hxxps://workupload[.]com/archive/U7eK2DmANv

Analysis

max time kernel
303s
max time network
283s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://workupload.com/archive/U7eK2DmANv

Score

10^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5924 created 3416	5924	NoRiskClient_0.5.6_x64-setup.exe	55

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 37 IoCs

pid	Process
5924	NoRiskClient_0.5.6_x64-setup.exe
4376	MicrosoftEdgeWebview2Setup.exe
4888	MicrosoftEdgeUpdate.exe
5656	MicrosoftEdgeUpdate.exe
5688	MicrosoftEdgeUpdate.exe
5700	MicrosoftEdgeUpdateComRegisterShell64.exe
4484	MicrosoftEdgeUpdateComRegisterShell64.exe
3800	MicrosoftEdgeUpdateComRegisterShell64.exe
5780	MicrosoftEdgeUpdate.exe
5836	MicrosoftEdgeUpdate.exe
5892	MicrosoftEdgeUpdate.exe
5920	MicrosoftEdgeUpdate.exe
2272	MicrosoftEdge_X64_127.0.2651.98.exe
1524	setup.exe
1412	setup.exe
4432	MicrosoftEdgeUpdate.exe
1964	NoRiskClient.exe
2040	msedgewebview2.exe
5684	msedgewebview2.exe
2336	msedgewebview2.exe
6112	msedgewebview2.exe
6008	msedgewebview2.exe
5732	msedgewebview2.exe
1596	msedgewebview2.exe
5408	msedgewebview2.exe
4468	NoRiskClient.exe
5096	msedgewebview2.exe
4140	msedgewebview2.exe
5040	msedgewebview2.exe
5792	msedgewebview2.exe
5152	msedgewebview2.exe
4188	msedgewebview2.exe
4052	msedgewebview2.exe
5620	msedgewebview2.exe
6060	msedgewebview2.exe
5368	msedgewebview2.exe
3264	msedgewebview2.exe

Loads dropped DLL 64 IoCs

pid	Process
5924	NoRiskClient_0.5.6_x64-setup.exe
5924	NoRiskClient_0.5.6_x64-setup.exe
5924	NoRiskClient_0.5.6_x64-setup.exe
4888	MicrosoftEdgeUpdate.exe
5656	MicrosoftEdgeUpdate.exe
5688	MicrosoftEdgeUpdate.exe
5700	MicrosoftEdgeUpdateComRegisterShell64.exe
5688	MicrosoftEdgeUpdate.exe
4484	MicrosoftEdgeUpdateComRegisterShell64.exe
5688	MicrosoftEdgeUpdate.exe
3800	MicrosoftEdgeUpdateComRegisterShell64.exe
5688	MicrosoftEdgeUpdate.exe
5780	MicrosoftEdgeUpdate.exe
5836	MicrosoftEdgeUpdate.exe
5892	MicrosoftEdgeUpdate.exe
5892	MicrosoftEdgeUpdate.exe
5836	MicrosoftEdgeUpdate.exe
5920	MicrosoftEdgeUpdate.exe
4432	MicrosoftEdgeUpdate.exe
5924	NoRiskClient_0.5.6_x64-setup.exe
5924	NoRiskClient_0.5.6_x64-setup.exe
1964	NoRiskClient.exe
2040	msedgewebview2.exe
5684	msedgewebview2.exe
2040	msedgewebview2.exe
2040	msedgewebview2.exe
2040	msedgewebview2.exe
2040	msedgewebview2.exe
2336	msedgewebview2.exe
6112	msedgewebview2.exe
6008	msedgewebview2.exe
6112	msedgewebview2.exe
6008	msedgewebview2.exe
2336	msedgewebview2.exe
5732	msedgewebview2.exe
2336	msedgewebview2.exe
5732	msedgewebview2.exe
2336	msedgewebview2.exe
2336	msedgewebview2.exe
2336	msedgewebview2.exe
5732	msedgewebview2.exe
2040	msedgewebview2.exe
1596	msedgewebview2.exe
1596	msedgewebview2.exe
1596	msedgewebview2.exe
5408	msedgewebview2.exe
5408	msedgewebview2.exe
4468	NoRiskClient.exe
5096	msedgewebview2.exe
5040	msedgewebview2.exe
5040	msedgewebview2.exe
5040	msedgewebview2.exe
5792	msedgewebview2.exe
5792	msedgewebview2.exe
5152	msedgewebview2.exe
5152	msedgewebview2.exe
4188	msedgewebview2.exe
4188	msedgewebview2.exe
4052	msedgewebview2.exe
4052	msedgewebview2.exe
4052	msedgewebview2.exe
5620	msedgewebview2.exe
5620	msedgewebview2.exe
6060	msedgewebview2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NoRiskClient.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NoRiskClient.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\sk.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\he.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\c9b32d92-33b1-4423-b522-b2f5a337fb48.tmp	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\v8_context_snapshot.bin	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\dxcompiler.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\mi.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2040_882330634\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2040_882728154\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_ug.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\mip_core.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\ru.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\msedge_200_percent.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\ne.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\fr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\VisualElements\SmallLogoCanary.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\gd.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Trust Protection Lists\manifest.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\MicrosoftEdgeUpdateCore.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\libEGL.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\concrt140.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Sigma\Advertising	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\gu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\pa.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\az.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\bg.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\cs.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\pt-BR.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\identity_proxy\win10\identity_helper.Sparse.Stable.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedge_200_percent.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_mk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\et.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Sigma\Staging	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_cs.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\msedgewebview2.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\identity_proxy\resources.pri	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\mip_core.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\ja.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\sv.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\MicrosoftEdgeUpdate.exe	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\127.0.2651.98.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\elevation_service.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\am.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\sr-Cyrl-BA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\identity_proxy\win11\identity_helper.Sparse.Beta.msix	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2040_510792571\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2040_882728154\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_lt.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\BHO\ie_to_edge_bho_64.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\identity_helper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\hu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\dxil.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\ar.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\ms.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\copilot_provider_msix\package_metadata	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2040_882728154\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{72AFDFFE-9C81-416E-A007-36F8E289D57D}\EDGEMITMP_4E11C.tmp\SETUP.EX_	MicrosoftEdge_X64_127.0.2651.98.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\VisualElements\Logo.png	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2040_882728154\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Mu\Entities	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\or.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\VisualElements\Logo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\ga.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_nl.dll	MicrosoftEdgeWebview2Setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoRiskClient_0.5.6_x64-setup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5780	MicrosoftEdgeUpdate.exe
5920	MicrosoftEdgeUpdate.exe
4432	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133678792096070573"	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{375D3B39-152A-41E1-BF1B-B648933F26D0}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CurVer\ = "MicrosoftEdgeUpdate.CoreClass.1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0E8770A1-043A-4818-BB5C-41862B93EEFF}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{375D3B39-152A-41E1-BF1B-B648933F26D0}\InprocHandler32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 359297.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 625742.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
2856	msedge.exe
2856	msedge.exe
3132	identity_helper.exe
3132	identity_helper.exe
5816	msedge.exe
5816	msedge.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
5924	NoRiskClient_0.5.6_x64-setup.exe
5924	NoRiskClient_0.5.6_x64-setup.exe
3312	msedge.exe
3312	msedge.exe
4052	msedgewebview2.exe
4052	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5924	NoRiskClient_0.5.6_x64-setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2040	msedgewebview2.exe
2040	msedgewebview2.exe
2856	msedge.exe
2856	msedge.exe
2040	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4888	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 3896	2856	msedge.exe	84
PID 2856 wrote to memory of 3896	2856	msedge.exe	84
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1592	2856	msedge.exe	85
PID 2856 wrote to memory of 1476	2856	msedge.exe	86
PID 2856 wrote to memory of 1476	2856	msedge.exe	86
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87
PID 2856 wrote to memory of 3088	2856	msedge.exe	87

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://workupload.com/archive/U7eK2DmANv
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9df2f46f8,0x7ff9df2f4708,0x7ff9df2f4718
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
    3⤵
    PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5456 /prefetch:8
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
    3⤵
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5940 /prefetch:8
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
    3⤵
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5816
- - C:\Users\Admin\Downloads\NoRiskClient_0.5.6_x64-setup.exe
    "C:\Users\Admin\Downloads\NoRiskClient_0.5.6_x64-setup.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
      C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe /silent /install
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:4376
    - - C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4888
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5656
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5688
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5700
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4484
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3800
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkMyQzBGNUUtMEZDQi00QjRCLTlGNzYtRDI4RTQ4MTBEMDYzfSIgdXNlcmlkPSJ7Q0Q1MTZBNTAtQkQwRS00NEIxLUJCQjctNUZFQjBEN0Q2N0M5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5QkY2RjM4NC1GMUExLTRBQTEtQTMxMS0wMEM5MkMzM0U0ODN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4xNSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMTUiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzNjgwOTk3MDAiIGluc3RhbGxfdGltZV9tcz0iMzU5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5780
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{BC2C0F5E-0FCB-4B4B-9F76-D28E4810D063}" /silent
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4620 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2284 /prefetch:1
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6356 /prefetch:8
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,4977044855842048,13777550422513355543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3312
- - C:\Users\Admin\Downloads\NoRiskClient.exe
    "C:\Users\Admin\Downloads\NoRiskClient.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    PID:4468
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --mojo-named-platform-channel-pipe=4468.3712.10877922875402195577
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5096
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=127.0.2651.98 --initial-client-data=0x180,0x184,0x188,0x17c,0x1b8,0x7ff9cdb2d198,0x7ff9cdb2d1a4,0x7ff9cdb2d1b0
        5⤵
        Executes dropped EXE
        
        PID:4140
- C:\Users\Admin\AppData\Local\NoRiskClient\NoRiskClient.exe
  C:\Users\Admin\AppData\Local\NoRiskClient\NoRiskClient.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  PID:1964
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --mojo-named-platform-channel-pipe=1964.3924.9796433779181041891
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - System policy modification
    PID:2040
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=127.0.2651.98 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ff9cdb2d198,0x7ff9cdb2d1a4,0x7ff9cdb2d1b0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5684
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2336
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2008,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6112
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2296,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6008
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3496,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5732
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=4672,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:1596
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4952,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5408
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=4984,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5040
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5100,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5792
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5044,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5152
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1232,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4188
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5048,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:4052
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4628,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5620
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4444,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6060
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4160,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:5368
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView" --webview-exe-name=NoRiskClient.exe --webview-exe-version=0.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5188,i,16102256017044673594,12992028392262125851,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:3264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:440

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5892
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkMyQzBGNUUtMEZDQi00QjRCLTlGNzYtRDI4RTQ4MTBEMDYzfSIgdXNlcmlkPSJ7Q0Q1MTZBNTAtQkQwRS00NEIxLUJCQjctNUZFQjBEN0Q2N0M5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Njg1OTVERDQtRTJBMC00RTQyLTkzRDAtOUMyMkIzMzBGMTEwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI5IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MjI2MDI2NDciIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM2NzA3NTI4NTMzNDM4NTciPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTE0MzI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzczMjUzODg3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5920
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{72AFDFFE-9C81-416E-A007-36F8E289D57D}\MicrosoftEdge_X64_127.0.2651.98.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{72AFDFFE-9C81-416E-A007-36F8E289D57D}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2272
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{72AFDFFE-9C81-416E-A007-36F8E289D57D}\EDGEMITMP_4E11C.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{72AFDFFE-9C81-416E-A007-36F8E289D57D}\EDGEMITMP_4E11C.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{72AFDFFE-9C81-416E-A007-36F8E289D57D}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:1524
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{72AFDFFE-9C81-416E-A007-36F8E289D57D}\EDGEMITMP_4E11C.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{72AFDFFE-9C81-416E-A007-36F8E289D57D}\EDGEMITMP_4E11C.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{72AFDFFE-9C81-416E-A007-36F8E289D57D}\EDGEMITMP_4E11C.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff64629b7d0,0x7ff64629b7dc,0x7ff64629b7e8
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:1412
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkMyQzBGNUUtMEZDQi00QjRCLTlGNzYtRDI4RTQ4MTBEMDYzfSIgdXNlcmlkPSJ7Q0Q1MTZBNTAtQkQwRS00NEIxLUJCQjctNUZFQjBEN0Q2N0M5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5NEQ5MkFCQy1CQUUwLTQ1MDMtQjNDMy1EOTlCNDM5Mzk1Qzd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7aFZmRGpNZEZHNkZnS3MwTno2ZW1yWUNTZzZUUXZEUG9tb2xSYXlRWEJLND0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI3LjAuMjY1MS45OCIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTM4NTk2NTczNCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzODU5NjU3MzQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NjEyMzQwODE2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81MjlhNDFjZC01YzBjLTRjZDAtODA2MS1iNzFmZWFhOGEzMzY_UDE9MTcyNDAxMDMzNCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1Zd0RIS3dxWVFSUENjVDhiemxFWmZIJTJiYkdzY0t3NnlGV3ZGZ2RkZSUyYjBuJTJiUGo3JTJmdWh4T25sZFlsSG9kcUk0V3BHTkYlMmZvZmJXSmFocEdsZzZ6U2I2Q3clM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIGRvd25sb2FkX3RpbWVfbXM9IjE2MTkyIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTYxMjM0MDgxNiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU2MjU3NzgyNzQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjYwNjcyNTA3MTQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI3MzQiIGRvd25sb2FkX3RpbWVfbXM9IjIyNjA2IiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ0MTMyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Installer\setup.exe

Filesize
6.6MB

MD5
527503f430c5fd4a542f8c0f163fde47

SHA1
6b4db644895df6c71b547d8b147ef3e327418f9d

SHA256
d1d9b6fa51141f58b95191c8a62cc5a4c9568ba4b70e3deba4e1929df9a97628

SHA512
ece940340ba2216966b6d4b28a950826b55f8987998c101c534331674376b148dfbfacaf5c78695944bf940dea07ed4887f9572e09c118e307752036679850b8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
182KB

MD5
b69894fc1c3f26c77b1826ef8b5a9fc5

SHA1
cff7b4299253beda53fb015408dd840db59901a1

SHA256
b91bad4c618eb6049b19364f62827470095e30519d07f4e0f2ccc387ddd5f1bf

SHA512
8361e97d84082f8e888262d0657bac47c152bd72f972628f446f58cbeacf37c05f484dce3fb0d38c4f0da2a2dcbb0813639d201d127ec7f072b942d43b216755

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
136e8226d68856da40a4f60e70581b72

SHA1
6c1a09e12e3e07740feef7b209f673b06542ab62

SHA256
b4b8a2f87ee9c5f731189fe9f622cb9cd18fa3d55b0e8e0ae3c3a44a0833709f

SHA512
9a0215830e3f3a97e8b2cdcf1b98053ce266f0c6cb537942aec1f40e22627b60cb5bb499faece768481c41f7d851fcd5e10baa9534df25c419664407c6e5a399

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
215KB

MD5
205590d4fb4b1914d2853ab7a9839ccf

SHA1
d9bbf8941df5993f72ffcf46beefcfcd88694ebd

SHA256
5f82471d58b6e700248d9602ce4a0a5cda4d2e2863ef1eb9fee4effcc07f3767

SHA512
bce1447d5d3210c22d52dec3b846db091b65ed03fd9d7cd11c6c4dbd2aa5a943d881360bc033c29abd61011581ff9354b35cbe421719d92568ed99997bfbbae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
261KB

MD5
b07ab49ee8453853021c7dac2b2131db

SHA1
e1d87d6a6e7503d0d2b288ea5f034fe2f346196a

SHA256
f8535d5d73ebebed15adc6ae2ced6bb4889aa23e6ffe55faeabd961bf77b05e4

SHA512
5eaae533fbe71430ae2a717f7668fd0a26ec37624e198a32f09bfdbee7e3b6e93d64e4fbb78cbdb05c4fe390a864490ea997d11849ecd371f5153bc8bfafccc3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
5d89123f9b96098d8fad74108bdd5f7e

SHA1
6309551b9656527563d2b2f3c335fd6805da0501

SHA256
03c3c918886e58f096aa8e919b1e9f8dcd5a9f2a4765971049bf8da305476f44

SHA512
9d8190e5374cd1b4adbbfb87c27fa40d4de529d7c0a20654e0ce189a4cb9a53d3708c4ce657a7a5469b015df7efbbff495fc844579d9cd363b329b7e007e85c8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_af.dll

Filesize
29KB

MD5
4f860d5995ab77e6efa8f589a758c6d2

SHA1
07536839ccfd3c654ec5dc2161020f729973196d

SHA256
9841d787142dd54fea6b033bd897f05f3e617b48b051de0ee3cf5865b3393150

SHA512
0b9a661b76360f1fb2eb3ee25c6bf2cbab7ec74e2363e0af321dc4d0afb3cad301dddd16ea367d588451a40a2c2ed41f21d7afae48307e1e4a4ec5b24165b378

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f624de37750fd191eb29d4de36818f8b

SHA1
b647dae9b9a3c673980afa651d73ce0a4985aae6

SHA256
e284453cd512e446fcbf9440013f8cb2348ffd6b1acec5366f2511cdf88b1794

SHA512
d1d65e29ed59e34d4ff66df11a2368f1a724730e32eb245022d4f3d1fadf16d445ba8532460afb0e6e91f8be60a7240d13577403193042d1e912a67e4bf23b1a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
5de3f4dabb5f033f24e29033142e7349

SHA1
5c446985de443501b545d75f6886a143c748b033

SHA256
2533d443b68c5288468b0b20cc3a70dc05f0498369d5321368a97dd5bf3268c8

SHA512
c96296e6f67edeff2be5dc03014a8eb65fc287fb899357d4608c36c07b4610827aa18cbec6ccd47b66230a12341af488aca8bd02632fa768f84ca7b1d9c9d065

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_as.dll

Filesize
29KB

MD5
1fb14c6c4fee7bfabe41badb7c5acff8

SHA1
953d94cd73951943db14c08cce37b2d3ac821b02

SHA256
cd32339fd7e4a5959e93eb5bfd6e009e4137e15c5e6c2e861d7891487216da49

SHA512
a93b081935fbe48fafa8071a9cd593ae7b19205c70eaf48c724397019a04161460c66d6d8c6ffd872f4d52a4a7aa25ba1cba04181b9ebaca04b76d111ea588d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
d3345579310f3bd080b406de47b2305f

SHA1
16aefb27ea6d81c684f041aa50ebb49fdd403d83

SHA256
b4ea3c63fa0104093a2b2034f950428e66d2cf3d55f0fc5bd688483392d60d69

SHA512
65e4aa8587bc579b5109d91e02745f6de96a23b6ac2962cdeb6d9d536b51abab12b2bbaeca72572c3ae1971dac5bd24430eb2ae5ccf44a7068427594e4afdd7a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
ecf3405e9e712d685ef1e8a5377296ea

SHA1
9872cdf450adf4257d77282a39b75822ce1c8375

SHA256
e400415638a7b7dcc28b14a257a28e93e423c396e89a02cba51623fdfbdc6b0b

SHA512
37e5f1b3bdd97a4370718dc2a46d78ab5b66865d3cdb66a20a7dc20a9d423ccde954c08f97e574fbab24e8dfa905351cbfb94bd3e6692a9b6526097ea3dc911d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
051c429fa2beec9c2842c403a86c0e7b

SHA1
0a06a45200a1f5c81c48fbd2d03549fc9fac3a58

SHA256
1a8465922bbb05a97a24f6c2200fcc7afd8bd0ace245c2eda9d9d335d4fb9353

SHA512
bb59b41804328f27ba8861af32824266ca69ddcfdaaa11551b1edd4e129dbba630da8070abedb28e180045f8d0ddc1209cd901919f6b9aa421c457188af795c6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
82711e45d2b0764997abc1e0678a73bb

SHA1
47908e8885c86477a6f52eea5fddb005ec5b3fa3

SHA256
2bb7455999b8f53a2a0834588ca4da4703f4da362a127d01cc6bd60ca0303799

SHA512
4b517796edc954ab7f5a26a5d6605925dc7e84b611bcf59352b3b95f719cedc72c77a465fb1e7bc2d2f422d596c97968dac5b57292c82967d5cfaff980128fc2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
a0a1f791984f1de2f03a36171232d18d

SHA1
71f69d8fe47640ba9705725d7d627a05519c8016

SHA256
d2c7da8f4745b81874a9666c7d10a779a9956b4de0ebdaa1647bf78d4e17d85a

SHA512
a4267911846cd55eb91227b0117ccbfdf8ef6c4ed0b8935b08e5d41a91aeabd9259988c71da8606cfb2876c4d69df6ca5a246687440283f1625105624305eb33

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
30KB

MD5
897712b508931dab76d39b209611740c

SHA1
9d80e07c2dc744e2efce3b67aa9876949fb9edfe

SHA256
ee64fdefdb3381ce61fc445190cc44b015e7b65a3a16d28f3477f68de6079f1b

SHA512
3329e37318dd9b11f282301e453af106168d3d10beff1ed62ffdcda60c6b4edb6b9c69ac6b9bb8abce3c9a9686a0152404524012dbff025e571de2cfcb3b5d56

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
e90155442b28008992a7d899ca730222

SHA1
1d448e9709de0d301ded6d75caaeba4348a4793d

SHA256
6ae98b5e2eda22a0236434b7e952d732e3cd5d9cae2e51cd70222f1fd5278563

SHA512
a91d8357ca976db2eb5a081077304a50edc1b55b2775c00cfde05e03831f98bd04e43f0dba5b3efd5a6370afcb10b23bbf307412467502e9ef57e0beae636013

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
1de961b662a374c3af918c18225f4364

SHA1
e8f1c438e57b322f43b4b851698bf38c129eb6ae

SHA256
bb1365c5770dacbb918af27b47b02f269504f4d2396cf3f82bf5ecb2551c5021

SHA512
c6bf62b684039f62744f1aab07f4751948e0c175f7fb7fe126f20903ce23fcdd2e284f1b794922621dae7eaa15c6dae0177ad102289a18f967721486f21073a1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
29f027d2d5fd486bdc20386ace925603

SHA1
66b8605f23871b4a8302bef0aaccb36ee1e72755

SHA256
03c8566f749e8fa349d97101849bc3b2cc0b7561b565a2b0928bf8fe901da813

SHA512
3348bdf10b2d964b34b791a774e28c97d3caf28d7f90e36b948cc2cb6c21e84cda933b7ddbd51c8fc604a450361cb834322c15ddbe0f4851154d05e5a2a2ea42

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
b0ae9aa0d5c17ee7abfc57d21cdcbae6

SHA1
01019eb6ba9c123be528136e12192b0bb33df407

SHA256
d10938919e3d28d71e8e3ba2d8e02e0f9dc2faf148cdedc21c166fd994c603e2

SHA512
4cba25c8159df865231b08fe650eedfb92d54c3037d28b2b9af010c8a59fa23669041a6c393622fe69b0194c2532f71f02b740f7e26e0bbf7ef34a421d6747b8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
ad5b530eabff0540078c5d17f27b9610

SHA1
7e53dbbf64e70e561d37669e69f50eb0da8e37d1

SHA256
49f512316a51e51027b4e70de4ffe8c8ecb188e126439a90a5d12d52a0393966

SHA512
e1cc853d96589220676d39d91d4108633ce56304640f770e7d22b97a9b3be9452d5fb94e4e7fcd1400b62f0c398da8255c53a31853194a9e7b7784982b5ff40f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
a7e64339a5314e3576c0d170171fa52a

SHA1
6c12aab6c97c30aff3245b78f7a3afeea604215e

SHA256
4e9ccecb8e4383395f2134347fbad00521345ec9c857d8fa102d5257c7bea9bf

SHA512
a4ca3fb60a7f4bda50847544dd1289d750f0d4b3565929290a8392b92822ef1856cec15a1f63f2c6fe1ef2e7cc0936a35bdb38ee5d904eb08cd32f05addc6ee4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
74d4cf3b8efb6cc3d0acc3eac38bd5b7

SHA1
9337803aadad9042c895b6f418b4c733b81221e0

SHA256
b83c8981d8835e4c78250bf265faa6d64693204b77764c8e349abc4365ae9871

SHA512
e6112ef60d56101aa16327042162d6ef43519bc56668ca8eaa7fd3e1aaadc75c7df75c1e41583a292ff1a9bdc7d9ad9f5c0d97fa84964532dca2d5f3df604c23

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
19dc1f6d1f309eb7abf1e0c8257f41f8

SHA1
e2d3e86fe22c6af6b8ee5b359315dfa6ac4d52ec

SHA256
046f6c532fcabd969c6e63bb7ee0d7a83d806fa659006508e1c3a9485190d6ef

SHA512
478d6a84452cfadc48547930e336ad459eec188dd3d9e4c778cded4ec3d34e00b2b8c0538366aa644ee67f878b29c5c73444c1406c66e8394761bb0979c6483c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
8f7f515d78d2df371993fd70f863ab8d

SHA1
dfae1b47e80f91abf2d9c2aac009c0a1767bc59d

SHA256
ba57fbb9d3a32b84d6a76054b9ad180b6510e53206b9804bb9ea18ff73c2ae3e

SHA512
308a62af00a4410551eac967bb9f2cea7adf7c13b471dd28b276bda40b1e4c0b4ebb60aec29b6165069d40180bc45b4f5da5baddc374ce7bc5a5bb223afb4e96

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_es.dll

Filesize
29KB

MD5
6af05d448c842027f876e93f8ac58b65

SHA1
f34c988e3875a1d1b267b082476fcfb8d7505a73

SHA256
36876b14a214cf98dda5100a7e7134d7ebb78e895535d6bd7562099574607867

SHA512
412031db59de0367a102a026f73072244b33d726adc5bb9fd079db3dd37b5d6a24d7420a9811576d0a356933b5ba15cc9e2a92046d2d6e6d6fef37e9d840aec6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
ae9bdf6416c3630c4b0b5b119308a135

SHA1
d7218c677b098d2a93cc91ead39c83d3a2c653b6

SHA256
62da90c9417a70632aa190fecc17c31ecf433c1f84f82b08d7d7290669cabf32

SHA512
4333ac6cd3737f25e6e1d429b195da781ced4340b89808cbd5d5d2aae2e79bcc700419d613123d632252e31ac44d95b7718f23da5b82ab5054407e80106a64a7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
fe73dbc305da6223d1e94e1cf548c000

SHA1
b16f2c40d68cd9718eaaa9b6db9c8e5c4b6acb9e

SHA256
1ef64088a613a4e10b4cf4206f95f5414ee27872798747234a6574b7e5c70a7d

SHA512
d9900720d89defffa52198dbe63515995095c94aa0cbbe4f32a1c09d26809cec480e92926d2240702604b8c13fcdc0032cc46910ade8e4c1d2fc9a4bd1b63858

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_fa.dll

Filesize
28KB

MD5
367ea715e942c81dd3cb734274969a0b

SHA1
f92f1ec2a5be9b775e67c4252a07c37ed0ca508b

SHA256
082da1c09782c026c9cd73456dc12539a226f0bf5d113e59bc93b29c1e98b37c

SHA512
c94e787ba3bdb56d1827a0477461cbba6b7cc68986722275e0d04ea7dc70db83b5d03887eec810bf9b67f70b18bd3c7b7d28f0e554938b81d3501bc11f97830a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
5a30bc4216af48a493eeb0f3a9f02607

SHA1
2fdf65a4002d91818d56a23fb8bfd08ab715002f

SHA256
5131c23915ad6b5b469bcbff31d0ae31ef34ded28ca0ffff9f1eb998bba98aa1

SHA512
34b3a4865f31ebdb8665780011b384ada768a0f71bff77f91706b140eb8cc07fff8787f710cdb1ee14a449cae8f22ee5fddadcc501cf1c921eea078e97dc2f89

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
84c4736cf301b93998028ed7678caec1

SHA1
3b6f1f6b9eb3dd7d9a13c11dfd3ac56c93f1b10f

SHA256
3c8dcb7e982dac3159298009a86909b1e1000ccf6f4d333341f16d4d6fbd84ad

SHA512
5a1b77ef9450c32802e94e473a5b4e43e892c923ef368ee9bbbbb5b0090429320263cc79a4da0b281930c1a60861519211abd0bd67a9d9ee370bdda2230d2e81

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
8993c0784111fc7cd6a90a82303e5f44

SHA1
8d1ff2fed98ebc608604c555ceb46ca628afb285

SHA256
3d0ba88267018f592141ea86592757cf1ecaac1a3a18f99203e0fc5c5eacbd62

SHA512
124d16d848dc8ea0a93b292b10ce1fbad23b56b13771d904cf14c19d54478614d214441b05f6cd9e1999b8310fdd26d1c6ecae784be00aecee7e80c96ba4ac88

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
a640aa4ff33662e06a474765df0b2a8d

SHA1
c6265225532e389e48c6057bd717b69de2125b61

SHA256
078b1943bf7f7955b90abc40f691b27e04376f8c43dd3abc4791614286cd4f23

SHA512
59791eef021f94efd9c18737d6c46fbc45add582eec92d5b997cfd66993abc7da872720a037766c3c70862f0654ccf30d122d4a5a6b305151bf8bf1c053a466d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_ga.dll

Filesize
29KB

MD5
5bcc643a969559317d09a9c87f53d04e

SHA1
3602d51cde97de16d8c018225a39d505c803e0fc

SHA256
b48f57e90ea9db6d6a296c01e87f8db71e47ab05ab6c2a664cfa9f52cf1d2c18

SHA512
4c65772f77e61e64d572df5b1f62733aceb02a5c967c296b303ff17c5d49831e5b7fc3d662724ae3ae1e88cd0fdcb704e838af5d4ae20f2d82b9577f57159159

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
aea23f526ef0c5bb3d2f8fdf192a49ea

SHA1
4d7695e33ed43c3efb95f304e29675ea885b2939

SHA256
3cfe866c151a7e8a208af725c0c6f2a47fc3ada35f9ad3509b16b8d5229318b9

SHA512
412e4742ebd46ce38010b4f6a46d8d524025f929ab4658040e271d768e79115d90903403b2f1e51ab910bbdf9677b49439eb3c8afc5959477af198efb0c7c3c9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_gl.dll

Filesize
29KB

MD5
295cd30c00f43d9131621baf4859578f

SHA1
cab79a6263b7b0a799461f3e6df41f815029cded

SHA256
b851c5a60cb6d1e8dd9aa161106cba99ccea047d0b39d007beaa7b9ef4a83397

SHA512
5f5c1e62e6c0e11a63fad68928765e3f504f33cdbb1d9a05cd53cbc3ed145bf3528960a10e3d57e8c83b07c030c72257f403b9a57d12975d3ef8bc255418ad6c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_gu.dll

Filesize
28KB

MD5
c43c1ab37cd93e54068443bc330fb3d2

SHA1
ab51a2cbc51b3c17cf184c6d99ac480c02eb63af

SHA256
0c26a367355e766402c31fbab102dd1c35300d4a1301417c75be5fc4b3d54680

SHA512
ff0193189fb846eb3c4188bb599dad8e6f415ec9612da567d95c9c513defb148b6013208371798d174569b46f443a744e4e8b83aaf139d68c31f7de0f94e63f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_hi.dll

Filesize
29KB

MD5
a5544f517f7c1bfd1ec6a2e355d5a84c

SHA1
34a2a4a576300ad55b6757171bcba0fab005daa5

SHA256
8274c64bb778b55d912929625cd849adfe733b2dd674d94895d53af8dfaabeca

SHA512
9069bcfb736e13499250844dddef40e2cf64937e33ee1f81fc4968f024f7d7b89c6a778866bf1bff98d770686569e4752a473c0adfad4d4099cceda84da3cac3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
c09876a180731c172fa2532f8be90a3d

SHA1
4359c7840ddb23142a40aff85129b9920360e954

SHA256
50fd548ea12e2b72fc563bc082b870a89a523e8b3a4a0e9b65fe673384da2b58

SHA512
91cee1b10fc12a01a2a285e67dba583d6f1bee0716cc89103fee0c7d0f52fadc0f9ac5b13e833834e7279963726950d3897847e7acac61857257fc031692033e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU7E43.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
ee19156c12d2d7cce9b12e515f9ac6c5

SHA1
19ad46e40b3c1cb6195231bfcf45bb68ee1b43bf

SHA256
c290883b4b99758792284755efa52c12eb09039f0f8027d8ba3b1d4bb2f3846f

SHA512
631364472a450519ad8959971d6c319610570ca37b4486ea12d6af5b46aaecbf336aadddd1f3fefba841534ff82adf905b1e1a008638ed784bf08870a3b86ee1

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
9d0fe487f6771d3eb8c53ee56e1da9d7

SHA1
3dd281094d7bd6a435a40f7ccef7bf711d2b0890

SHA256
84911f9dd38ece8b6fb19b3edfff8195ba25314f9523b5673e0d5a451ee50acd

SHA512
d6565328e73ca62e22bd261892eeb3b93be509ca77fd93916c552a7ec7d7d27df9d4ec0fcf1dcd189e7bf3237b8a1f174be618530a991cde27ac5ef82f9209f4

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2040_232067178\manifest.fingerprint

Filesize
66B

MD5
7ce55ac0d7683657fd051e573ad06e30

SHA1
3bc51fbc6155c4e9d1439587e1c739995054cc52

SHA256
138e2b36e4c8bec8b00180558843355037d7de99c389f46e6183c4fc5a34c790

SHA512
f269c5c2ee53ed836bfd1b928b40e1ddb2aaea00e5585c85fecfcb1add71130d4ecfe91d2f2527934ac472c8b432d3475ca02b8f808e7e6014cd49155529d9a2

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2040_232067178\manifest.json

Filesize
43B

MD5
55cf847309615667a4165f3796268958

SHA1
097d7d123cb0658c6de187e42c653ad7d5bbf527

SHA256
54f5c87c918f69861d93ed21544aac7d38645d10a890fc5b903730eb16d9a877

SHA512
53c71b860711561015c09c5000804f3713651ba2db57ccf434aebee07c56e5a162bdf317ce8de55926e34899812b42c994c3ce50870487bfa1803033db9452b7

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2040_792822836\manifest.json

Filesize
79B

MD5
26eb792775b785bc23b76b53d9f29c2d

SHA1
4e753dad4043f4f9cac02fe1e65f60cbcb2dcff0

SHA256
2043baa68a0dd96994936ac08b4437b364a36264d9a549f0866ce6032b4f0bba

SHA512
a2b16c3c59fd34cf1fccd0516e14d9c56ef4aeb4e758cfc2fe483cb395a416a9376c09f830d2034929a678a6309321148fc5abaaf9b2d035b48896d282ea709f

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2040_882330634\manifest.json

Filesize
102B

MD5
8062e1b9705b274fd46fcd2dd53efc81

SHA1
61912082d21780e22403555a43408c9a6cafc59a

SHA256
2f0e67d8b541936adc77ac9766c15a98e9b5de67477905b38624765e447fcd35

SHA512
98609cf9b126c7c2ad29a6ec92f617659d35251d5f6e226fff78fd9f660f7984e4c188e890495ab05ae6cf3fbe9bf712c81d814fbd94d9f62cf4ff13bbd9521a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2040_882728154\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2040_882728154\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2040_882728154\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2040_882728154\manifest.json

Filesize
179B

MD5
273755bb7d5cc315c91f47cab6d88db9

SHA1
c933c95cc07b91294c65016d76b5fa0fa25b323b

SHA256
0e22719a850c49b3fba3f23f69c8ff785ce3dee233030ed1ad6e6563c75a9902

SHA512
0e375846a5b10cc29b7846b20a5a9193ea55ff802f668336519ff275fb3d179d8d6654fe1d410764992b85a309a3e001cede2f4acdec697957eb71bdeb234bd8

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
187KB

MD5
ab8293291fd64bfe181ab5985f0a4c2c

SHA1
2d211fdcd406feb70c120e4bbd057caacc9b4f29

SHA256
1f260072b1e97317fa2dbe715d0db093e5a0d01680da0863503bc78b0ec9802f

SHA512
dbfa62ecc81083b554027112079cec24446645ded479c2e2a2f95812c4da52d8f3323e7f031338db36036722dba7c8ba690c8e4e1a1596b71ce0ba2fb7b5d6e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
93KB

MD5
0083bdc1a667d30f7be2f970af4a1d5f

SHA1
0485db5aee24784af692a77862c1edff44ec9ffe

SHA256
ce7ce413808cca6aa4bd6c72bb19691bd03d70c6766cd4fa4d276d713d164a8c

SHA512
fcf9ae894f79e0d229d7770b7a24ac8f1a37889f7927135c5e0eba916636f542b22daf50ed6919fbef4f794e7260d807e27d80472a851f5d253e941e18aa4f93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
37KB

MD5
27eec7e8f48ac0d64e62ec535a19ed37

SHA1
0454ae16951154ff4d64dc2dd20f780b6da87ee8

SHA256
9107d29b79f5c0e9d7ac88f893e0afb7c672d536b2e41de469172c8b7366e3d0

SHA512
f93033661c1974d9225b7e05543d7efe62574567abf7bdbb982b36e5b0be658937a7128de10376f9e39c20a2d40688862fa0e76aa53b0b8c87b99ee536fbb175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
48KB

MD5
cb360a9e4e7b13ce18ddf311ba981d3f

SHA1
47a93c49a21e5b7a95614509e4617256a67cd09c

SHA256
ad885c9ecffe5091fae72b5ea3842772f1f3101ef5a34257125c432c7b32c1e5

SHA512
56d701587d1f490eea1db0211bad82943f3030eed759c87193028283a74d9b9e92b08abd131e78316d3c76a8352ba9c01e29084e8f02fbdcdaf316f81a51c04a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
18KB

MD5
af73a83498e939379445066f4be6686b

SHA1
bd5fb87bbb126fd672ec96b3a17e85ef92f8bcdc

SHA256
680fce4f4484948006f144bbabcbbc43b898e82ffe80b1f36b2a381f48507585

SHA512
e923a671dd7b9f2a3ee90b93eda9ec5dad3e4084053cb6c0a2002f02a4fdb0706f9d5c1859a8c2495ba08c6d6f641ca77dcab41987d1da08f8c0395a9e5cdd6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
49KB

MD5
184a2a669cf798f8d80bcfba041c3ecf

SHA1
b8dbbf83b27b5e4f5588f997685b2ccfecf97ff6

SHA256
659a8dee04b272c247129ff6513d23c16f4f9c183b5d64e7347815af8861a2a4

SHA512
c882dfc93fe0b07584a21a24b9e89ef8b3b6ce3e07d3f1b822f750a18aff353997cddf11c711aefe90861787068d7e281d23c8cfd5299b883122ad74f3dfa8ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
49KB

MD5
bc4866b032d34d1ab1fe7d30fe7d2af2

SHA1
98fe0e5e6e425a6881de5971eae18cd5ccb5ccf7

SHA256
be54ac8b9843afcd92dea7b3e72306efec71ba3b6365f679f179c7ca4a0aea9f

SHA512
200a3da2976be7fe5e4330f8f4444fcbf63f6ead8940a82eb47415993ee07b5447ed52634f1563b603c19acf39196faaac4a54b7cd6b058ba1ae2cff85a206a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
75KB

MD5
af7ae505a9eed503f8b8e6982036873e

SHA1
d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c

SHA256
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

SHA512
838fefdbc14901f41edf995a78fdac55764cd4912ccb734b8bea4909194582904d8f2afdf2b6c428667912ce4d65681a1044d045d1bc6de2b14113f0315fc892

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
46e5171838151843c4143a4e93924b4a

SHA1
020b37cf5203bafb53aabde8e1ac4706e6083d6a

SHA256
74c9915d197ba04ef1088676a0d88962f605c73ab1013700b478393fea2a4d92

SHA512
4fa0ebf95b88e2ab0d6283b79574cd0d5e30fa41fb15fccb86f0b46d966b0e4edc07a036af110f7dd5485b5af37d23ab95bdd1d846a0b665cd6ac9527d511ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
ae5b9a6f7010cfb03474426e2bc339fe

SHA1
9b93f09ed606429ca48d1b6cefd0c31268e59110

SHA256
cb83f0dd64659ab0fc594779ae4eede67565ec383efdcd690cc65be04a51d931

SHA512
3d1a7ff5419eb9bb6ae0b949fc91af0636fa4cd523c03148d1ab2ea83ec449758265d77ca995a9013b80a514d2f44e1bed6be45e06dd2600f0952b573e502ada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fad19043e7e3ccddd9fa985deac92e81

SHA1
39909d01c9d811fc759582360641711cb37b167c

SHA256
28818921cf5a375401394f2755ccb21b28f2f67f9d5aef092a79681fd8b03450

SHA512
7c37ad305b563325b59a92bded4921f877d3aed8d7f603ab8305b3e071492cdeba8323e6f3ad94aff3f7e8b8ba363bd23b2dc4f92b0c62b08c44bb29361c91eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ccfc54c47ed8b3e63b6134aa83f81647

SHA1
0c7959d238a5e7525a79f4131626541f8e664c74

SHA256
857e77806a5365f2c77389a0b1ca43fe2a96c4a1cd533d82efef1f27aec36a55

SHA512
91cf06bf586e41373af4d7e1f87bee0628dd29de3b1373a2dc7a55b118ba318bea4b05a280229156b6e254e1878c7afe0b22261e09619c1929db64e9ce5fc124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f338ffb4e089b528acc6c83c24eb41d

SHA1
97c78fe08a1d2355927f9137337c234bc7ea8372

SHA256
83c41eba3782e30c85f14e148186a916d4fd7d49b45d483178a49f1e5ecab309

SHA512
10e3c760fb3d81ca93caf95fe0e88d3ae307edefce75d32e721e4ab90b6c742e37c6062b9812b65badab9e1a957fb5cf8b2c75315dec2a255f2fe6e7c7124417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
74e0337aba43af01a10067cffc612464

SHA1
08562e1a6c6c271f8cfb526db149669ba7c5d248

SHA256
843f9bc1093722a9bf3b2808a64531b650cdf56a72be289753c93213ebf1ef79

SHA512
c613c5164d76cdc2420736396358ff443cf378dc3c1746e0946c8df4e03b91a406deb289d12fd8838c887822c6786088f28bc59d161bdf087dde578f25b37912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3c0aa53a0db831d00ad953b9534b86e2

SHA1
5eaa809c703fe1ed2a342eb430dbae64957fe6c4

SHA256
b295dcf31cc400d20682256b9579165f222e34cd22681538c6606c237790d6aa

SHA512
e46501b2001ea644d012d98f7dd9704a00d139ddb6567985fd2807043474a36699784b8e5e3b1f56cdfa8ce8722bfc9b1e1df46b6878fd961f1b7c4fa823bc08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d042cb37a35997ddd8f4a6c0d00baa91

SHA1
fe55abf82e88d35ed425a5e3f37f12888a8aa96b

SHA256
3e70fd9a6850d0ef366ee6c3596cd438164b65a27236f6973852e8e591edfe03

SHA512
6fe702b7142d4f2e9bec5c4b5ca54c87e32f7893d98b162efc42c2d198bed23fbd31e4e7d49ccb09c60c1d1f1fc7f26fcef0f29dc1f7c348381f858403db6907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9409034d710801f0da662744c6bb8356

SHA1
e6cb5e579735357bb22be4d80fdb3b7b547536b1

SHA256
7b2859ebcaa642bdd22205ef8999f1b8f7462576baef19810dc2318fca635282

SHA512
e58038aaeed187d907580b7e0345980e13a7cf68240b9214622f29f4c24d0b6edfb63cbb548d1ab42854dfa8f19f2205df225f4cc2f8204c83479709ab30c1b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fa3d88af8987394f79419f209a6a253a

SHA1
1b049dbb0ea6f0b6b16569769e0c697a5c62e18c

SHA256
2fb7e340b65e4faaff77c340abfd9ea8b6b6fca83bf0cc0645dedb90e5bbbdda

SHA512
52bef61b72089b330bd1c15256bce74cc831c28abeb00ab978db23148187c4c999e7f8e71431abeead49ec5c862e567e7c7bd5d8a2df1465e3d3e431f0a7ea36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
015a8291a127ce71660e5cf60475c08c

SHA1
840c47f5dbd8331239fef3b9ada6ce460d5cec52

SHA256
5ece8d421b1cdc980ecbb8b56f4d641f3c73742547b7f8a1258590d4b98dbacf

SHA512
fbd9db93791ff6dd22a2c036475a0ef4ca8d391952c5e26d65d9572f48832236c2316d55209feb462fa2bbe021146e4db7b35f1023e94a66ae8deaf82ac7ca60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ab054f42ef531a027320ddabb5ca35e

SHA1
3ffdbd3a0940d708e6ad24287a527618cdb65181

SHA256
394b6fa5e093c497ed254ac49942a3f5304357e9da515ec11921918a31aca199

SHA512
bb1feac130f7e8d137fbc329e1868ef8fead9f953df96f4386db2f3ed54c03abaa6573448504255f1c1ae74d846b5cf6bc2fe464a872c42ef21817622478a88b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1de2ed9ff49bb4e05194189fc1292e14

SHA1
49d2ff61b99a098644bf7eefcdd908770637be3c

SHA256
28ca01f3ca2d2d99e5e41b043fa386e3f76e23cdde552d83c85cc65a67423cfd

SHA512
d9eff03d14f2a7c691547000557e7cdc5def23610a86e31737e66e517834c88d4d1917ea3d6aa82592ed904b199a49b354e153e31638ee1a342a7800ccd3e3f5

Download Submit
C:\Users\Admin\AppData\Local\NoRiskClient\NoRiskClient.exe

Filesize
24.1MB

MD5
7d929f591f13130f6c67454bac84d05b

SHA1
e553491a5a39cbf4e696920211ecc78478c1b837

SHA256
573ee13874c9e30e90f632459143c7ecce1a8caf4515919305258b4a12d1e4dd

SHA512
7f11d9f2db2bccb42c2444c47465bdc69343b9500b0d15ed9990c0e44ff457773757b2e2ed7fffccbb972f9f6a3c6c59ea16d3a56e1b1fb4d9ef2220caf5d2d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

Filesize
1.6MB

MD5
45e5ca74b9ae3c3fc6f6a63c609783b6

SHA1
f36715bea96d69bb18075fac30b90502c6d2464b

SHA256
b4afd37b9087df7e041ae749fd0fa342926d9cce533bde9cdc4283132c3820a9

SHA512
014fd398d456fcb118dfd6b038b6f96008ca209d44d9707e175e85e7f14cfb3f2886deaed0d8ed25971813035e8dd7f88142c06972f3e2c9b4a534d84bec661a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6BE6.tmp\StartMenu.dll

Filesize
7KB

MD5
d070f3275df715bf3708beff2c6c307d

SHA1
93d3725801e07303e9727c4369e19fd139e69023

SHA256
42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7

SHA512
fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6BE6.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6BE6.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6BE6.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6BE6.tmp\nsis_tauri_utils.dll

Filesize
29KB

MD5
8def0196223484f8aed4106148dd3f08

SHA1
e0fc0951deb0e5e741df10328f95c7d6678ad3aa

SHA256
c0f2b928bc4c81cc5ca30a8932a6dc8cd617dd016679c057e23355fe732b2333

SHA512
9ffa66181bce5aa5210da0fe5edc6c80aa9e46e2bd1fafd840f468965f4d06bc03f9a77e04b975ffc9f25c886c274196e3fedae6cfb57f366ef39f1e31e1ada7

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
3d3715565f91f4c59e19b49d4eec796a

SHA1
42d90019d306578bbe77b3c4662d6640f61bdb1a

SHA256
cedfdf5afb9ccb06277e413221d76f385c601ddcab639ec9ca2b90980636594f

SHA512
053a53cbd845000ae2597cbc300cb37fcee0bdebde351a72b38d2f521bc19623fd2fd0db4afb235d50711d0886e7724dd89aa0298c5b19b1b4f4b769129cb7d9

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
f7a79ccbb68ef1c3f78728912d893b60

SHA1
0181ffc10ac8a1d47817d80433f555701663214b

SHA256
e2915565d44fd216d9e785f5f95694f581e901ade92b479a2394770728b9dd99

SHA512
62b1ed87616bb3ba9f44ba612961ac96d872f83abb5d14cfacfabe289b5a7541789a257385c443484c7b9ade48af1a331d1aaa61d80d6377925a21f1ff9ae1e5

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
56635a3a25dedc1c93371d4cb48f1964

SHA1
7e38f3264f1958645f83c9cd800f93f29de10f7c

SHA256
73a73c9187ed5aec54744dfcf85540e9d0f732be291b21dfe5368611fa4f16ec

SHA512
99bd65ae17edb753cbdac636fb0629a7d668b324663cacbcd44c1fe5a0123d50a14e78b736e7fdedd45781d46e89276a929f3d95e32c17ce36b2a9a656ff8f8e

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
de07822d8dc4bd7ea9112c77cc6c1522

SHA1
c58bdd2e6d7fc48b59b14a6bb764f59d167a97c0

SHA256
1caaaf38259b7e7cbbafe5e901a2a07c9ec71338a600f3171b900e2e8c88df0f

SHA512
f0d0ca2ddfe0c2dcd67816c5a6bce38ffb4c46833d8650848ea9188fea0e3147bda514e852688b36db345036d99cec5ace8fbfa8769040afd07ecb69fc8e1def

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b2599eb3cfcca170aaeec6eee365c3bb

SHA1
cafc9dcc83469b284259bab2bc4fd755db1aab91

SHA256
8d57b3b41c3972a9389bce386086d43ffd975bdfe9c7b6a0959cff4678a1c6f2

SHA512
deefcf531fd8877825fc9464a0818b15a43915cf3e09fe72ade907f651ac441c0f03fa406b21135c7bc6c9c051cef6a90e3cb984cbc7c0221dc15d07ebfadb7a

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Default\Extension Rules\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Default\Network\Network Persistent State

Filesize
426B

MD5
20755e4570028d62ca42820d34917f34

SHA1
d6cc2df85a5ea559dcb98c21740bec307d390d2c

SHA256
a99a16a34121f00af5949afeb1a105f98047b5cdc954964a2976ddc353549d0c

SHA512
5689f5ea196928b6a721a269fb3321cc595e7eb1e95d0d0b0d822e8e70cc6455b6682c4fb592e41b214e29f63805d8a6268bc48ee75ae041f364ccdaec603a50

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Default\Network\Network Persistent State~RFe5ad245.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Default\Preferences

Filesize
6KB

MD5
ceaf6011fd52b5cd3552056c7f42648f

SHA1
1f421e17eff464857b0a756ec452ff6111b1da75

SHA256
d8c4f84e20980106a0fb697e2bdc64142d7c549a47607b289e31b22049ab3a31

SHA512
4c26f7f64a3b4c4713554e771198cdd8a23b53bcc1f2c978e331558db1b96eb94925daf9bcae64d705c5d71ac38acfa59ff839ec5be97ceca8f9339000909ac0

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Default\Preferences

Filesize
6KB

MD5
f6091b8f5438632aaaece3a77ec5a61d

SHA1
eba33ea115f34b775526870cc03dbf72d8f068e3

SHA256
0096855a271b1fb7cf9b2eb042f6305c7e8f0fc7b931018e92c9f6b070572208

SHA512
b534d755d6bade667a8c2e6ac21b94a43a4387b71bd3b28157c175e4c7cc85255bd88b4cc2d5b90952dd98c81c887d6d63457437b9939ff3cf4bb54ec55ba50d

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Default\ce35c457-c187-42c4-b852-74ee7d5dbf85.tmp

Filesize
6KB

MD5
bcaae1d865799faa20eae474ac2644c3

SHA1
6b1b293e06c038f87c09b275e89d6a1f64273b68

SHA256
a5c5bc6356aa2f612dd6e2abd2f7a6aa7b0d1f98f41558aa5e45ca48324f8e13

SHA512
49f60576658587d58679f70e9260c6516cae9ec1c63b87ee3c59f1188decd3a07d4e49a3666cd9fce2ed7b88f08f0f9b6ef11924682e9e71f049932beaf9dce5

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\GrShaderCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\GrShaderCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\GrShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\GrShaderCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Local State

Filesize
1KB

MD5
9fde3249073990209171901cbf06c3ca

SHA1
d1299bb60cb8c7710ce92af23b85b32cedb30ea3

SHA256
ba34fde492d6cdf165e38cdcb0f3d20fe51b755cb89163ca161bfd9b5170a97d

SHA512
ec0417d58508a5974c916745fe8a91c4d966f7109c07366e2827ac4fc6b0efd9fd98e6ab8b37bbe7607722b3fb4e02b3929ddf1e5c6d2397e70dcee56d1c9090

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Local State

Filesize
2KB

MD5
19d8c4d64ba858fa3d0b07af823d3888

SHA1
df75de798858f0547585501995ff41a6639ee4fb

SHA256
8df17289c13732e631cce8ae1acd841ecd92afba0a7c52e5aa30f21acb715b42

SHA512
cc42ff84ea26ffde2a4d3bfee52d6da9d24659ec972ab0df59d7426cebef33cb6d70364617439b626d91aa9e6842676185407d629473ca7bca9fb5201af2d37e

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Local State

Filesize
3KB

MD5
06d27b87150625a02b5122a956c6ab11

SHA1
341ccd7f6c5bacfa3cbf86be0aad6c931be56e92

SHA256
cd3d05751b10c8f00b47e0f5fac8bcf52334c3e56ac68c18687073de835b49f6

SHA512
73af4ad446cc83472b52f51466a4023d0075dc92097d6ddc422c5061a1f0cf3827893ef6e8da6eaf0edd860438e3aaead37190697856fc4fad56239a9605aef5

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Local State

Filesize
16KB

MD5
8f0c846a968ca840a794984a1eff133a

SHA1
a27a1b2ccd9f32f0ee1e4aa935698c0bcaf7ee66

SHA256
f918b31fcba8063161f26d760f6e4dc9060fd75886e8c624d8fc66431022aabc

SHA512
f31724f058ae4a28c2c4b16d0245168c8c31eb2d27138bac57ffa4bd646508fde031ab3f950fb8a9fd1131944d97dd9ef31650dd7993c8ad04e94c438fb86315

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Local State

Filesize
16KB

MD5
6083773d8a78ff3e7d41a4d4b2768e2f

SHA1
6c56c718bef1732db184276a32e8e57deb4d5028

SHA256
e3143a9429299729a4fdfb1d4b0ba62bdd0bf70a9b6cae0dbacd37a1ef33cfaa

SHA512
2e171a0e578cf50136c9d9f9234169f501ff525d8b204cdcaad283aca075ef0fd7ac49ea9e858883ced1c65e82c2deaa1d81498703079e78086a11a03b8dcd26

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Local State

Filesize
17KB

MD5
8bb82e0e89f1d778a054c407cfade23a

SHA1
c90a0cfd1a5c040efbed1259b43bce139c24bafa

SHA256
aa6fd2634254d5de0e20534b96fe700ddab4ca835ec2784145cb803a0657da6e

SHA512
413cef97e546f898eb3dfa3e8d5263eef0d7ce26ffa9d6c21de0433128e460ef6b96b532aba3485dcde694eb926d88538d37adff65241b042a7b308fe080602c

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Local State

Filesize
18KB

MD5
ffc0c2c71f3f42b537bf176316245701

SHA1
fae87222103e04d82c76fd93faca173d7c051af7

SHA256
b0c35bce2f2471d97827f4c71bcd89985449c5d9be850af74199cf9dc2579903

SHA512
c19a4417005af5f037f86ed93eabea5f21e4073f0d788908284ded10de0815515322a8075b03dcdee30d2ad6c2296c5a9fe0fc12e929bd022cccf1ef208f62ae

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Local State

Filesize
18KB

MD5
4726ff087503eca5c41a6144db812012

SHA1
cf565efc569e74374e29d138669172a434db7a25

SHA256
fd485f0a9c9c17ebf56d9e35536ee267ab0099f41c1da5c027b54cc8f6b26b8e

SHA512
519c1fd16b4a52331d8a7556ca898e76449ff42ef40bf4ed9ca13ec6e0dde473b09902dd75c54ab79aa49b246f7db0de6b32bc1edd94f14979fbf6ffb3cd9896

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\Local State~RFe59ab88.TMP

Filesize
1KB

MD5
8c6ce1bdbf50583813b19dcb126a5f10

SHA1
e828508f9b2c4dbbbaf2b7106e4f2bbbbcb20109

SHA256
5653e34e480f2d9b9b7663ab50e5efb94dee2deabed79aaad1facdb75737741e

SHA512
cd36d925cc43d2330c46f41fe779d42c55bc32d2c2b084fa8a0255474c7a378a64db156e427ec51ac7c2d5efa2dfc1872eff1ce759543e79c1e48dbab8f5972a

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\PKIMetadata\13.0.0.0\crs.pb

Filesize
278KB

MD5
981a9155cad975103b6a26acef33a866

SHA1
1965290a94d172c4def1ac7199736c26dccca33e

SHA256
971393390616fbe53c63865274a40a0b4a8e731c529664275bdc764f09a28e2d

SHA512
2d75ce25cb3a78f69f90fbd23f6e5c9f1a6ed92025f83ce0ab3e0320b64130d586fc2cd960f763e1ab2c82d35ef9650ebd7ff2a42a928a293e0e7428cc669119

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\PKIMetadata\13.0.0.0\ct_config.pb

Filesize
7KB

MD5
df3d937079b894c891f9b0b741874928

SHA1
ed93fc386807b3a28fcc7988a88ae4741bfe1b15

SHA256
c7cbb0db6e924cbfccf4a6e8223e3fed4d93f5d78a3122c30213b6e38ee195f4

SHA512
5728bdd930283a4906e7e07acd3eadecb813a3154ffb41729738444bf13aab27dceb01e05a27c77bb13cc498c1d5c2d492ac653ddbfe4b14004b1c7a5bc54f1b

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\PKIMetadata\13.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
d43d041e531dc757a69a90cb657ef437

SHA1
09138b427565bc276cfd3ba9f59b0c8bad78e91d

SHA256
9431360a5534ad2f8eddde157cce39704b99da035fcb6d2cca11220700b11ccb

SHA512
476a98122059b9cc19492b7ae557c61381842c8c347f85c686e0a493bfd0e8707ce3491b690e7978b3fb7d7d2a4daa2767e4a590398a50562519bf32e8d12ec6

Download Submit
C:\Users\Admin\AppData\Local\gg.norisk.noriskclient\EBWebView\TrustTokenKeyCommitments\2024.8.10.1\keys.json

Filesize
6KB

MD5
4049325bf91ed62d8e023e28c89ead1a

SHA1
b3be36e16e120550a6f5aac88a009ca0ea7590a6

SHA256
6aff1412bbe12d18cc2b0ccc3815991d14f898d7019c27bbb5f17f128d14cda3

SHA512
64be3c0a4c1f056b0e511851553c959ec6e820b8890d50fd5f53ff1f7fd79a0e40a7432ae01ffa882c91bb2351916ba9ac45a871e41a8f134fd8867dc3b6066c

Download Submit
C:\Users\Admin\AppData\Roaming\norisk\NoRiskClient\config\accounts.json

Filesize
2KB

MD5
9f50bb6a644c459fb943a912db52c3bf

SHA1
b07092516b28cd593ebcc887e5b5343f2e1315e0

SHA256
97a63d3b6209c2a2e1e09385d43ffb7375c36de1cd143f0f5b334f78d63efead

SHA512
0b80449a4a1b19305c30b8c15bf83b5d6e3db7661b0bdee125f2e654799c3c474036c632c631297f786535cc0eb12b9d34e36a6e8d10b01f74998852c84a865b

Download Submit
C:\Users\Admin\AppData\Roaming\norisk\NoRiskClient\config\launcher_profiles.json

Filesize
138B

MD5
5fd09b6eb0e0020d6aa2c76559235c62

SHA1
06225d2bfec2c23c105f27901f0ba00c839f5491

SHA256
13c63b42fca339d447ac251a653fc7d07e0f30991d76d1b8b81475d53f29a065

SHA512
39e66627f0575d28803e2dec79bf0638320a226a50b42eda079098ae44e3e8d383c4608ac0e77554c7fd193bd660306d1741921c72d70db0a7e7e736f8a64546

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 359297.crdownload

Filesize
8.7MB

MD5
9a2bf1da458ab8274d348aa9a0dbc4ae

SHA1
275e32ce0ffe3351697d9f237bd25095bf5ffeb8

SHA256
c23e9205fa517e0b556ae8f6085dcd836e2d62387e934e6042ba1fbc55829c1a

SHA512
84cd1e8c4c0c1bc199ba608aa5a29b4d63e5abba11853f7d0009e65cfe64d3587a5963d2563fa8f111fcbff01e70827e96b0499719dfa1d6ebf782b906a849be

Download Submit
memory/2336-704-0x000001AFA0700000-0x000001AFA0815000-memory.dmp

Filesize
1.1MB

Download
memory/2336-490-0x00007FF9EB810000-0x00007FF9EB811000-memory.dmp

Filesize
4KB

Download
memory/4052-1096-0x0000028A906A0000-0x0000028A906A1000-memory.dmp

Filesize
4KB

Download
memory/4052-1088-0x0000028A906A0000-0x0000028A906A1000-memory.dmp

Filesize
4KB

Download
memory/4052-1099-0x0000028A906A0000-0x0000028A906A1000-memory.dmp

Filesize
4KB

Download
memory/4052-1098-0x0000028A906A0000-0x0000028A906A1000-memory.dmp

Filesize
4KB

Download
memory/4052-1097-0x0000028A906A0000-0x0000028A906A1000-memory.dmp

Filesize
4KB

Download
memory/4052-1095-0x0000028A906A0000-0x0000028A906A1000-memory.dmp

Filesize
4KB

Download
memory/4052-1094-0x0000028A906A0000-0x0000028A906A1000-memory.dmp

Filesize
4KB

Download
memory/4052-1089-0x0000028A906A0000-0x0000028A906A1000-memory.dmp

Filesize
4KB

Download
memory/4052-1090-0x0000028A906A0000-0x0000028A906A1000-memory.dmp

Filesize
4KB

Download
memory/4052-1100-0x0000028A906A0000-0x0000028A906A1000-memory.dmp

Filesize
4KB

Download
memory/4888-410-0x0000000073E10000-0x0000000074035000-memory.dmp

Filesize
2.1MB

Download
memory/4888-446-0x00000000005C0000-0x00000000005F5000-memory.dmp

Filesize
212KB

Download
memory/4888-354-0x0000000073E10000-0x0000000074035000-memory.dmp

Filesize
2.1MB

Download
memory/4888-353-0x00000000005C0000-0x00000000005F5000-memory.dmp

Filesize
212KB

Download
memory/5732-594-0x00007FF9EB810000-0x00007FF9EB811000-memory.dmp

Filesize
4KB

Download
memory/6008-572-0x00007FF9ECC00000-0x00007FF9ECC01000-memory.dmp

Filesize
4KB

Download
memory/6008-573-0x00007FF9EB810000-0x00007FF9EB811000-memory.dmp

Filesize
4KB

Download