigma\Social C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\hu.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedge.exe.sig C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Locales\gu.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_ar.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\eventlog_provider.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\ja.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\kk.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Trust Protection Lists\Sigma\Advertising C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\VisualElements\SmallLogoBeta.png C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\en-GB.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_bn.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_de.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Trust Protection Lists\Mu\Advertising C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\vccorlib140.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\fil.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\lb.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_ml.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\msedge_pwa_launcher.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\MEIPreload\manifest.json C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\pa.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Trust Protection Lists\Mu\Other C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\MEIPreload\manifest.json C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Locales\pt-PT.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\identity_proxy\win11\identity_helper.Sparse.Dev.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_nn.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Locales\ar.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133627667382395650" C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ELEVATION C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\Enabled = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82CCB536-D2EE-4F19-9067-40531F08D1D4}\InprocHandler32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\PROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ = "ServiceModule" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82CCB536-D2EE-4F19-9067-40531F08D1D4} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CurVer\ = "MicrosoftEdgeUpdate.CredentialDialogMachine.1.0" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\MicrosoftEdgeUpdateOnDemand.exe\"" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\PROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation\Enabled = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\ = "Microsoft Edge Update Legacy On Demand" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4472 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
PID 4472 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
PID 4472 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
PID 4100 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe
PID 4100 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe
PID 4100 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe
PID 3280 wrote to memory of 2796 N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3280 wrote to memory of 2796 N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3280 wrote to memory of 2796 N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3280 wrote to memory of 664 N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3280 wrote to memory of 664 N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3280 wrote to memory of 664 N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 664 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 664 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 664 wrote to memory of 3716 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 664 wrote to memory of 3716 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 664 wrote to memory of 3940 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 664 wrote to memory of 3940 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 3280 wrote to memory of 1708 N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3280 wrote to memory of 1708 N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3280 wrote to memory of 1708 N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3280 wrote to memory of 1664 N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3280 wrote to memory of 1664 N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3280 wrote to memory of 1664 N/A C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 920 wrote to memory of 3904 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 920 wrote to memory of 3904 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 920 wrote to memory of 3904 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 920 wrote to memory of 3888 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\MicrosoftEdge_X64_125.0.2535.92.exe
PID 920 wrote to memory of 3888 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\MicrosoftEdge_X64_125.0.2535.92.exe
PID 3888 wrote to memory of 812 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\MicrosoftEdge_X64_125.0.2535.92.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe
PID 3888 wrote to memory of 812 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\MicrosoftEdge_X64_125.0.2535.92.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe
PID 812 wrote to memory of 60 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe
PID 812 wrote to memory of 60 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe
PID 920 wrote to memory of 1000 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 920 wrote to memory of 1000 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 920 wrote to memory of 1000 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 4472 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 4472 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 4384 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 4384 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
PID 1436 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe

"C:\Users\Admin\AppData\Local\Temp\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe"

C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjIwQkEyRUEtQ0Y3MS00NzA3LUFBREYtRUNBNzY5OEEyQzc1fSIgdXNlcmlkPSJ7OUI3QTUzNzUtODlGOS00M0M2LTg1MjYtNkY5MDI5M0Q0QUI0fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0UwMUVBNzU3LTQ2RkQtNDgxQy1BMDg3LTRCOEQzNjhFQzYxRH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTQ3LjM3IiBuZXh0dmVyc2lvbj0iMS4zLjE4Ny40MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDYxODc1OTI5NyIgaW5zdGFsbF90aW1lX21zPSI2MjUiLz48L2FwcD48L3JlcXVlc3Q-

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{F20BA2EA-CF71-4707-AADF-ECA7698A2C75}"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjIwQkEyRUEtQ0Y3MS00NzA3LUFBREYtRUNBNzY5OEEyQzc1fSIgdXNlcmlkPSJ7OUI3QTUzNzUtODlGOS00M0M2LTg1MjYtNkY5MDI5M0Q0QUI0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QkE1QkIwNUYtOUExQy00OTFELUFFRUYtNjk2MERFMzJDMzhDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MTgxMzIwMjIiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM2MjYwNDY0MDQ1NzkxNTUiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTE0MzI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NjIyNjY1MzE1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\MicrosoftEdge_X64_125.0.2535.92.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\MicrosoftEdge_X64_125.0.2535.92.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\MicrosoftEdge_X64_125.0.2535.92.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCEEAD6E-7342-4095-A18D-EC0C7C14E7CE}\EDGEMITMP_D1E6E.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.92 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff754ed4b18,0x7ff754ed4b24,0x7ff754ed4b30

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjIwQkEyRUEtQ0Y3MS00NzA3LUFBREYtRUNBNzY5OEEyQzc1fSIgdXNlcmlkPSJ7OUI3QTUzNzUtODlGOS00M0M2LTg1MjYtNkY5MDI5M0Q0QUI0fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0VGRkI5MzhFLUMwQTgtNDYwMS1CRDNELUVFQzc3MUIxM0VCN30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjUuMC4yNTM1LjkyIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NjUyMTQ2ODgzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDY1MjE0Njg4MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwMDg1MTkyMDQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzE5OWQ2YjIyLTZmOGUtNDYyMC04MDI5LWY3ZTNhMmEzZmRlYT9QMT0xNzE4ODk3ODUyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWZJdWxUU1hnQlByYjRGYlN2cHM5WUVXejRlTWZlM0hJZFRPb28yNyUyZmlhSHl4Z0ZlQjNKWW9sSlIlMmJzbWNWOCUyYjBIQUR0dzFHakNWcFlIdlpjNUhvJTJiVkElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM4MTA3NTIiIHRvdGFsPSIxNzM4MTA3NTIiIGRvd25sb2FkX3RpbWVfbXM9IjI4NTc0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTAwODUxOTIwNCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwMjE5NTY4ODgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU0NjU4NjAwMjkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIyNTI3IiBkb3dubG9hZF90aW1lX21zPSIzNTYyMiIgZG93bmxvYWRlZD0iMTczODEwNzUyIiB0b3RhbD0iMTczODEwNzUyIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0NDM5MCIvPjwvYXBwPjwvcmVxdWVzdD4

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe --webview-exe-version=1.9.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4472.2636.1354745341553587324

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=125.0.2535.92 --initial-client-data=0x160,0x164,0x168,0x13c,0x84,0x7ffa957f4ef8,0x7ffa957f4f04,0x7ffa957f4f10

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView" --webview-exe-name=e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe --webview-exe-version=1.9.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1820,i,7332196956223735533,2639119934577146087,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1816 /prefetch:2

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView" --webview-exe-name=e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe --webview-exe-version=1.9.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1788,i,7332196956223735533,2639119934577146087,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:3

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView" --webview-exe-name=e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe --webview-exe-version=1.9.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2296,i,7332196956223735533,2639119934577146087,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:8

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView" --webview-exe-name=e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe --webview-exe-version=1.9.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3704,i,7332196956223735533,2639119934577146087,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 demo.tidesec.com udp
US 8.8.8.8:53 gitee.com udp
CN 47.93.254.67:80 demo.tidesec.com tcp
HK 182.255.33.134:443 gitee.com tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.57:443 www.bing.com tcp
US 8.8.8.8:53 gitee.com udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 134.33.255.182.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 57.61.62.23.in-addr.arpa udp
HK 182.255.33.134:443 gitee.com tcp
US 8.8.8.8:53 foruda.gitee.com udp
CN 180.76.198.77:443 foruda.gitee.com tcp
US 8.8.8.8:53 msedge.sf.dl.delivery.mp.microsoft.com udp
NL 2.18.121.15:443 msedge.sf.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 15.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 msedge.api.cdp.microsoft.com udp
IE 20.166.2.191:443 msedge.api.cdp.microsoft.com tcp
US 8.8.8.8:53 191.2.166.20.in-addr.arpa udp
US 8.8.8.8:53 msedge.f.tlu.dl.delivery.mp.microsoft.com udp
NL 2.18.121.16:80 msedge.f.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 16.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 98.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 90.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 f.m.suni1ng.com udp
US 8.8.8.8:53 gitee.com udp
US 8.8.8.8:53 api.m.taobao.com udp
CN 106.11.53.98:80 api.m.taobao.com tcp
HK 182.255.33.134:443 gitee.com tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp

Files

memory/4472-0-0x0000000000760000-0x0000000003787000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\SMTP-user.txt

MD5 1bd45dc5fcd63654825aa693e0407326
SHA1 3a4567c70aba378d04bc4eff545c28ddc82fb5c4
SHA256 0ceaf90a3e635efcd84c5b45e7586db66136a9f4511cd4aea2072580667fbc25
SHA512 e20f89b18f88df404b63172f6bda7a03b8e63f47542ba09ba98e8255d84e3b68a8a03bcb67fdd4ace7833a786eb2ee1c896c946116aa893e95fb24306e36b6bf

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\POP3_SSL-pass.txt

MD5 4cf29adaad3ef5aeae5ae8113bb703d7
SHA1 e6f01ad6ee1c541a2c54897dce4afff3711f8d41
SHA256 fb5831d6c6b82ec8ae328aefc6a1af4e60427b541463190f97d9bd92ecd1b8f3
SHA512 d15ba884536294e8b720cf735a3edce7bc1583279969e2d160e8cf02e230e2caad6f1cc68cced4748af361b21aef995f57f1ddfdc5d75cc4fce4e9c14b30f2b2

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\CobaltStrike-pass.txt

MD5 c78d86e3ec6038f3e1ab6a7d0f4c449a
SHA1 6a0ac926e48e1947c5456fef1038c8c5328abb66
SHA256 6c09e4ebabb5b0752d17630700784aa637bd1db0e7d4540a1582bb93b36122fd
SHA512 907423e3a3990e53ce88cee61f45f8bc00c9c7684fedf1c5c25a63a2d57bf34f0a64abbb5b5f2849a99646912a64d7c7b4474b67bb26859a8fa680c928f5ffde

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\Zookeeper-user.txt

MD5 fb8a9623fd5b1d8c31228677d7b1aaa6
SHA1 8ae061dbdb1df384dcfb5a06684c0c6a9c361df6
SHA256 b73c856da26ebcc11a6325b6279190e36949766c7e02f95628e5a80c61b6d79d
SHA512 a05086e85ede707f89f8be9099175e011ecfef9fbc1a960d0a98f141476fb45ba6a71d500a1e988ef4712f65e31b2554bc8ff41e65ea83a147d5fa7300e3b9cc

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\CobaltStrike-user.txt

MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\IMAP-pass.txt

MD5 5441e5159032a9a8c26448cc454b2370
SHA1 aa0f8c8ccbf13c489f3ef15afaedef8a469c0d71
SHA256 8f533fab5b00e5d5d41e135311c7bb0560dce9b7814daab23b11fd727ec6a235
SHA512 35bc6d0a5c518a5851d07369c67e6b755e559951a6fa7146f508c17615639d06ce2e60d714c968e1d933ead63063f48dbf0c0cd96a13ee62597fdc6fc246533e

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\SMTP-pass.txt

MD5 d73991d50902727a3a89717188d8b82c
SHA1 7a9d18d4b8a1e11d11366ff221126cce27407490
SHA256 aa7f59e2247e8d87c8a534a3b911e256e412e85f3790511c9e070a5c0c4de57c
SHA512 b8c89e4721ca96a55a5c45f72ff03557701cb8a02b60f0ab4e4631f3cb18f09ae4986e08bb9475121e3a1d64b1badf273132e3b41628114d56e97d52a0efeb71

C:\Users\Admin\AppData\Local\Temp\config\CrackDict\WMI-pass.txt

MD5 688652a8bdc1e5236fe249b8329e151f
SHA1 820b082e4aba175d3dddfa5ef4ec0a73a49d6330
SHA256 adb16a26d84ac2ced75863678373025555c3a11b447c2cb06ac52a93d5d5e08d
SHA512 66b3a8269ad1b49b0139d0e880a80c07fbc98a23164307a2095d2e735cdd54524be6c68067a7f818aa7924551caa7028e7ea231386c956be83c8efb632f149aa

C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

MD5 db7fb67fcec9f1c442de25f3ad59f50c
SHA1 b600aa26d1cded59760304c6d77f4ff75722eabd
SHA256 c227208854734bbd38c9f74f39034111733da5c7ce71515b1610aedd79417f9f
SHA512 c14ec7d252a6f201dfea476d302fbc5140713cb4ea7bc8d4e610bfd806b3fa3c141153e2e9b8cb36255fba1fab4d4400ed83f5f5c1228d77d77bace41d5de7fe

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdate.exe

MD5 e3f7c1c2e2013558284331586ba2bbb2
SHA1 6ebf0601e1c667f8d0b681b0321a73e8f4e91fa3
SHA256 d19616ac12d3d536c8fbf034513a4977c88ef2d1676d358a2358fa051c8a42ba
SHA512 7d4fd7ad06b05d79211144cbaa0047bdb4910212565b79f292a6bea652735dacf69435b24c73bc679cbdad4207f6352726eb297a1e7af4f7eef14dbc8a2ca42d

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdate.dll

MD5 1125e435063e7c722c0079fdf0a5b751
SHA1 9b1c36d2b7df507a027314ece2ef96f5b775c422
SHA256 7d8d1756343598bc651d62a0e81835820e0d6cf7a995503bb6b129b4bcc37df4
SHA512 153f096af5c874c00a3c38602fab590eccf885f642040007b67799ef39d919d7cb261fba43a9ffbd68c8824eddea219505d49e05b3dcc70f00e6016a1fbd12b9

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_en.dll

MD5 a430ce95b80c07bb729463063e0c7c48
SHA1 cc488bdc18c191d88dd93e45bb85fda19d496591
SHA256 c9c8a06948123607b7b35d0d46c9600b1d3e2f674e6117820b4f559818c26b60
SHA512 cc9c24b95d079a949a8e725002494b0c75c19bce9ec6457cb4307f5803b7433eed738944f1baf770df8e034212224b1d9662fa533aa5bc5c01568d192fa49efc

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdateCore.exe

MD5 4f840a334c7f6d2a6cba74f201e83a7f
SHA1 cb032c7b1293190f8f1cd466f6ded4bbe71c47a1
SHA256 2ff44aa5f48a3e5b3ca3c5a3904be23d29a282b467e30d6f52494df3dc1d612d
SHA512 575c20fcdbebb16bcd17a137a656769d355a81817e7fa3743981976998e00bdf3ce42bbfa046c42a835e9e9e7a10ef6f8d7b306de9940fa332817cb2885db833

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\NOTICE.TXT

MD5 6dd5bf0743f2366a0bdd37e302783bcd
SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_bn.dll

MD5 4d2988ce0b2cf5cb02269a2455e1174b
SHA1 d89cd05805965648c9e7b8bb4bc8bd3605ce2d4a
SHA256 cbc9a8a3936e6cb279885dc8a23261a290e85907f947a1a16fe9e7d6bdee69f8
SHA512 64cee7e579367faca4864ebb5feb9dee310915f8640780a5a52c19f5c68d817adab7ef357913a68fe841a3b2e801e85de173a37402cdd49cf35319571ff6ce44

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

MD5 e0de8c3f8252202d2f68341290c45e34
SHA1 1d3322ab111774484be8865c1893dd834c3f52f7
SHA256 ed3676152ff3f24f93034f3931b0a735b704906c50ed59a8b9cf49452afb1891
SHA512 bb22666ba675c88715aa1b906f2b356c0d4289723052b942f416d3b56f727666f4fb8cc51609ca96be0c76ffda85cfbdcea917979e8a1ada5a5ba1b82e5bf816

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_ca.dll

MD5 9e4ddaa68d6d4f210905092096051b36
SHA1 f38198c364da7b5ebcc75aafdf42a7d55699d8d4
SHA256 8bbbe723da938f6f0b3cc35f48779949c5fc177b5dd157ee053a088e2968f48b
SHA512 d65102c0f4337cea443c5f8e65531f0f7b628c5edeff17257b427d1073a1b291d1cc90fe46dc4bbd2c2988f940480d46e5abb2cbb9985bcbafa7e5f3bc727151

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_fil.dll

MD5 1b18f02bac918465032f9c4c6226f3ee
SHA1 8173e1be4375ba1ab5fcd35da8b8a4399bee1fbb
SHA256 e1f0c497bb4d9b2a9f4cb6cf6e382fb4fb8827979c5eb230737af3953db24bda
SHA512 baadab3af2d3988acc31a94f9b1321a613a794cd8b8da2ec2e938b7cf7774d586f566fa2bfdfff6da4f05c90e8cb101e261883faa4de48b9a911cc37576ec999

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_is.dll

MD5 3f3efa36258e2aa2e06d692e25003a72
SHA1 eb263e69ae3242a518ea0e4c6563e4a99e294292
SHA256 b5b48151003cdbf1368b2fc3431fcb5a9646504439b14a95248048706e0b89cd
SHA512 a5b20784e9531f37a0d25352b033a75d2d5286d914ffba2d401f37ac34fb3acfe024b70c1cbe8ba4a8e9f447db3cc5f45990e2e7e71461961a33d2ef2409efb4

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_mr.dll

MD5 8725cb4ef60ec46f76f4129b959f6a6e
SHA1 5ed33580e581b6d9b026ba2b385df0b93d76d382
SHA256 2436c483e8789dd4ba5ca2d0713020b1c1f812b113d5dddc3f8473cdd9667408
SHA512 d65ec21da2ef8256125820f781bc2fb1a4feeffa62c873fe439f2a2f1c151ef548da1feb58618aba3a58f6a154ea4f3fb70e6aebffb588b5a84770d77d783fe7

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_ml.dll

MD5 bd23100a9b8bf75e9e5e68966022bd71
SHA1 6562f97d29d19e41b864aae00a1c1279b7f44dfc
SHA256 e56c8c324b1578347bc93c0fe47d9b6276b999a18e9da52e414d56006e1fdf48
SHA512 d77594af22cf97afc68bc7857daf1032333009111675b52fde7c2f83bf7658585f6915abea38e5d3e524453a34b6633a5d5b00594f10cc86da7e4bcf616acf2f

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_mk.dll

MD5 c3aeb80795b68157737bcf7535c69bd1
SHA1 163c1cb7d0ae484f1cb9e6eb25c80969efe2f702
SHA256 ef2578df3ec1bc94a9624f80af4bcf8e70392553ae28930063692dd7d1d4c46a
SHA512 ebef893a8e82f7fa99a5e6a5d94da72788c83e7ba4e385a8dc189c622e5759200f136742dcb812d1cae6f1564f97ee4ffc9d10650bde2b88e5bff298918b9432

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_mi.dll

MD5 761440b1b177daf4f51beb2f66d79c16
SHA1 76577f1e098e7e81b2ce9e61d6e853c5491a5dd2
SHA256 49e02d60f70fcd0d7ab35cd0deea17ba1f8c687dcd0484ed34a31a529d63ac46
SHA512 ebcb7c62427fe303d3f381b626fabbf4d1aa35583db7333b90889f0b3462b6196dc2dd8649d1071e893c1461870e046476f6089cdc2024f7a71dbc533e2fa103

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_lv.dll

MD5 14c89980237895b168b2805db7964212
SHA1 8c2bccf5b24869c2ffc19e6230e866d5721bbc3c
SHA256 5a4fbb96bd165f7dc7a55d56f70ede22068819835b60ffc14d7a370c2c891804
SHA512 83f436072281daa4d6ad7ae4e27912ff661ff72bc3ad34e41f96574925e9abbedc1e3381d557320208aa23978c50a8b46c2d9ee2f6fdc630e30658d207803438

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_lt.dll

MD5 41bb0d130f5466432a94b2a45028ed5c
SHA1 23a81de294a82986da25eb86b73097195a629e78
SHA256 ace485702162345de29b705b3be37826db72f568a44410d7961732d1cd62e56c
SHA512 f106ee7052352d41b0c56d0a557239860dc7e885823cf21ad2cffc00ecae603227ccd18f7d9d1edb2c6752263c9b159e444124d1256b8c442c921d1add69cfbb

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_lo.dll

MD5 96c98965a7904d7adaa31f5f8a1f1f95
SHA1 1d9fb588e7cca9c2a7836ec49eb9202081adeb1d
SHA256 b7285701b7a1ee1089568caa05a1e527825f578baf188eabf5d43179a934669f
SHA512 d316000ad7e65f9b131664411b8adbd0e27842e9f61a016b5f5f1624202c5281939459f9380ef63977b217126ac5bdb481d5ae9ae318beffa44aa57303930372

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_lb.dll

MD5 c6b06f583f3e048363e22c24caadbda6
SHA1 3c119a1008c463f7efb55492ad88ce56fbb3533c
SHA256 3a4342864e18ea9050f0c5c58a89c95fc5a1b868c835290a3be244965b08f314
SHA512 4aef4224601b9a8df3b07188133b9d97fa90e06a245f49397baec7fbcb85996ba886f13b41c3b909a6b87f821c4f969f77f6be112b1c71c21f8a585d087acdc1

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_kok.dll

MD5 4140a967a1579c92bf488998b934fd86
SHA1 9a174bec29f2c166c612e9cf2b25b47d99ef9be7
SHA256 9c9a0984b09ec8ace7e6879dabc5ca60cac45c00992972a91dd6425bf2bffe62
SHA512 12436a277adcea2aefcdacc3d96f78a759e8eabe313887dd7c2fe9a5f6c02b75bd301b82a8120a11f51b6c8120d56b47eb7988b3f9c7bada34dea2de182e27c4

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_ko.dll

MD5 83995c5253aabdd4bd236d8238809ceb
SHA1 18c763f657ee6d3270829290564fb0199615f122
SHA256 bd4f94f7d9e3617d7b05fefe59925b7cbfe7dfbdcf051b6fb378291b7b7bfb25
SHA512 ebbf4bbd8970b6f7eac79d73a6858c0b9546d3ee7ec189f05e74045f6c91385376d4110256aced247828e17812e505919babcd5f623006289021dc3e5a2abb69

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_kn.dll

MD5 9360c3a97180c78044c67fcfa2f51a8b
SHA1 b1fe6cf821e6dedb1f961833c791a9ce7b2c5754
SHA256 84b3f954cb61c4a87c769c215ec570e8974141c6534517b128989931e881e7ee
SHA512 f65c857c1f6364fccf512125d841ac86d4457e0d1d8aae24bab65b1aaf79502993218a2e41916fe32d2ef10af3f8691fdf76c0b280d4778a67b3984fd3af2d8f

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_km.dll

MD5 a01f834efd28c57faee53d79949ecec5
SHA1 c3cf458bb2f1315f5d2fc4e2c4dfe2bdf8dcb0f7
SHA256 ee917d39a77d9a66491da123f0a54242c444f3a0e72645121488f7cdc75c8889
SHA512 b767e3be9a164736e8b5aca1768cba4452c2c2fe543f30e08707f6a63ce0d345474c922c9af09f702c437887d4d9dd2d1be59ba69395e9f0f0a47273d7a2e3df

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_kk.dll

MD5 fe09bc3153f94b68208f3ae813e15cb0
SHA1 7e7264fe77a31826549919aa99c7af6ad3769c40
SHA256 3573e2e52e84b9ce87e535244376f8fb57c9bc565c5ef3a6defaeb7433a3a958
SHA512 a6cd7185c47496a3fb666f8fa53cdf40fa1f71cb3759a68088da5f20f54bc4198d0d0c85fc0f0fc215827f4631c1022eca43878487f9fc379a7cfbbd229fb102

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_ka.dll

MD5 b2447c1b8586e9d659bd6c236589e60e
SHA1 9f0642a974738bd5eb0569dcea308d46d3235dce
SHA256 2a3830279c80da4ce28b02391703d5315e4b674cc81195bbd9cc18f1bcd6f67f
SHA512 7c2fb588fa440473436318e1028303831941988ea9f36ca56c5acd8936b4f52246973c6c76a1e7b3b25ba5069bdd986ec04709c6e0a4f6f2bafaa2029c1c0c91

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_ja.dll

MD5 52a48aa3c01cb348b109e7e2233b85aa
SHA1 8bb93772ada23ad818788de655c2b1f68bfbf9ee
SHA256 1708bf78de41b10f3fe8c3f56de08af88670f672390970de76878dfcb5cfb1a7
SHA512 3c3246ab0b780576304765cad51aabf71dae49181983ea7eb4b084f31aef500794604db4c7153e9866abf09dcf5be971808eaf0910fdca7ef1e36fe10bedda92

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_iw.dll

MD5 8e4ca001a9ae5aa92c5e74b9b6d490fa
SHA1 70e3a474c967873aad7d2ad9cb4831f17e032701
SHA256 34eca96f268259a6a67308cb4acd4ec00f33ca3b03c29d5e7cff47d83c137b4c
SHA512 997b66aa0c70e26b9b3893f61d9c26a05f87c6d8eb7c1d4a579bfcd1bd54382978f76c1fa6cb59cca20749bfa43890b6c4a65922d77e7914b00821c49fc5e0a2

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_it.dll

MD5 7a928cdc306a15eca2acba8c6e7fb49c
SHA1 1d61d526ea7b21b5efcd70d40942bb0b2a3e78d9
SHA256 45f3d6c9396208c5a92af53562db2924a6369004a1f6a06bafdc5c51bbf7c084
SHA512 843d93cea038ace31ad92e9cf92f2d3b7b6a627c4926605c67760740c6b1e6d7adf965fd549c0aee327b409227e5afef8758944e0015278a035c8b9efd2ac8f7

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_id.dll

MD5 eb92a889850152a3c67a046b26afb1de
SHA1 25744a9c829c08faa644d4fdddbaaef2c662605b
SHA256 f66d54d3e1ab099d8df66700a9dd04018d088d3d47422b59636bbe1868de495c
SHA512 14f353ed295e9b2adf1bae45e9eb8ffaeb738f1ca75b7bfdae9c1162b48e24d32ff8c2472d701924c341d9ad4a8216576f666bd08cf012167d325f013987f64b

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_hu.dll

MD5 3b3917a776c95d41114b590f31513253
SHA1 6aaf5c9054a4c661f1374f4828ce15cb065d1db1
SHA256 a96e5b1a84537708d5ed1e16e59f593cfc35599024e333f0ebaba631f4655ce0
SHA512 f22b73146cd84f1e14eb83c461bebc56317bd32b3f734c5f2103cfe6f395a822da33873ff7331330b54c734c2f15685a2b9fac9dfc1895f80e46ee8f2fcc2155

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_hr.dll

MD5 99298a89e5aaddd4c5d31c8159e9df40
SHA1 980b0840b77f5dfba8af1fe1132afeefa7343e55
SHA256 771d490248327bbed8e0f666284b02f691252198034f5b4873c4f5863b60dbda
SHA512 0776b89edf8a6be71e813db06c48f0bd97afb4f90387f39f882b255dbd818bd6edffa6ae719d758a63d7d0c236b303e0a053a3741bc9941f3b850e9298820b7d

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_hi.dll

MD5 8ae7c60978f1797c22819452c28e5755
SHA1 e3c595e988d06248da11f415d279b7371b068e8a
SHA256 c591dbd7563109d709a6fd6b897a3439fca8e14270c4905e6cfbba98590fb6be
SHA512 fff4683ee4b0233f37bb8196e9b30e34d66712e0c462207b48c7e5ae40b36c440aeb6015f3b7db3f723bf02c5b0a3853cf2d0a424d187e2587bb4c568f93f3c9

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_gu.dll

MD5 099eef142a6e8af6f7bb01895dcac818
SHA1 02d320adb865e6cc6bc22c70ac51102b3473d1a2
SHA256 9208225c1d83b314ead913c9c5a4f7d5d353a048642f102cfd06bc94598a41a1
SHA512 e2586b5660ee6e0cd0030895f9c4c398432d041b2db03d1f94e2df47d404d78baa8a18eecab1736d313eb031fdfd2600cf3025b7a39c00cbb82d2b7b094de24a

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_gl.dll

MD5 d53c4b0747cd028a7a4a59fcdfe6f375
SHA1 edbb5606edb9f9899c18853872a2380bb02f39bc
SHA256 0ea76700d2286185f0b65d24106b81258e1593e617a4e66a129004b659518bd7
SHA512 56ff2ed53a6b9f3a2c2f36713b18049ac2bba2494992f0c1dc8d92d2d9dcfe0cb1296041e9a53394bb4d5402e03794b99a774f9054609dd48d42622eb192ac72

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_gd.dll

MD5 e4dbb357e40a839f9c8caaa5a1c1b827
SHA1 10c66bf5312110a2feed763afa41a448d4070bd7
SHA256 e18b53fd3b34c85dad87f43b7833b518e61c712c3b48c6967408312ff9e43b35
SHA512 a09ca0ae932a81919c37faf138dcf017bd2fe9ad21ae8a560444d7c7d3338213274e205d04b7378512603537af2d5fa0235c2ba2bd458cad947ece24c99c9e71

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_ga.dll

MD5 ee66c6c39b414cd5adc1c59be87074b1
SHA1 6f34917e48c5e55850ba55b528faa6e075a76230
SHA256 5ac439af44574f3b1c5557edcf8bc416babdba89aaebd51bd5d13d9c023ba5fe
SHA512 451fdf3331b8f02bb60530dc184a0ff5e2193bc05b59e602e8b633047209ca668e38968e7cdae268e993d619be44685fa0e06a46f2ac3c0f8c606a3e4b4825ff

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_fr-CA.dll

MD5 a2ca38f79d18fd44b0288fab8cb6f31f
SHA1 5e94d1265d5dee58d9ff7c72b7b1ba7b07eb4948
SHA256 40b00c38c1cb9b0ef6b916ffe1e52605f2523659592e29d06f3f08716033df69
SHA512 37a1aacbe69b90fb3b89bf92b6851a8f7038061dd009bb372db64227657224604ab01f0b09bee54d43205a08536cc43f992ede01cdab64cbad404cd557ccb34c

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_fr.dll

MD5 9666bd1ba06b37249980b198b22aa208
SHA1 a26043d46dd8767f76e111cc971a53237ce720d3
SHA256 5f2461703e6da108b61709078bd19ddf18ff673e8059ec795d52ded554846fac
SHA512 61b893bf94fb3efb70b8da1412d6eb149734da1bb2d3eef2a62fefac469e0e0f3f25b851c6cc0ef2062f826e32ef777bd6469a3402d6dd7aa596600476f14331

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_fi.dll

MD5 7483cb4ff3f422d05af3267a242130e3
SHA1 f723b294d2088cf8a4ff2478e18470b256116979
SHA256 c3800427be8e5550e6fa985f28bb4cf183f8b49d398533ad0eacea53a5a573d6
SHA512 fc5ef6b792a9c2f113f5fc6cef1bf268e8688ae8f5de369224458c07b4fa229da3b6bcf698b0d9962d4644b7e1b9c682cf4f4dfe66c46c0297a41a14fc6e53ed

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_fa.dll

MD5 3d30bd97390f100a3dc9cf3263623434
SHA1 ac328d192b4218722e0994c8c3c67df1aa8383ba
SHA256 a66e9dc8829de13dfaf3e727ddf5a1655e0dd8844ab95fe461b61f996287a802
SHA512 bb45aaca5f13bab5ebb5b542a71635e15cf0a111ddf752db510f7f161bd889f58ff30d0fcc4f36e9882564271a32281d4d9a48cfffe06172e2a46041b2af62f9

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_eu.dll

MD5 60417e3a859f5e728bb9edeacc439309
SHA1 ee96ac74353e0e1725e09a6e5e6d070767286e45
SHA256 698dd9be2f9edce221977a6c076e894f72ffd1287c4a67423d1ea06ddfa90b21
SHA512 2470f2cb04c720e3b0259ea2440761adef1493253a7a93242ff543d52936a67685a59d36d3e7f39c7807c2ee1d2932109534337e3096137441668f9cf507d16c

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_et.dll

MD5 2e1b7c75e1ee567906a62eb19ee4308d
SHA1 10b77bc1040db4a3712a94c2e5ba56be3a54bfd4
SHA256 83a38cc799974f6a018dea761420a77e25bf17d2c1b7d09d6d75a7b50c5762c2
SHA512 9bcbb626945390ca07c99b4a698036b2a59869040944866edb893f4e5f7a6524b8980183f9825b33bafa41b10165b7ef6d20dd7750e38edd880fc22362110c08

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_es-419.dll

MD5 31177139af7d1da131c31d7d5cbe8099
SHA1 113f3b38baeab35d2d0f51f1238f5b9e11402f26
SHA256 39e80dad7071bc0a82fbd3475a780b50b9c0f1cac2240322c48b6befb1837163
SHA512 6828a1cab2fdefe642a0b58f47c31e02b9dba7b15ad28cdb8039b194d9a86e2d24ff0e658fdf982e3d2d4208a2b57eb7546136e4739e64d714939c14a3d58410

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_es.dll

MD5 dd3dd031e05a54c4bbf6660dd8053608
SHA1 f32870bb0f7f522fd536c4ffae8c39c9d2f266f1
SHA256 2d71da96f961fafe269241c27290917bf54a3c7fc5ced2de0c4b33e4b0386dab
SHA512 7b0bb0ae619baea45cddab042d10d7e4b394c70a29c01632585fec7ff9aaa54a50a8fbc894f02af5e2130cff11c4573cf41ab6b5fc4c29392b69e72212c41c2d

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_en-GB.dll

MD5 1b79536b20df86a2bd8b232abe07d533
SHA1 a9d24de616055f9800d5c4bc902cb2d0f625d178
SHA256 fbf5215552bf6e12e7ba5c3e6e69748c47b6750845f5e4f048096903ef009008
SHA512 ac4704fade4879992f0a67888e1e4098be2879e5e3ce2bd80275ce68729f0037497d975e1ececb587ace4d72f3e71b038f616725831d4fca12280d583cd77d7b

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_el.dll

MD5 8cb60db631b0939688f39e76564505cc
SHA1 6dee577de716460737f7a330f440880b4e73c5c8
SHA256 e8f7c8baaa1187c430c22cfc5907541411ab46e0609a53d39b015d722e35bf6f
SHA512 d43216c1a8ed2daf51d70d476b789a3797bd62f69c1a556e306dfccc41efea73117eafb970010d7db151cd3ebfb7cd82de01efb4e2a2c0757b2027732a3361f5

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_de.dll

MD5 896c0f7b03a6cd211fea53ecc71a1308
SHA1 434eac60a992ea77945a77964050a5d0e41d48b2
SHA256 84ffabc322775aee896df188189fd633483c3eb10571c8c86ec55561c2329582
SHA512 7d2f9fc0086b3dc60275c6a2e17b0562626a57fb080dc1bc4cd5ad80c2501f366e89533aa961613eacd3a0bce343bf831e8cfa3d3a691c33481042b1ee02908f

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_da.dll

MD5 9fa41c3ba8bbd84e85f71c3cd377d90d
SHA1 363c1d61c84fee42987193e8edeffa522eccbfdc
SHA256 157c6cee2a283c6a1966356f8d91172f55c05408f292dc352579a4dc9283c0e6
SHA512 34569a917bf08ac7d50add115b09cd8bf4583a3bc7652fa54c1cd606cb94e752f4e4e278fbb99ea1e41e2d712f82893ca5f59bbed05a57c8d29b2d7037d835e5

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_cy.dll

MD5 04ee3ec0e73eae42509bdfb689927610
SHA1 6176e7ae836dcacea10f7004b04ba85e3e081da8
SHA256 5410d30b82c006e207a8fab3a771eed3abff145d19ddcc92e48d47bb54684e81
SHA512 89c41d77066fde1cad219603d1bbdd812a65bb0680d3c545ee4cb63135486296f1af934a69161e76ca53d00037729e75bdcc22a2eca954eba98cf3f34af5d839

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_cs.dll

MD5 731cb513cd866dfc65e12446a0d4d62d
SHA1 be32570fb7fd50c43cf1ae24e7a35302eb5278fe
SHA256 829630039ca9125aeb8885d069214b4112972ed02dacd309ddd26fe087f3fec2
SHA512 6357f965c183e89e5a1c485a0e3becf56ab91265241568d7df7fdc1c01f1ac8fa58bd206762ada8cec99b6988eff60c41cf4836290d5e007fff63a69a78de68c

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_bs.dll

MD5 3e817089a18c72bd505dd6bbe5ce6163
SHA1 2c21b568c2fda5e475a1a996b73874ba6fe420dd
SHA256 7c31aa69e3109d7134443c47b12859fffbade13a2f994f0bf42a8fdc12f796df
SHA512 20534eee7c59a9cdb595c3f6d01abc8cfa534aaf84a693d3b011e4dada3fde080142a95ba036270a6a2ad2b65e6fdb18b08e53552715cc4edfcb87662fbf8100

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_bn-IN.dll

MD5 a8817334810c093e0c280e2a61caf36b
SHA1 9b3b2a8e33de3fa8df0b6b6ab4a40ab1d088ab28
SHA256 18d4c6a9840ba877dd1906ff258fb06c245cfea6bab00bbffe18c442957393ac
SHA512 24ee9a0c29d42c96ccec7f4f3322c3b6a2ed0e4d68b17a5b424a364f789adaa8f1404784c8feae77986cd0be39579dacc9ca89a3fa868bb0bf11d94c95f0bb23

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_bg.dll

MD5 c30674009659b56bdb6a60f8629f0eb2
SHA1 4b6fc6ea93620a206a621875513455b57fd24e83
SHA256 d09c23ecd92f5cfbe650c63bc93af84c11c9ae143a5838286c04169eab8bd103
SHA512 8947a9bada21ed2e0f2cf080d58f9473a5c54092a5c1f75ca9523b48143caed346e831714e80466cc2e88513e507aef422d8560b69cbf8663eb21ab05c61707c

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_az.dll

MD5 1e4093c3b0af3eed6f95d2620d45bf40
SHA1 e29a10ede562f2d057d6fc04c3a286996051a14d
SHA256 afcc0b001c7ffc1f5bbdea02fcbd6054e8b15aff9ae47366910bcf5908d4437d
SHA512 843480e2d2b431f32892830c26fc3e4b80656d069f83f9a9df78d10b1e22c9ceca99171360b2baa921d156995d87ea5223f18b11e2a8ac18fabdf905881940b1

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_as.dll

MD5 d1aa2764e05f7c8c88a17bb0cd25b537
SHA1 2bee78f103faffe3e25ca20c915cc6b46e2134e4
SHA256 3dd5aab43eeaa6202adc115f40fc1feb5332128388c2d8e62176fdea20035097
SHA512 80762e4611b8ac451490e5238c0650be048bf315526ed405d9c5837e5002bd6a9526f335a06c6baa009cba671ecb0613c76dce23086e13333f332480cbd9ced0

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_ar.dll

MD5 819e3c9e056c95b894f1863208d628a2
SHA1 596993f5d21cfd92f29e2ea5b0a870dc2ac19917
SHA256 588adf8e9a300e39b51f7404356c4ae863dee1f404664933585f8d9f2467d494
SHA512 3a7e67248895ac2cbb1874514bffe62a23cdfff2c3674d21589f528ec283ccf3cc2e3abfea0d81f49046c7ba920f3e64cda100c5a20be69b91ce05095b50c06b

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_am.dll

MD5 86465afa3ac4958849be859307547f57
SHA1 9bbde5e4df719b5a7d815dd1704ab8215602f609
SHA256 921fce73f4fc7b47749d250f5ab885141bd5ddec2ad057b049e470cffa4a6b20
SHA512 13e178e317280cbd585261aa22a840ea2203d4ef5c845f4fd6d5b4fbf216d45aae55153aed43c1fe4284d45391c72e580e612347b2903effece8a2252a13b90e

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\msedgeupdateres_af.dll

MD5 3a8fa737407a1b3671d6c0f6adaabd8a
SHA1 b705b27c99349a90d7a379d64fd38679eed6ec30
SHA256 5995a5ae09cb7da69b5a6f8ea1a60406d8ebc2201b627417b578ebe903d22276
SHA512 9872f32a727b248d3edafe303e5290e1bae0c270a988500424221970c0041268c1626ebb94712a0b8ba0f21d2f29d833ab9dbc4db884f7f9af5a5063f94d71b5

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\EdgeUpdate.dat

MD5 369bbc37cff290adb8963dc5e518b9b8
SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeComRegisterShellARM64.exe

MD5 687ccc0cc0a4c1de97e7f342e7a03baa
SHA1 90e600e88b4c9e5bb5514a4e90985a981884f323
SHA256 ecbab53f1a62d0459d6ca81f6c004651c09562f8e037b560dcb0890a2c51360d
SHA512 4da91ee55de7abb6ce59203edd9ae7e6fcacd5528ac26d9e0bfbd12169db74758a9bc3fde437e3c1d10afc95d74b04b0e94586472b0a0bb15b738f5e6ec41d8d

C:\Program Files (x86)\Microsoft\Temp\EU57D4.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

MD5 a177a23ca2ed6147d379d023725aff99
SHA1 1a789e5ef7bf9f15f2ccbac5f9cf3750ee41f301
SHA256 9c584238ea9189afd6b11cf71604b1c2762ac815d6ca8994788de7e076b21318
SHA512 c508ffd3e2cc953d857a2128e29dfdfe0f9e729da38c9cc3022c4376342aec946c6e79176e7885f6637008573c85339bdc8a9e261b3811887ecf5a7dd78383c3

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

MD5 7f293338a6ce5bf107bfdae8397ee288
SHA1 6615ced3fd456cfa0c40c04f2c3667901322b5a7
SHA256 084ba793974c842d99ce7677de76d7213bbbd1ead4a597b7d49973c13fc630e5
SHA512 2c96ed1a1e69ab2881915df31909c9d97b86ed96cdd3611e61315e5b99240752bb164cf2d8b291a5aec25291fbe06a4a7a670dbf86c4f70f7157ccc8e5197d6a

memory/4472-360-0x0000000000760000-0x0000000003787000-memory.dmp

memory/3280-364-0x0000000075300000-0x000000007551F000-memory.dmp

memory/3280-363-0x00000000001F0000-0x0000000000225000-memory.dmp

memory/4472-362-0x0000000000760000-0x0000000003787000-memory.dmp

memory/4472-365-0x0000000000760000-0x0000000003787000-memory.dmp

memory/4472-366-0x0000000000760000-0x0000000003787000-memory.dmp

memory/3280-373-0x0000000075300000-0x000000007551F000-memory.dmp

memory/4472-371-0x0000000000760000-0x0000000003787000-memory.dmp

memory/4472-379-0x0000000000760000-0x0000000003787000-memory.dmp

C:\Program Files\MsEdgeCrashpad\settings.dat

MD5 ee59f93be19ca856b03d2d42232d7e9b
SHA1 a7ead2e3c92a6fd6d4dcdc7fee83ed5fac9ef134
SHA256 7a0720a48e62fbcb67c98a6e716e61637d844caf60907a129b0191df3a6205de
SHA512 31a78a290ffcff578231ea17b207e5bd1d51b3b21dc7452585d2fe1c2eba80bf4e38665e80815c3adbc0d4bb8912b94f53aa598b6b7220da0f5f732996dbe2d6

memory/4472-399-0x0000000000760000-0x0000000003787000-memory.dmp

C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Installer\setup.exe

MD5 d42926508ba6626be0143a2aa5275ba9
SHA1 ca2b45426611211dcd47fe66c9255ab81b843943
SHA256 9595008f51be8ca7c82618c84d30f0a7fdac9fe7433b806af504da0d38aef10a
SHA512 53aabfbf20389f4d28746c41109b5a194ed5d21521fa67042bd5a0fb38407e877bed5481a7502bec848a54d0fd4e33b09e3c6bc47a576f8e14a4458c64bc14e2

memory/4472-418-0x0000000000760000-0x0000000003787000-memory.dmp

memory/4472-422-0x0000000000760000-0x0000000003787000-memory.dmp

memory/3280-429-0x00000000001F0000-0x0000000000225000-memory.dmp

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Crashpad\settings.dat

MD5 aef72173c7eb182c1f14e7d47250c8c6
SHA1 9202fbe6798486698e11c1f04547fcbfd456dc61
SHA256 747722c46df6bca42d98629291f43a636e5082ffe11f4ce9ed842d358cc72a69
SHA512 f841108f8c0f63fe097f3cfbc0ff9accf6976d7f948705321bf0f42b07ce075432f17e3f72130a3108ef00034ce2b32ffb302a6aad73e86881c8b6e9ec04a67e

memory/3200-482-0x00007FFAA6EE0000-0x00007FFAA6EE1000-memory.dmp

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Local State

MD5 b703baf6162767ade24aac432eaec122
SHA1 d1a4a133a4c98234c705e5e3e2540947253ece61
SHA256 06bb324cfd252cc667ca63b180d841a7f0ef1e1b1af8970455a2fe6ae5f034cc
SHA512 9c16bbba2a1fcc131fe64364bf8c0cc9850505e86b6ae0adbcbbebd2447961e3ede60d17850098a3dcee95b807a619a47f60a2772da625529446f51c4b2ba9f8

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Local State~RFe58acb6.TMP

MD5 d81af46d55e574313e1cdf19254922dd
SHA1 ff5e0ad262cda03afa7c23536e68e82f8d759b76
SHA256 99c6f1d412a1491467f7519c7211e2557916fe5b30e1f3ebe6e3a8a71d489a8e
SHA512 18692638cb5ef46da65f36866f9d0b041a6e80fc7ff38bef69a35a2aa1343f077c5797fd061d3d9c0f9e2f313462f399164bf91b0e153e439a86b409b0fa4ef5

memory/3200-481-0x00007FFAA71B0000-0x00007FFAA71B1000-memory.dmp

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Local State

MD5 cb1252098f017797180b17439f0d7348
SHA1 30df2c937bc998cc51863bde41ec527cfe6770fe
SHA256 041ea2b138434a737e85a68f6d78753d69f38ecd5e252ff844514e9a854ae912
SHA512 db90cbeeda3d89a005cb631c6987dbb0c506179214bd897308f34787716291304dce45ddfe606cb6eff79c4a6945cb06eb6376037e97e4087198acec8b54b60e

memory/216-461-0x00007FFAA6160000-0x00007FFAA6161000-memory.dmp

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Default\Extension Rules\000001.dbtmp

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Local State

MD5 fc071b41dc4a992d9025ece381e9b506
SHA1 04e8021bc06cbf4d43c0d690a73472bb714bb1bf
SHA256 caaf18749dc4ad143d2896c60a2e6a46c8eecf874be0526c57d8e23c3f6c9c08
SHA512 d361b1931d7bb3dc8009e58014eb52f1a0e9bbd5adff1204fe9c1dc0aeecc0e2d4af2f127640fab28c01cafd511278b602a1a1b61d21965ca77eb92bf1e07768

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Default\DawnWebGPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

memory/4584-563-0x00007FFAA6160000-0x00007FFAA6161000-memory.dmp

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Default\DawnWebGPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Default\DawnWebGPUCache\data_1

MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Default\DawnWebGPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Temp\config\config.yaml

MD5 c096d8e7b909d1feb90fe20842354341
SHA1 74bd962aabd20a918a43944f7a23b449ffa2912f
SHA256 d5360a6c82c5069d64a01d948bea596baf2bdcfea26e7f9f0d05e0e181c7e0fc
SHA512 096c19bcdb785198c63a05e31b0e4996becf638c4963a69aed4eb67914fb01a64ae0420cbaa49e1ebe149235f89d00d16171d5b25b7fe49fa244756f8e9701da

memory/4472-623-0x0000000000760000-0x0000000003787000-memory.dmp

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Local State

MD5 b3817fc33dab3c1e49340c63f3395c83
SHA1 95c221ddafe934bf583a94adfba3a1b6c89e14b1
SHA256 3ee228e9240ff6e0d6373dd3f0f02d98046468c3009ad705e3f88ebd9c14c745
SHA512 58f56579e5e44ffab832b4908017bb583a6d5e7f6d298b5b49f6be4062abb71d9f1711180a9728c2c4795724cdcdb084f3bda7833c8fa0ab82f99892d252279c

memory/4472-641-0x0000000000760000-0x0000000003787000-memory.dmp

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58ff89.TMP

MD5 6d62d7c8d9bdbf273189a160ec77da8d
SHA1 691de66eeee4b8a7084271b095746c9a7cc813bf
SHA256 457c675101ad5fe4f438aaab174747c57e91cbf6da4bc22714e089d0dc9cbbcf
SHA512 c5ee85c2ba8a092234f765a76e15520d687e90bc7c5ff4281fa95bf2bb5de72dad0b261e81ec66b99a9a1d98489ae28ed1730246d35889496f574f01051e4488

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index

MD5 56c77bddf2c189417a07aa3e129a1fe5
SHA1 7661e8c31ddea315a216ae77ab0aefe501f24d5a
SHA256 18b7c90c7b4b40d4fd3f380ba89d665372ab1a467ae3c1cc31e1d5251ba20fa7
SHA512 0406ccc936ebb380c13a4702a34169d4e34e97de82a126ff7a8f51f150d036bb9769f42e6b7ad8120ff635840a1009e0a457280726ed75d6ebf275e002199ccf

memory/4472-653-0x0000000000760000-0x0000000003787000-memory.dmp

memory/4472-654-0x0000000000760000-0x0000000003787000-memory.dmp

C:\Users\Admin\AppData\Roaming\e4dcae47d980f156136b6b9034db1de86447c7d8b4973476a68c0548f8708f8d.exe\EBWebView\Default\412106f7-7cd6-4374-bf2e-ada08e10efe2.tmp

MD5 7aa2f915721cdd485274c8b824ffc1a3
SHA1 56e73eae3d9bc87958597b668b95438b581a7154
SHA256 0a9db1c1c11d79ada453cb33a47763120586482571db9f9ef66385977fd00986
SHA512 da1cbb42c32a31b245aa1a79a0d050a764ca305f8d0e22d929c34e18d86fb9f11ae6391654a4986cb75d68c4c9f16dc287885505547f6bcdffd3d688491a3c62

memory/4472-673-0x0000000000760000-0x0000000003787000-memory.dmp