9ab1f0f955d23c0a2a0e3727a9f778bef9057d4b615df3f6194906dac49e2c26

Resubmissions

21/09/2024, 02:03

240921-cgz6dszfpl 8

21/09/2024, 01:42

21/09/2024, 01:37

21/09/2024, 01:13

21/09/2024, 01:00

21/09/2024, 00:55

Analysis

max time kernel
331s
max time network
337s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EZFNLauncher.msi
Size

8.8MB
MD5

c094ae439f4a97409d752fa64f6eab86
SHA1

e607d4616a2262bb245c43269d7c3f769269e5d0
SHA256

9ab1f0f955d23c0a2a0e3727a9f778bef9057d4b615df3f6194906dac49e2c26
SHA512

df8bd4db2130cdf94493caa170801cfc1e273aa22253d33b066db3be56b164c904f54172bb6f60afd131f9459a8e9895d718bb905420f067936862d86ed9506e
SSDEEP

196608:hwrQNEqoCdzOx618QNSi2lfVc6VpvPH62RM7tBIbK1/JuhC:hgcOxvQgllfjXtr8/kh

Score

8^/10

discovery evasion execution motw persistence phishing privilege_escalation trojan

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
32	1728	powershell.exe
46	1728	powershell.exe
48	1728	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1728	powershell.exe
1728	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EZFN Launcher.exe

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
437	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3304_1711107426\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Locales\kok.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\PrivacySandboxAttestationsPreloaded\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\Locales\mi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_ja.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\VisualElements\Logo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\vercel.svg	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\msedge_pwa_launcher.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\dxil.dll	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\BHO\ie_to_edge_stub.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\libGLESv2.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\identity_proxy\win10\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Locales\cy.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\pwahelper.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\vccorlib140.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Locales\ml.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\Locales\mk.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3304_3286382\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_bg.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_fil.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Locales\fr-CA.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Trust Protection Lists\Mu\Other	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Locales\km.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Locales\lv.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Locales\lt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedge.dll.sig	setup.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season7.webp	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Trust Protection Lists\Sigma\Fingerprinting	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Trust Protection Lists\Mu\CompatExceptions	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\mip_protection_sdk.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\mspdf.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\edge_feedback\camera_mf_trace.wprp	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_it.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\d3dcompiler_47.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Locales\ca-Es-VALENCIA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\edge_feedback\camera_mf_trace.wprp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\Locales\kn.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\Locales\zh-TW.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3304_1309528483\Filtering Rules	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Locales\gu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\Trust Protection Lists\Mu\LICENSE	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\dxil.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Trust Protection Lists\Sigma\Other	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\Trust Protection Lists\Mu\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\Locales\en-GB.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3304_1711107426\hyph-la.hyb	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\Locales\es.pak	setup.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\Inter-VariableFont_slnt,wght.ttf	msiexec.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\edge_feedback\mf_trace.wprp	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\PdfPreview\PdfPreviewHandler.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Trust Protection Lists\Mu\TransparentAdvertisers	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_sr.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\identity_proxy\win10\identity_helper.Sparse.Canary.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\identity_proxy\win10\identity_helper.Sparse.Internal.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\dual_engine_adapter_x64.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_cy.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\delegatedWebFeatures.sccd	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\msedge_proxy.exe	setup.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57de1b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF06.tmp	msiexec.exe
File created	C:\Windows\Installer\{260316EE-A4F4-4E07-8E2E-D899FBE40CA3}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e57de1d.msi	msiexec.exe
File created	C:\Windows\Installer\e57de1b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{260316EE-A4F4-4E07-8E2E-D899FBE40CA3}	msiexec.exe
File opened for modification	C:\Windows\Installer\{260316EE-A4F4-4E07-8E2E-D899FBE40CA3}\ProductIcon	msiexec.exe

Executes dropped EXE 36 IoCs

pid	Process
2916	MicrosoftEdgeWebview2Setup.exe
3160	MicrosoftEdgeUpdate.exe
4528	MicrosoftEdgeUpdate.exe
5084	MicrosoftEdgeUpdate.exe
4364	MicrosoftEdgeUpdateComRegisterShell64.exe
3036	MicrosoftEdgeUpdateComRegisterShell64.exe
2396	MicrosoftEdgeUpdateComRegisterShell64.exe
1976	MicrosoftEdgeUpdate.exe
3132	MicrosoftEdgeUpdate.exe
960	MicrosoftEdgeUpdate.exe
2200	MicrosoftEdgeUpdate.exe
1224	MicrosoftEdge_X64_129.0.2792.52.exe
3792	setup.exe
4032	setup.exe
3760	MicrosoftEdgeUpdate.exe
376	EZFN Launcher.exe
3304	msedgewebview2.exe
2616	msedgewebview2.exe
4784	msedgewebview2.exe
1972	msedgewebview2.exe
4920	msedgewebview2.exe
1536	msedgewebview2.exe
2500	msedgewebview2.exe
7692	msedgewebview2.exe
3928	msedgewebview2.exe
6744	msedgewebview2.exe
5196	msedgewebview2.exe
1500	msedgewebview2.exe
5208	msedgewebview2.exe
8024	EZFN Launcher.exe
7204	EZInstaller.exe
7800	EZInstaller.exe
7684	msedgewebview2.exe
2704	msedgewebview2.exe
5364	EZInstaller.exe
6956	EZInstaller.exe

Loads dropped DLL 64 IoCs

pid	Process
2944	MsiExec.exe
3160	MicrosoftEdgeUpdate.exe
4528	MicrosoftEdgeUpdate.exe
5084	MicrosoftEdgeUpdate.exe
4364	MicrosoftEdgeUpdateComRegisterShell64.exe
5084	MicrosoftEdgeUpdate.exe
3036	MicrosoftEdgeUpdateComRegisterShell64.exe
5084	MicrosoftEdgeUpdate.exe
2396	MicrosoftEdgeUpdateComRegisterShell64.exe
5084	MicrosoftEdgeUpdate.exe
1976	MicrosoftEdgeUpdate.exe
3132	MicrosoftEdgeUpdate.exe
960	MicrosoftEdgeUpdate.exe
960	MicrosoftEdgeUpdate.exe
3132	MicrosoftEdgeUpdate.exe
2200	MicrosoftEdgeUpdate.exe
3760	MicrosoftEdgeUpdate.exe
2944	MsiExec.exe
376	EZFN Launcher.exe
3304	msedgewebview2.exe
2616	msedgewebview2.exe
3304	msedgewebview2.exe
3304	msedgewebview2.exe
3304	msedgewebview2.exe
4784	msedgewebview2.exe
1972	msedgewebview2.exe
4784	msedgewebview2.exe
4920	msedgewebview2.exe
4920	msedgewebview2.exe
4784	msedgewebview2.exe
4784	msedgewebview2.exe
4784	msedgewebview2.exe
1972	msedgewebview2.exe
4784	msedgewebview2.exe
1536	msedgewebview2.exe
1536	msedgewebview2.exe
1536	msedgewebview2.exe
3304	msedgewebview2.exe
2500	msedgewebview2.exe
2500	msedgewebview2.exe
7692	msedgewebview2.exe
7692	msedgewebview2.exe
3928	msedgewebview2.exe
3928	msedgewebview2.exe
6744	msedgewebview2.exe
6744	msedgewebview2.exe
5196	msedgewebview2.exe
5196	msedgewebview2.exe
5196	msedgewebview2.exe
1500	msedgewebview2.exe
1500	msedgewebview2.exe
5208	msedgewebview2.exe
5208	msedgewebview2.exe
7800	EZInstaller.exe
7800	EZInstaller.exe
7800	EZInstaller.exe
7800	EZInstaller.exe
7800	EZInstaller.exe
7800	EZInstaller.exe
7800	EZInstaller.exe
7800	EZInstaller.exe
7800	EZInstaller.exe
7800	EZInstaller.exe
7800	EZInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2792	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3760	MicrosoftEdgeUpdate.exe
1976	MicrosoftEdgeUpdate.exe
2200	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a54fc9f1d525247c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a54fc9f10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a54fc9f1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da54fc9f1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a54fc9f100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133713542152109957"	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\ezfn\shell\open\command\ = "C:\\Program Files\\EZFN Launcher\\EZFN Launcher.exe \"%1\""	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ELEVATION	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0B4C1840-3931-4AA5-A64F-95339D05E614}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass.1\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31FB561A-CD57-4AF0-AE52-5652A86256B1}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ = "IPolicyStatus5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B4C1840-3931-4AA5-A64F-95339D05E614}\InprocHandler32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.19\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	EZFN Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2276	msiexec.exe
2276	msiexec.exe
1728	powershell.exe
1728	powershell.exe
1728	powershell.exe
3160	MicrosoftEdgeUpdate.exe
3160	MicrosoftEdgeUpdate.exe
3160	MicrosoftEdgeUpdate.exe
3160	MicrosoftEdgeUpdate.exe
3160	MicrosoftEdgeUpdate.exe
3160	MicrosoftEdgeUpdate.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
4500	msedge.exe
4500	msedge.exe
2796	msedge.exe
2796	msedge.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
376	EZFN Launcher.exe
5332	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs

pid	Process
3304	msedgewebview2.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2792	msiexec.exe
Token: SeSecurityPrivilege	2276	msiexec.exe
Token: SeCreateTokenPrivilege	2792	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2792	msiexec.exe
Token: SeLockMemoryPrivilege	2792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2792	msiexec.exe
Token: SeMachineAccountPrivilege	2792	msiexec.exe
Token: SeTcbPrivilege	2792	msiexec.exe
Token: SeSecurityPrivilege	2792	msiexec.exe
Token: SeTakeOwnershipPrivilege	2792	msiexec.exe
Token: SeLoadDriverPrivilege	2792	msiexec.exe
Token: SeSystemProfilePrivilege	2792	msiexec.exe
Token: SeSystemtimePrivilege	2792	msiexec.exe
Token: SeProfSingleProcessPrivilege	2792	msiexec.exe
Token: SeIncBasePriorityPrivilege	2792	msiexec.exe
Token: SeCreatePagefilePrivilege	2792	msiexec.exe
Token: SeCreatePermanentPrivilege	2792	msiexec.exe
Token: SeBackupPrivilege	2792	msiexec.exe
Token: SeRestorePrivilege	2792	msiexec.exe
Token: SeShutdownPrivilege	2792	msiexec.exe
Token: SeDebugPrivilege	2792	msiexec.exe
Token: SeAuditPrivilege	2792	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2792	msiexec.exe
Token: SeChangeNotifyPrivilege	2792	msiexec.exe
Token: SeRemoteShutdownPrivilege	2792	msiexec.exe
Token: SeUndockPrivilege	2792	msiexec.exe
Token: SeSyncAgentPrivilege	2792	msiexec.exe
Token: SeEnableDelegationPrivilege	2792	msiexec.exe
Token: SeManageVolumePrivilege	2792	msiexec.exe
Token: SeImpersonatePrivilege	2792	msiexec.exe
Token: SeCreateGlobalPrivilege	2792	msiexec.exe
Token: SeCreateTokenPrivilege	2792	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2792	msiexec.exe
Token: SeLockMemoryPrivilege	2792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2792	msiexec.exe
Token: SeMachineAccountPrivilege	2792	msiexec.exe
Token: SeTcbPrivilege	2792	msiexec.exe
Token: SeSecurityPrivilege	2792	msiexec.exe
Token: SeTakeOwnershipPrivilege	2792	msiexec.exe
Token: SeLoadDriverPrivilege	2792	msiexec.exe
Token: SeSystemProfilePrivilege	2792	msiexec.exe
Token: SeSystemtimePrivilege	2792	msiexec.exe
Token: SeProfSingleProcessPrivilege	2792	msiexec.exe
Token: SeIncBasePriorityPrivilege	2792	msiexec.exe
Token: SeCreatePagefilePrivilege	2792	msiexec.exe
Token: SeCreatePermanentPrivilege	2792	msiexec.exe
Token: SeBackupPrivilege	2792	msiexec.exe
Token: SeRestorePrivilege	2792	msiexec.exe
Token: SeShutdownPrivilege	2792	msiexec.exe
Token: SeDebugPrivilege	2792	msiexec.exe
Token: SeAuditPrivilege	2792	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2792	msiexec.exe
Token: SeChangeNotifyPrivilege	2792	msiexec.exe
Token: SeRemoteShutdownPrivilege	2792	msiexec.exe
Token: SeUndockPrivilege	2792	msiexec.exe
Token: SeSyncAgentPrivilege	2792	msiexec.exe
Token: SeEnableDelegationPrivilege	2792	msiexec.exe
Token: SeManageVolumePrivilege	2792	msiexec.exe
Token: SeImpersonatePrivilege	2792	msiexec.exe
Token: SeCreateGlobalPrivilege	2792	msiexec.exe
Token: SeCreateTokenPrivilege	2792	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2792	msiexec.exe
Token: SeLockMemoryPrivilege	2792	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2792	msiexec.exe
2792	msiexec.exe
376	EZFN Launcher.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
376	EZFN Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2944	2276	msiexec.exe	87
PID 2276 wrote to memory of 2944	2276	msiexec.exe	87
PID 2276 wrote to memory of 2944	2276	msiexec.exe	87
PID 2276 wrote to memory of 1076	2276	msiexec.exe	96
PID 2276 wrote to memory of 1076	2276	msiexec.exe	96
PID 2276 wrote to memory of 1728	2276	msiexec.exe	98
PID 2276 wrote to memory of 1728	2276	msiexec.exe	98
PID 1728 wrote to memory of 2916	1728	powershell.exe	103
PID 1728 wrote to memory of 2916	1728	powershell.exe	103
PID 1728 wrote to memory of 2916	1728	powershell.exe	103
PID 2916 wrote to memory of 3160	2916	MicrosoftEdgeWebview2Setup.exe	104
PID 2916 wrote to memory of 3160	2916	MicrosoftEdgeWebview2Setup.exe	104
PID 2916 wrote to memory of 3160	2916	MicrosoftEdgeWebview2Setup.exe	104
PID 3160 wrote to memory of 4528	3160	MicrosoftEdgeUpdate.exe	105
PID 3160 wrote to memory of 4528	3160	MicrosoftEdgeUpdate.exe	105
PID 3160 wrote to memory of 4528	3160	MicrosoftEdgeUpdate.exe	105
PID 3160 wrote to memory of 5084	3160	MicrosoftEdgeUpdate.exe	106
PID 3160 wrote to memory of 5084	3160	MicrosoftEdgeUpdate.exe	106
PID 3160 wrote to memory of 5084	3160	MicrosoftEdgeUpdate.exe	106
PID 5084 wrote to memory of 4364	5084	MicrosoftEdgeUpdate.exe	107
PID 5084 wrote to memory of 4364	5084	MicrosoftEdgeUpdate.exe	107
PID 5084 wrote to memory of 3036	5084	MicrosoftEdgeUpdate.exe	108
PID 5084 wrote to memory of 3036	5084	MicrosoftEdgeUpdate.exe	108
PID 5084 wrote to memory of 2396	5084	MicrosoftEdgeUpdate.exe	109
PID 5084 wrote to memory of 2396	5084	MicrosoftEdgeUpdate.exe	109
PID 3160 wrote to memory of 1976	3160	MicrosoftEdgeUpdate.exe	110
PID 3160 wrote to memory of 1976	3160	MicrosoftEdgeUpdate.exe	110
PID 3160 wrote to memory of 1976	3160	MicrosoftEdgeUpdate.exe	110
PID 3160 wrote to memory of 3132	3160	MicrosoftEdgeUpdate.exe	111
PID 3160 wrote to memory of 3132	3160	MicrosoftEdgeUpdate.exe	111
PID 3160 wrote to memory of 3132	3160	MicrosoftEdgeUpdate.exe	111
PID 960 wrote to memory of 2200	960	MicrosoftEdgeUpdate.exe	113
PID 960 wrote to memory of 2200	960	MicrosoftEdgeUpdate.exe	113
PID 960 wrote to memory of 2200	960	MicrosoftEdgeUpdate.exe	113
PID 960 wrote to memory of 1224	960	MicrosoftEdgeUpdate.exe	115
PID 960 wrote to memory of 1224	960	MicrosoftEdgeUpdate.exe	115
PID 1224 wrote to memory of 3792	1224	MicrosoftEdge_X64_129.0.2792.52.exe	116
PID 1224 wrote to memory of 3792	1224	MicrosoftEdge_X64_129.0.2792.52.exe	116
PID 3792 wrote to memory of 4032	3792	setup.exe	117
PID 3792 wrote to memory of 4032	3792	setup.exe	117
PID 960 wrote to memory of 3760	960	MicrosoftEdgeUpdate.exe	118
PID 960 wrote to memory of 3760	960	MicrosoftEdgeUpdate.exe	118
PID 960 wrote to memory of 3760	960	MicrosoftEdgeUpdate.exe	118
PID 2944 wrote to memory of 376	2944	MsiExec.exe	120
PID 2944 wrote to memory of 376	2944	MsiExec.exe	120
PID 376 wrote to memory of 3304	376	EZFN Launcher.exe	121
PID 376 wrote to memory of 3304	376	EZFN Launcher.exe	121
PID 3304 wrote to memory of 2616	3304	msedgewebview2.exe	122
PID 3304 wrote to memory of 2616	3304	msedgewebview2.exe	122
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123
PID 3304 wrote to memory of 4784	3304	msedgewebview2.exe	123

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\EZFNLauncher.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2792

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B6AADC6BA9C85C21A8EC79F08528A784 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Program Files\EZFN Launcher\EZFN Launcher.exe
    "C:\Program Files\EZFN Launcher\EZFN Launcher.exe"
    3⤵
    - Checks whether UAC is enabled
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.4 --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --no-proxy-server --lang=en-US --mojo-named-platform-channel-pipe=376.3264.17704695787692266760
      4⤵
      Checks computer location settings
      Checks system information in the registry
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3304
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=129.0.6668.59 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=129.0.2792.52 --initial-client-data=0x160,0x164,0x168,0x13c,0x194,0x7ffc16a68ee0,0x7ffc16a68eec,0x7ffc16a68ef8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2616
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1824,i,4096303994238166669,14246748038600855259,262144 --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4784
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1892,i,4096303994238166669,14246748038600855259,262144 --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1972
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2308,i,4096303994238166669,14246748038600855259,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4920
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3520,i,4096303994238166669,14246748038600855259,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1536
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2228,i,4096303994238166669,14246748038600855259,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2500
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2084,i,4096303994238166669,14246748038600855259,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7692
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4892,i,4096303994238166669,14246748038600855259,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3928
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5012,i,4096303994238166669,14246748038600855259,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6744
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4916,i,4096303994238166669,14246748038600855259,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5196
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4376,i,4096303994238166669,14246748038600855259,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1500
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4324,i,4096303994238166669,14246748038600855259,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5208
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=3936,i,4096303994238166669,14246748038600855259,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:7684
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.52\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4560,i,4096303994238166669,14246748038600855259,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc304546f8,0x7ffc30454708,0x7ffc30454718
        5⤵
        
        PID:4576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
        5⤵
        
        PID:3888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
        5⤵
        
        PID:1368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
        5⤵
        
        PID:1336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
        5⤵
        
        PID:1016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
        5⤵
        
        PID:5572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
        5⤵
        
        PID:5596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
        5⤵
        
        PID:5604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
        5⤵
        
        PID:6124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4396 /prefetch:1
        5⤵
        
        PID:5536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
        5⤵
        
        PID:5620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
        5⤵
        
        PID:5748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
        5⤵
        
        PID:5476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
        5⤵
        
        PID:6072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
        5⤵
        
        PID:6088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
        5⤵
        
        PID:6024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
        5⤵
        
        PID:6092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3296 /prefetch:8
        5⤵
        
        PID:1632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5588 /prefetch:8
        5⤵
        
        PID:5976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
        5⤵
        
        PID:6028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
        5⤵
        
        PID:5508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
        5⤵
        
        PID:5416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
        5⤵
        
        PID:6212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
        5⤵
        
        PID:6220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
        5⤵
        
        PID:6452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
        5⤵
        
        PID:6464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:1
        5⤵
        
        PID:6608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:1
        5⤵
        
        PID:6764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7280 /prefetch:1
        5⤵
        
        PID:6772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4396 /prefetch:1
        5⤵
        
        PID:6996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
        5⤵
        
        PID:5752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7840 /prefetch:1
        5⤵
        
        PID:6724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:1
        5⤵
        
        PID:6972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
        5⤵
        
        PID:6976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8092 /prefetch:1
        5⤵
        
        PID:7044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8096 /prefetch:1
        5⤵
        
        PID:6464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8108 /prefetch:1
        5⤵
        
        PID:7084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8124 /prefetch:1
        5⤵
        
        PID:7092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
        5⤵
        
        PID:7100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1860 /prefetch:1
        5⤵
        
        PID:7120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8224 /prefetch:1
        5⤵
        
        PID:7112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8968 /prefetch:1
        5⤵
        
        PID:6632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9008 /prefetch:1
        5⤵
        
        PID:6736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9172 /prefetch:1
        5⤵
        
        PID:6748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9320 /prefetch:1
        5⤵
        
        PID:6812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9556 /prefetch:1
        5⤵
        
        PID:6752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9572 /prefetch:1
        5⤵
        
        PID:5200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9688 /prefetch:1
        5⤵
        
        PID:5212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9612 /prefetch:1
        5⤵
        
        PID:7664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
        5⤵
        
        PID:5436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
        5⤵
        
        PID:5872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
        5⤵
        
        PID:8140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8284 /prefetch:1
        5⤵
        
        PID:7464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3896 /prefetch:2
        5⤵
        
        PID:6648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12086348131705295404,14844493232650170239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
        5⤵
        
        PID:1832
    - - C:\Program Files\EZFN Launcher\EZFN Launcher.exe
        
        "C:\Program Files\EZFN Launcher\EZFN Launcher.exe" "ezfn://login/?accessToken=eg1~eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHAiOiJlemZuIiwic3ViIjoiMzg5NDg3YTJkZDU1NGMwNThkODk0ZDdkOWZhNzNiZTIiLCJtdmVyIjpmYWxzZSwiY2xpZCI6ImY4MzNhNzI5MmIwZjQ2M2VhMzhmOWMxYzAyMzRhNTQ0IiwiZG4iOiJvcGlvZGVyIiwibWwiOiIiLCJhbSI6InBhc3N3b3JkIiwicGZwaWQiOiJwcm9kLWZuIiwic2lhIjoiNGU2NTZmNmU2OTc0NjUiLCJzZWMiOjEsImIiOmZhbHNlLCJjbHN2YyI6InByb2QtZm4iLCJ0IjoicyIsImljIjp0cnVlLCJleHAiOjE3Mjc0ODU1NTQsImlhdCI6MTcyNjg4MDc1NCwianRpIjoiNDU0NTUyYzlhOTk0NDZmOGFlMzNhMzZmNDkxMWM1YzEiLCJkdmlkIjoiY2Q0NzcwMTcxYmEyNDE4NWE2YjVjMzUwNDA5MGZmYWQifQ.V5LTHIvrbWNZ_BL-BUD1mei-D5yC0kBtUEe-F1mXH08&refreshToken=eg1~eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHAiOiJlemZuIiwic3ViIjoiMzg5NDg3YTJkZDU1NGMwNThkODk0ZDdkOWZhNzNiZTIiLCJtdmVyIjpmYWxzZSwiY2xpZCI6ImY4MzNhNzI5MmIwZjQ2M2VhMzhmOWMxYzAyMzRhNTQ0IiwiZG4iOiJvcGlvZGVyIiwibWwiOiIiLCJhbSI6InBhc3N3b3JkIiwicGZwaWQiOiJwcm9kLWZuIiwic2lhIjoiNGU2NTZmNmU2OTc0NjUiLCJzZWMiOjEsImIiOmZhbHNlLCJjbHN2YyI6InByb2QtZm4iLCJ0IjoicyIsImljIjp0cnVlLCJleHAiOjE3Mjc0ODU1NTQsImlhdCI6MTcyNjg4MDc1NCwianRpIjoiNDU0NTUyYzlhOTk0NDZmOGFlMzNhMzZmNDkxMWM1YzEiLCJkdmlkIjoiY2Q0NzcwMTcxYmEyNDE4NWE2YjVjMzUwNDA5MGZmYWQifQ.V5LTHIvrbWNZ_BL-BUD1mei-D5yC0kBtUEe-F1mXH08"
        5⤵
        Executes dropped EXE
        
        PID:8024
  - - C:\Users\Admin\AppData\Local\EZFNLauncherV4\EZInstaller.exe
      "C:\Users\Admin\AppData\Local\EZFNLauncherV4\EZInstaller.exe" install -y --ezfnlauncher --app_version 4.2-CL-4072250 --base-path C:\Users\Admin\AppData\Local\EZFNLauncherV4\Fortnite\4.2-CL-4072250
      4⤵
      Executes dropped EXE
      PID:7204
    - - C:\Users\Admin\AppData\Local\EZFNLauncherV4\EZInstaller.exe
        
        "C:\Users\Admin\AppData\Local\EZFNLauncherV4\EZInstaller.exe" install -y --ezfnlauncher --app_version 4.2-CL-4072250 --base-path C:\Users\Admin\AppData\Local\EZFNLauncherV4\Fortnite\4.2-CL-4072250
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7800
  - - C:\Users\Admin\AppData\Local\EZFNLauncherV4\EZInstaller.exe
      "C:\Users\Admin\AppData\Local\EZFNLauncherV4\EZInstaller.exe" install -y --ezfnlauncher --app_version 7.40-CL-5046157 --base-path C:\Users\Admin\AppData\Local\EZFNLauncherV4\Fortnite\7.40-CL-5046157
      4⤵
      Executes dropped EXE
      PID:5364
    - - C:\Users\Admin\AppData\Local\EZFNLauncherV4\EZInstaller.exe
        
        "C:\Users\Admin\AppData\Local\EZFNLauncherV4\EZInstaller.exe" install -y --ezfnlauncher --app_version 7.40-CL-5046157 --base-path C:\Users\Admin\AppData\Local\EZFNLauncherV4\Fortnite\7.40-CL-5046157
        5⤵
        Executes dropped EXE
        
        PID:6956
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3160
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4528
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5084
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4364
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3036
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2396
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTY0OUYxNUQtNTIxQS00RENCLUFENTgtQzI4NTY4NURFNjU1fSIgdXNlcmlkPSJ7MkE0QjdFODMtNTQ2MC00MjM0LUE1MTktOEE3QTE4NUMyNkE2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5NEIyODIwRi1GMDZDLTQ0QjItODlGQi05RDM5QUVGMDQ4ODF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xOTUuMTkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyMjQwNDk0MzAiIGluc3RhbGxfdGltZV9tcz0iNTMyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1976
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{9649F15D-521A-4DCB-AD58-C285685DE655}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3132

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:516

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:960
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTY0OUYxNUQtNTIxQS00RENCLUFENTgtQzI4NTY4NURFNjU1fSIgdXNlcmlkPSJ7MkE0QjdFODMtNTQ2MC00MjM0LUE1MTktOEE3QTE4NUMyNkE2fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MjUzMEYxOTAtMkFGNC00OTQ1LUE4MUUtQ0UxMzEwNzM5NkFBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90Oy9yMjUycCs2Ylo0b2lURnM1WTF3dCt4c3BlWlgzWUNDNi9MNlo2UEl1ZWM9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0OSIgaW5zdGFsbGRhdGV0aW1lPSIxNzIyNjAyNzYzIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNjcwNzUyNzMyNTMxODEwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDMyNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIyOTk5NDkxNCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2200
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D3ECE7A9-D6D9-4E7C-B0B7-A261173DA44C}\MicrosoftEdge_X64_129.0.2792.52.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D3ECE7A9-D6D9-4E7C-B0B7-A261173DA44C}\MicrosoftEdge_X64_129.0.2792.52.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D3ECE7A9-D6D9-4E7C-B0B7-A261173DA44C}\EDGEMITMP_04272.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D3ECE7A9-D6D9-4E7C-B0B7-A261173DA44C}\EDGEMITMP_04272.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D3ECE7A9-D6D9-4E7C-B0B7-A261173DA44C}\MicrosoftEdge_X64_129.0.2792.52.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D3ECE7A9-D6D9-4E7C-B0B7-A261173DA44C}\EDGEMITMP_04272.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D3ECE7A9-D6D9-4E7C-B0B7-A261173DA44C}\EDGEMITMP_04272.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=129.0.6668.59 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D3ECE7A9-D6D9-4E7C-B0B7-A261173DA44C}\EDGEMITMP_04272.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=129.0.2792.52 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7110576f0,0x7ff7110576fc,0x7ff711057708
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:4032
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTY0OUYxNUQtNTIxQS00RENCLUFENTgtQzI4NTY4NURFNjU1fSIgdXNlcmlkPSJ7MkE0QjdFODMtNTQ2MC00MjM0LUE1MTktOEE3QTE4NUMyNkE2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEOUY3M0IxMC0yMzUyLTRDQUMtOEVDOS01OTVDOTlBNkRBM0R9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI5LjAuMjc5Mi41MiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIzODExOTk2NCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyMzgxMTk5NjQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDgzNzI2OTk2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9lOWRjYzNkNy1kMjRhLTQwN2QtOGY3NC03NWMzZDdmZDhjZmU_UDE9MTcyNzQ4NTMyMCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1JRVA5ZVJUV2xUNFkxb3ZUUE9ZTG9oUDBqR0dIN095Z0hibFolMmJPbUVuNlQyTVh3RDRsWHQ0bWtDVXJEOU02MGlEa2ZsVG5wdU9mVUh2azhZdzlBMzVRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTczOTAyMjgwIiB0b3RhbD0iMTczOTAyMjgwIiBkb3dubG9hZF90aW1lX21zPSIxNzk5OCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU0ODM3MjY5OTYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDk3NjMzMjk3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MTA2MDA2MjMzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzYwIiBkb3dubG9hZF90aW1lX21zPSIyNDUzMCIgZG93bmxvYWRlZD0iMTczOTAyMjgwIiB0b3RhbD0iMTczOTAyMjgwIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MDgzNyIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57de1c.rbs

Filesize
21KB

MD5
47e99ed27e3005911080aa500e12f5cd

SHA1
1b0bf5e5e8e0f1b75cb105da7801035d6e4d3966

SHA256
118239b7fcae13d52540e5128875abad31bb174e998bfff1bd6e205888b12fdd

SHA512
d62217d0580e923c92c70317ea724968e14136eaa6aaca251738757e98aa700232bce90c9ce4067157efb1109952fc4f422ce84ccb6f7372e6ea75864c0b54e8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.52\Installer\setup.exe

Filesize
6.6MB

MD5
00bcd9d9dcf8c6376d677caa332c04e3

SHA1
0a86d25ce5d84a0371064ff3bb38a6ff6a3a27c0

SHA256
08003badaf082b1f7c535b98abaf9f9953004668c5192fba75786e2036d59c14

SHA512
fdfaee47cc7b434141a7b860d260d1cb9a130140e4838ba591256a9f93d04bb5ee839da9961fedc2c65d9557b9095a12bfd94573a2af7983c5856051007a835f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
182KB

MD5
3a6b04122205ec351f8fbef3e20f65c4

SHA1
ba2e989a1f1963652405b632f5020e972da76a8c

SHA256
7ba65317643fbc0d03195bdeeba318732823a91ef27f62483d5fc0ed3fea4912

SHA512
2a0dbc91e79c42bf934ce7ab41ff6ed900322706bb71ffa1f3ade4ad85e0e1de2fa31540e1f1e0e979ad749c84343563ebe341585965f2f3a62debd6b4ab0cb0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
b0d94ffd264b31a419e84a9b027d926b

SHA1
4c36217abe4aebe9844256bf6b0354bb2c1ba739

SHA256
f471d9ff608fe58da68a49af83a7fd9a3d6bf5a5757d340f7b8224b6cd8bddf6

SHA512
d68737f1d87b9aa410d13b494c1817d5391e8f098d1cdf7b672f57713b289268a2d1e532f2fc7fec44339444205affb996e32b23c3162e2a539984be05bb20c4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
215KB

MD5
1d35f02c24d817cd9ae2b9bd75a4c135

SHA1
8e9a8fe8ca927f2b40f751f2f2b1e206f1d0905f

SHA256
0abf4f0fe0033a56ebdaff875b63cc083fd9c8628d2fb2ab5826d3c0c687b262

SHA512
17d8582c96b22372a6e1a925ccc75531f9bab75ebe651a513774a02021801d38e8f49b4e9679a9dfc53ccc29193fed18ab2e2935b9b7423605e63501028240e9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
262KB

MD5
e468fe744cbaebc00b08578f6c71fbc0

SHA1
2ae65aadb9ab82d190bdcb080e00ff9414e3c933

SHA256
7c75c35f4222e83088de98ba25595eb76013450fc959d7feefcab592d1c9839f

SHA512
184a6f2378463c3ccc0f491f4a12d6cac38b10a916c8525a27acd91f681eb8fb0be956fc4bdb99e5a6c7b76f871069f939c996e93a68ff0a6c305195a6049276

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
b0da0a3975239134c6454035e5c3ed79

SHA1
fbea5c89ef828564f3d3640d38b8a9662c5260e6

SHA256
c590d1af571d75d85cfe6cb3d1aa0808c702bcefd1b74b93ea423676859fb8ba

SHA512
5fbfa431a855d634bcbef4c54e5cc62b6435629305efee11559f66473c427ad0775c09364d37aaa7a4a8a963800886f6547a52ae680a1ff2c4dcc52c87d994bb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_af.dll

Filesize
29KB

MD5
c54dfe1257b6b4e1c6b65dabf464c9fa

SHA1
aef273340160af0470321e36e9c89e1a858e9d39

SHA256
0c426d4d48efff328a0da5497af24e83892a2ed1d6397a6dc42f9548a24dbff5

SHA512
58ae24dfc6045ce1f8ed782a03cb3d02c10b99a2992b9326711fb8700c8e7d05cfbca21e9b47cb4b1f4f806a9bb7667672026c715aad2f175febb6ba2b5f95db

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
ccdf8ae84e25f2df4df2c9dd61b94461

SHA1
64cd90b95a17d9ecf2a44afc0d83730b263ba5fe

SHA256
816c64b37e4c42cd418d05bc34a64e9c4acb4ce08b2a18ac5484374ca7b76e76

SHA512
242a8a93326d3a5ea1fd367ef6cc2b343f08f4ff68d88d91044d0ad7fce490f47524a6e57940991ff0893a590459e96c588944f2b115cee703413ca594046f7f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
3374d9bc4467dbdeaf50bbd5a26edcfa

SHA1
6d7bd73ad27148bad7488959d7ebea22b6805436

SHA256
5c8a8755cc0b1213fb0d5b57e10a53702f2091479d3c058d0c756134e548c685

SHA512
c0c02e54d7e0060b6ffa5bedf8d79cf4b40f77711680d2161b5186c5a8a10e521169dfa7ab6b8e4816c98e4aefd136f209a40c78104cb618c21105e095537719

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_as.dll

Filesize
29KB

MD5
87e596d8f0ac9fbe2d3176665eeb68f3

SHA1
1c9364d55b4844cd250504abe30dcff9792ee576

SHA256
c39669e004facfb0c500788747a4427fe26dcdb50ae695562e6e417f4eb190cd

SHA512
ef3708632e19332ddf460e081f8444ff8b4ec483c6b3e57f386df66d5f62d222b1d3f9f3728928701a6e48720133133c43619858853585a7d70b7bd5d8cf847e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
ace0925ded0a4507d82e6d32a77c50df

SHA1
c760ff52c71de3080631120c6992dcd0ac4e37bd

SHA256
8e3c517bfc5986310c35f30b9681d9c919a7d62e299014410132ddc2b41f00b3

SHA512
8adec80e179f205d0571625c1a63a0188e6533adefd48691f2fc287a546c12249c2126e6958d1732fa8847492a8287723a0196fbc0f2b9af3c54e1ab418cc3e6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
aeb3a05ce4eecdef3d23dbc0094fe21f

SHA1
e2a5c49b4d0fddcad28649bd09d0cc7af4c0b2c8

SHA256
6c874a312ae57b8b0deac8457a200fcfc90aceaaa252628701c92aa8b9a823e8

SHA512
4a7fe6cf8300b394d7471d9a2d759ebed59690ce925270d6ceaa4e14ee06f01b67f8219559e9ec917477f4c5aae03329ae2c6e231f3fd41c645d02d26b29f367

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
afa21b2feee2831c5478e113ed814b76

SHA1
9e883c990a31b8cd0ed2f80f732f404386cc55d9

SHA256
183bcae9e143b78d04c2ed83ab6cac8cbd82f1d2bcf7bbb2506886a3925ac556

SHA512
294838c67f6d87fc3b4975c73d24e1c38173c8ad4a14c215945e9910ddc306e9deb0168f38661c85b5c77929fcbf56093f632a35c1b39181203fbd662d71f7f8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
8e0ff856270ca13f8c07825e39ae3613

SHA1
b351f8ae0cc13d97d201a268990b75fc9e6cd422

SHA256
18cd8ed69df17e1bcb517285caa88c8a73e093984fecbea2587e7144a8812a73

SHA512
25f3821c20aa222a28143951c9f370d3feceaf41e449f718640dce9af0e88e518bc40d2d02f5e64148d8909feedcfa6a8caf65a87ad12637a8bc13c848b1f178

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_bs.dll

Filesize
29KB

MD5
9f4c9469ef1930ec3ca02ea3b305e963

SHA1
e588ffdf150b55bb4ba38e2aaf175aaf6e1826d0

SHA256
fef14de38a4501cf538c89ca2d1ec389031124f69df9090df94fb4461e54ad58

SHA512
c166189ad76cb395a2aeea724f2088f42dd4d361518856166fb92b3335b8fc670e99eb7b1c4c9ac2c872c8283826cc2c88009bd975e690efbcc3d99289557e96

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
30KB

MD5
2e9132ee071ca5653baf90b9b1ea382e

SHA1
8a0c1e5a0df6432c50539d68caf697b8adaf1556

SHA256
adf6e6542f1422c431ef92a209886224fbb53b5c67e68ac070d5c8a4c6ee569a

SHA512
0b021758117109e4414c7ef37356106a96b68536ade8d3f1d1fb3dfce7c1132ab6fe02f7292ed225c09814a9c57124f731fd35069d220760678eab565f320976

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
917c18cfa84c8b8e83d8321f03be093b

SHA1
c0a4a743f4059183724fc8c26e84b5a80bb2f7f0

SHA256
6c56355b232c3bd35f397f99648c020733ea2d57db1cd4beafffcd962b896ae4

SHA512
03359c6104e9f0cb2d66b6f1bf5598b2bb00d9e7a62fbd0c5475ca67b5194e96c2e6053a2a1c22323ba0002c614caab0477597fd34b57dd1f5acdb19f70c0854

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
8b49a989a56d4a5aabd0a03f179ed92e

SHA1
ca2f84217c867eb853830e95c7717ce35bd997f9

SHA256
849e23c2f53d06462bd0f38e9d7c98e9389486f526a90c461c04c0aa1db7b7be

SHA512
f4861ab9200db234550cd2e355ce200b7746c614e9c326287c0509d152f29d41d7a056e4fd27e3150cb433cd0234c4ae1cbc0c3a8b5892ecb3e8d4632a985aa7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
1146f59b139b9d810996a1bae978f214

SHA1
cc9d54e6e3ce1efc4ef851eba35222547b996937

SHA256
7b5ce6c7fa03e69a93694fa59c61be88b3eb8cd8951790f3bdd7cba2d99e6b83

SHA512
0c94943646b0a08662eda2d236b7c88ecec0745faff5b9c6097f68e73a20059f8d2de47a9c00e58c6d2083331a34a0fa19b0964f3c62a6b8cfa02bc1e283e75a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_da.dll

Filesize
29KB

MD5
08fb61cf492ccd1236907af7a6b1bd4b

SHA1
9f6e0f7610d42f8a402d3adb7b66374f4d0f3cb5

SHA256
d6261d4bd9ce4011caee1e0efefb5685a5bb5e29130ad8639e4578fc90027631

SHA512
747982680ebc9e3c0993a69923c94382df6bfc113ebb76d31f65f9d824abef1a051a4e351f0f42296fd84e7663fc3bcc784da51dbce0554c3a880ac2258aa16c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_de.dll

Filesize
31KB

MD5
970e46bfaca8f697e490e8c98a6f4174

SHA1
2bc396e8f49324dee9eb8cc49cdb61f5313130d9

SHA256
eeff2c2487c6456e6a3ed43fe5fbb9d3b72e301d3e23867b5d64f5941eb36dcb

SHA512
789f29ee2c34d86da5c69225bb8b2fd96273c20146126c28d3d36a880bbda5b16ace479ce59aafdf645328255105133f489278023e63e04e9fa1fb34cc1f3ae1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_el.dll

Filesize
31KB

MD5
3d22a75afd81e507e133fe2d97388f2e

SHA1
f7f68cb6867d8c6386438d5a6e26539be493505b

SHA256
823fe6edc1fb0ebdfb8ebbaa2d36f6dc0424c8f26b6594a390ae0eaafd319ab0

SHA512
34a62ebe8d057a6f6e6f6b2672ebb95d4d7c49e739f4beee4bbfb5e917b7176aba4d70b0e84bd727c967d0885c08264dfb42371fe0d3fe4f8f12dbb1e26ca69a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
fe685e8edec8a3b3c16e7954b787e118

SHA1
ac71544158bf86d357d78d003f5ff2b4b5fd4ef3

SHA256
4b60ce6e3c8f725ad8e88cd0d0a3f0155a7145915670a532fe1143fb2dfbf49e

SHA512
e30d12a607d1c6fd2060ab38f443af680f8c8655900b0a21f3f0b488033f9300915667bdfa59ff4fd3488f58ac52c7f5598ff5078bf849bd177d1d8c10533f04

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
be845ba29484bdc95909f5253192c774

SHA1
70e17729024ab1e13328ac9821d495de1ac7d752

SHA256
28414cd85efe921a07537f8c84c0a98a2a85fdbd5dfa3141e722ed7b433d0a96

SHA512
2800ec29ece429151c4cd463c5042492ac24e82b4999a323607d142a6e1a08cb69258190a6722afbbcfb3c9cdc6eebdedf89ee6549e0f420f6fbae3aa0501fd4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
dc8fcfbcd75867bae9dc28246afc9597

SHA1
8fd9361636303543044b2918811dbdab8c55866c

SHA256
3deb382ffdfbd2d96ff344ec4339f13703074f533241f98f0ccd8d3f8c98f4bd

SHA512
ac8fbf033677a6862f3d02cf93bf1838c24f006b40fd44336ae13ecc2287ae4c733cc3d601e39556586131e8a9e2d930814399ac68165a26458a6cbf51b11d32

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_es.dll

Filesize
29KB

MD5
9c0ef804e605832ba0728540b73558a7

SHA1
a305f6b43a3226120d3010ca8c77441f6a769131

SHA256
626835e07c1fc4ab670127682f3e5225881a2d4ddea873c5271e9032668fa641

SHA512
c27a4b24600bdd33a4f9430e8d4d8f7f3718efcaf2d1ec36023e34b996817af79b5a9baeea1506f97d2716c9b2b5509bbc1bf4d7cab779554eebadaa8c942dfe

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
111118683f6e8ed7ceb11166378aebb0

SHA1
fd3e1cf198885ab5d9082d540d58f983d8a0f5ff

SHA256
5cc4930c50716138e25987baacb9a9aed7d30ff5c0ac927e35f7fc006f5179c4

SHA512
cc3480f05d8d59d3d705204e15ff6453a6d9c77bdb1011d069bb1f83b3d4e14204f19caa7e7ecbb6e3ed92d429ac46940791903440fbfeca2f7e7e12b9a47f6c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_eu.dll

Filesize
29KB

MD5
c0da1ad8854f64b7988d70c9db199d5f

SHA1
b184335283bf0026615f2a4a120fda87961c774b

SHA256
73190820d59e5bfe769b82ada48b0c9ed353524bd5cab303f5175d7d9bbb74ee

SHA512
424ef2d0ceaba76b64c3349ec1ff5088cb8aff9103fb38da238c80e6452a967f3dca09860b2b8fe9c01e20bebadc539960a5bc241a91bab98bfedf29c2f777ea

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_fa.dll

Filesize
28KB

MD5
c4cb44ee190c5aa8dd7749659437e5cc

SHA1
667f4aa01a4262fff2e01838f94330c0ebc285a2

SHA256
dc184d54d00d51d2f8de623c0c4b07e9408f7b02e1f1085107edaf14dcbee136

SHA512
0330d733e89811c4a89deb202ec517de3128ad266483f37bd8d91eb6e45336febf7297da4f3465c683ed1b6e08114d6a3f52ff74484276509b9816ae7dccbb10

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
a9b037f7bc8f5b382bf6c69b993dbeb1

SHA1
7beb733f3561ac3083a3dfca3b7644c5154e1330

SHA256
b498d1b38a81199b62a98a0e36aa9e955e1c0143436908538314089c0e59d128

SHA512
a63c1e1a4d8d2e5043e0cdc420d1c545b0adbcdaa1a65f09454d47cc9642c1ffcb16e76454e90c75fd88f29917024b11418a606acbd560a98b79cd8631186332

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
6b2319c3634103272f39fc71d7f95426

SHA1
a1d692a68c5cbb70d29a197ec32c9529c15a0473

SHA256
28c610ba7f8332be050c30e296acaee423bc0a7a9cacc7b3d60618e284ff9cfa

SHA512
51738dd14b410c689ed56530ac555824c773bcb163f4dbaddc86e684e04c1f06271001f0b2bef7d6231f17231b2e3e35f9aba2974c48eff6d1a8ab877e5a6031

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
8e1793233c6e05eeaf4fe3b0f0a4f67c

SHA1
97697fe9ba6b3cb5cfe87bb94587c724ed879c3b

SHA256
b9caaa668b71964316ee15e6e49f8ae81e5ed167fdb69fc31bc6df834ab4e7a5

SHA512
3d2fbf5e05e7b9e21c85ad7f59db9556046e4c1755f0b138d6de38eeadd3480e772e35798f9339aa7daffbf92afbc385f9c0bb4e4f5c65292dff3b280f52bd6f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
5e63ac4b5abe6c84f305898a0f9ba0bb

SHA1
e70baf6f175c297a9b491272ce8f131ba781553c

SHA256
711b5968d2116d7e97aa5852ec864db35d3c186f341fb024cd1ef4525256131a

SHA512
c383e4df4337bf9a66f684dabd2faa95cb49abb424c76d0603f91af7b7260be5b2877246da293d5df83fdb59d291d63a7d73303c34682a50ea84a8fcd7d6e874

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_ga.dll

Filesize
29KB

MD5
f7b123f6dd6c8d8832a8bb8b7831e42c

SHA1
7e9524b79036568b2b4446ee00c76460fb791c6d

SHA256
119b9e288832f2a4d47d63b693bb195a72f27e9c0aa014b2c3ccd5d185f7afc7

SHA512
6bd457d1e3f943a4ca5a1d36907fe526a4f2965a8411280a2988ef1d264203af0797365c1306e7ce103cabec2ead17d194f20848b4c665e986705c3ed6e291c9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
6de337fa9f131077042f7ce421a9fa42

SHA1
25e21b64cdf60a1da2f940b3c873eefd680a5fc9

SHA256
263e07308785bd7e510eda95499ab3d3d66942f0bfd0a5722258e2a87b5d0a90

SHA512
e747fc105c4ede0d4f73492e3757975a9410499caf867bc149cd43bdbf1be03d3df82fe04c7cf99e3ad6ee06fb5011fc5b069bd502c2f3b3e578f587d0362e3d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_gl.dll

Filesize
29KB

MD5
be03945025cc2f68f8edd4e1ca3c32b7

SHA1
d4b1c83f6b72796377bfd3b42c55733eed8fc5e4

SHA256
aa95c108db3582a4be98fe83519aab3fed09c8cc9b326469edb89871d6562373

SHA512
a03656acfc123f06a071f0e326ce15bf17e2efe080fa276acd50cb40e35000d74a3d0762da327c59a7564bb3f03532bf04c733ae850852f62ce71fd513e9080a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_gu.dll

Filesize
29KB

MD5
951dfd4709b3fdbe79a6e43828387592

SHA1
0c7bbf1852135456692970639869618fb616ba5e

SHA256
21c72dc48cd33291520e3f432d8d59ec103496ab6508f41fa1b081b3bdf98bb8

SHA512
b338c345db00135ceb3577a67bcbc36b37be742e39aa6a333bac93ba20ab1463df55a381be95c9e9effaed4daa0ce93203ff2994459f9a23813dc0afdff03e8d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_hi.dll

Filesize
29KB

MD5
6b97796e1746317567ed7cffe9441d3b

SHA1
dd269b22021eb37fe854ff181a09bf7f9568f7ac

SHA256
a4ce75f6b1de6a2500bfd6b0ebc1c268cb3d7080dc9e7661bedd9361f7215d42

SHA512
f1856ac881de7acb7f61f2d7c1d064458855c3621fcfa951f1d1207f3d85fd6f64b26547ea1391c4145bdeee23e6611acb2fe80b8c1258dd108085e371d34d73

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
8bbd58f9644187747407b0a18c60aa0a

SHA1
82888f3f2ce1dd7b9b3f5ac26bed0a6da5601dff

SHA256
35008c4ea7f22ac78d28e72311d4b3fa28d6af24072fa94558a9b3771a4b545e

SHA512
1fa7d62692062c1d22e3fe0e5c15bfbb2def115be2991001a998fcc6bbb5983d9343b06172e8f38b245587b15762b655ef58ec508160b576779963e5889efca8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
e56f98d6b32f82f391d5b087a135a7ec

SHA1
c8de62b4b22a8153cb788e03f7e04c55a5ae5396

SHA256
236252a34d2efdb4e801bd827a791935aadfe6c0a471f1b252d9bf2d291a6bae

SHA512
45b9933478505759e7217a65e3a054885841c5ae9bc58983c6cb216ea2a15c53f45ecfb6b40fee07d54c289819ddc2161a651e5183e244e0f43946176f224c8a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_id.dll

Filesize
28KB

MD5
5b5366c7779dc9ce9f3a15b6f22289ac

SHA1
d9995fee337b9696be970a2a48a845ed71bd7d2b

SHA256
da6d5c982387286396f54c043bacf106f78fc76db4a33984c8b2cb88882fc9b3

SHA512
35362a3719833449bd9e757194f9b0b28c3d68a0c62f52d224b1cd5eca5a2343e1db868668e2b30d927a1966b5db5cd0b2230d7f4576627e486eb3a86913b195

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
b675cc1f6f5f174c265c0887d9591915

SHA1
abb182cfbe1d5723ecc380c5fa08b24c1f421af1

SHA256
c012110ad65f8244494ef2aa70696128a949fbc5797e5139afa7d4195457df1f

SHA512
be1b23a563a2b4f6b658df3f8075d48bf3921c5951a6fbe77c24a0949997e068403f5bcaa3f93030b01d7a69b1aa74ce06f37038c30145e03a9822f4854f7c0d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
b8b03be1e73e1ccc0df159c48e875038

SHA1
37d1b2216f1e90a69b1be65b2c4f0f5f35e78aef

SHA256
4ee8f48af5136fb80f5d031395f92abb2b3571fdf7c4c98ae833c2ee74c49160

SHA512
ef47c8c0f8aed7a4d912986e2a3fbc34b54fdea25b006bcb63d502a6cefc42bca717a93e16ff1c137892a91b894ea15d95a53dd3b52b850bf1a75ec9bd7b3013

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
dede65e2268976ded6f598ecea661025

SHA1
45c6fd614dac74eecf83709081b4f289c05271dd

SHA256
9379736bb1b621367e42736d311288d33742a9e0ca3e056b4638491fc434a880

SHA512
92a46ca5e3c40bf55fede64aecd7fd05f6419c645d38325546c46632775fe72cff4152e473ffbc15d478da62c76a088ebfb4db91b9a0691a9ce1c763ad3f9285

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
ffc1ff9f4cb8fcb529f8580d3b92a80c

SHA1
d0ef21a7407c5eebe1fc21b6549c92c6222bf0cd

SHA256
d508f613bbec62a237a5616959dbc292fe4a79adc8783fb91725f3f2c32658d2

SHA512
6345362f03f3bc4409c1e5875b2e7cb58b5df9737c9c5502a19314046281e682a3ea7ac5adbbb933a130f52efad4da4eb9ad99ebfdd41bdba23d1fbea4180475

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
e802f3589731c88d166a8b0e3bae1dc7

SHA1
b94e21b646c26053c19a0e6238f0e4fbde0a2fa6

SHA256
173f78b786cd1a58a47ec9f7c662e403b191fa42cb7308aa7eb6b0f744bfae0b

SHA512
ecf9eb33afb00c6839d6778e36685b904267e6f384a7d307230000a506e6ac6e95132c2f50a4cbe523d834dd6c7ecd1277d47b73188130e097a0b64c0ec64a51

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
1c6f35c21ff0afb2f4aa9d4352fc86f2

SHA1
d4bf67c14304add3e7d8218ff66a520a7b1e0a6e

SHA256
779900e90b23d0443e0b93b4ac7c8fa24dd6a0ebddb36cd22bcd7a1a6fce2ecc

SHA512
caf80f4adab14a81bb14e36683772539a6789448ddfcaba2a09e5c6c3e2dae105ce436ca7dd7b412c6c73dcc0768141822b13064d452a48a37721e1e9dd357f2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
9dc0ee4f6b7e239018d6962b5097669c

SHA1
3b091cd8dc4f46ec7603c56d2ebf73385576031e

SHA256
4d31ba95fb2adf05ea6fb9b1896f09c872c228187bd3d2f979b162097ea18979

SHA512
aca659bcb9dfe59bd23dabcf2051b8529b0a1b9f2c1a0748ff29ffb02307222dc3a5d8b7aa42f6469200992e6cca14886908eb624f9f1959095133b09f3752d6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_kn.dll

Filesize
29KB

MD5
b6d73bbacd24928bfe692e2c48522e03

SHA1
8ae460214f623db552fe09944dde5f83e1f3e3ff

SHA256
9be3c751e0f89866599d8d4a6d2bc10db749fabcd6de88922e4b7c4bb1f03ddf

SHA512
762974a13e623435adda030e9f496220ba65e8ebcfbc3aefd896491a4816bd8496cba79dc56f321e4eb98a9fcf71b36160c27f701c5e690c071270065d1f3f14

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_ko.dll

Filesize
23KB

MD5
c89e6395725b3ba0b18d314d54589b92

SHA1
c57c5a8c4841206da919335bc29ab65ce7aca76c

SHA256
771009b26b95c3c6e0391fb78038c632a2475af36b3b48d13882645ab5e91d3b

SHA512
33ebe44cacccd475c958053614f3c179f2d0d3bde8a99e740faee0b87bca0eb2ea27a01501c70ae90367fe158a694edde005920d9ba18d647d0328d0a5f8c27a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_kok.dll

Filesize
28KB

MD5
c4740361d46b87eb618e395552f20b6f

SHA1
62654bb1ef4f6959bc421b1d5c0d4ef7c6651b17

SHA256
869461c0b655d697c5089ef9b5eb842670b5c3e9696aa109ed3ec9c217e31f89

SHA512
0dd00ce5cd4a13a00faa7925e0f3965d059e9b935601408e0b687b764680780d855d9fe13f653c3458bb672b67d039496c7fdf605b2c31613f79a2f7ae24ef4f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_lb.dll

Filesize
30KB

MD5
b426d4d32a6e0b7312459a896581e4b7

SHA1
a027cd7ceed7a610ac2405e2545207dd4627c83e

SHA256
a0be6cc82ada1b0c788f278b6cf4d9177e940b22b2157cf04f22900c71df2d43

SHA512
c400a7b326eb54f97b8680bd137e8e2f7e0ff6ef01da088b2eeeb23f1e01eeed96b17b907e1b1e040f894fd205fa192cd9fcb157e546e7e2d9a121122a633e4e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_lo.dll

Filesize
27KB

MD5
ac1b51dbc25646287542c35fc650a363

SHA1
4bf6b818f257d4b823e6d67fcfd572967b46e750

SHA256
8f2b7efe2193b1a87eaf9f36b926df4d5d4d1162e85a18723fcd6e69c581d40a

SHA512
9b7880a06e808bc337e98cfac6f8cf5be7267c6310aea7f3fcbaa87417fb30cb6f7411fc81f780742dc09e59de8cb89bfce227e65d01ce7cb98bd1ba37165df0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_lt.dll

Filesize
28KB

MD5
bb24d428375ec4d138e974adf53f820c

SHA1
f36096d3d0256a21a4ec312a7f293ef1afaea5b4

SHA256
d21bd9565abf453387fecfb7508ada6fbc5ef04a0760cb4d5c167d172d229ef9

SHA512
23549dff4f6cd826d4f7b15d57a72dff10aec200d8b0ab7ace0b7ef833bba6cb116a9f7bf2bc6dcff087d14ec0b072a567b4a8934cff7a15ef627135625994d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU461C.tmp\msedgeupdateres_lv.dll

Filesize
29KB

MD5
b329055638a2703204e2caff5c655003

SHA1
85fc0a199663ace9c7e3509f4799e04ef20e71f1

SHA256
55905c16ab32b718a605f51cbb4d58d68ec2cd6dec177b2d5fc43f98418a7e61

SHA512
75b6d1fe26927d31cee1cba894642222c8855dd9517bafefe514aaf930a758372703f20cdcb5abea4626d73d5a3e7d953cd9286d83791c0688bc967eadaf4f79

Download Submit
C:\Program Files\EZFN Launcher\EZFN Launcher.exe

Filesize
9.4MB

MD5
4f33ce3ea36ef1f99b6825a86b2470ff

SHA1
baca999aadc039799d779088276704b14b5c665b

SHA256
5f05babffaded0eae013bcea5de6821cb51c82acbb6889c4b01ebde41b3dafa8

SHA512
a96e86906b195d035a824f48f89db9455208dda2ca7ad1d7dc88881cbf6b0649bafea39fa384254aebc23f6a903cd18cf7dda375194390119c0111d901fbc0b6

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
e834135d034065b16201728df2a088ce

SHA1
edbc94b6530a2d63ac8e6695509e71f43c251bc6

SHA256
d1c586352d85cbb9d2ac398261a2b541108a925b75a4bda814e9ea63450578ed

SHA512
9aa7ef8e680cfed5aed325d23e9b34a0326ea824e833514ddddf6b89fe8dbe2a8755cebba25a70953eb0a7e27d9a1f4340c4abf2f4abffda2093aa90df80c7d5

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3304_1223468907\manifest.json

Filesize
102B

MD5
8062e1b9705b274fd46fcd2dd53efc81

SHA1
61912082d21780e22403555a43408c9a6cafc59a

SHA256
2f0e67d8b541936adc77ac9766c15a98e9b5de67477905b38624765e447fcd35

SHA512
98609cf9b126c7c2ad29a6ec92f617659d35251d5f6e226fff78fd9f660f7984e4c188e890495ab05ae6cf3fbe9bf712c81d814fbd94d9f62cf4ff13bbd9521a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3304_1309528483\manifest.json

Filesize
116B

MD5
e39cecf91d50b976575112bafefe9393

SHA1
82e2d1c3cdc771a02ae8989a89dfd1f61647b8b3

SHA256
f7d0ba2c20ffcf2fa230225b4a309a0eb52741eeeb29725b01c289d0067984d6

SHA512
0a63fcb2109d878013ee79fe0789817d9df4445eaec4bb27d663237ada6d035d28946e9a4c2ae0238413f5d404b56536c4095bedbbe6528ba36bbb5f24bcfd02

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3304_1711107426\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3304_1711107426\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3304_1711107426\manifest.json

Filesize
179B

MD5
273755bb7d5cc315c91f47cab6d88db9

SHA1
c933c95cc07b91294c65016d76b5fa0fa25b323b

SHA256
0e22719a850c49b3fba3f23f69c8ff785ce3dee233030ed1ad6e6563c75a9902

SHA512
0e375846a5b10cc29b7846b20a5a9193ea55ff802f668336519ff275fb3d179d8d6654fe1d410764992b85a309a3e001cede2f4acdec697957eb71bdeb234bd8

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3304_2133415573\manifest.json

Filesize
113B

MD5
b6911958067e8d96526537faed1bb9ef

SHA1
a47b5be4fe5bc13948f891d8f92917e3a11ebb6e

SHA256
341b28d49c6b736574539180dd6de17c20831995fe29e7bc986449fbc5caa648

SHA512
62802f6f6481acb8b99a21631365c50a58eaf8ffdf7d9287d492a7b815c837d6a6377342e24350805fb8a01b7e67816c333ec98dcd16854894aeb7271ea39062

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3304_3286382\manifest.json

Filesize
79B

MD5
7a8d314d7ce379ed9110403e012eb72c

SHA1
b0837c90e3962ab98ccf491391ac4668641693db

SHA256
ddcf34bfcdb15f97d4ee6fe8f28f66b285194731e44f9f66c6fd00b1e024e508

SHA512
0fd7b81f46f92685da84e46e63c1f6c701a38a83c952437b5b4fd2ffc1336aef4b631fbf5dfaa9156a7b9ead7e3fdb0d89ef03635f7f07738afc26ecfd678e31

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3304_524614896\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3304_903287809\manifest.json

Filesize
134B

MD5
58d3ca1189df439d0538a75912496bcf

SHA1
99af5b6a006a6929cc08744d1b54e3623fec2f36

SHA256
a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437

SHA512
afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
60KB

MD5
8668ded388ce13965684336fd9ca5b35

SHA1
6ccc5c48c748aeaea1eba0b6bb76422a4ee3a01d

SHA256
47757c84d433f13d51681139fdd74defc9ea5a91a450611f22c75f612d604a6c

SHA512
be50c7679b679810f87af07feace2df1b1f8dc6fbc74efe1c95d47caba66271204f314cbe68c6265aaaadf50f564596b195f165ef09df3a5dd38dfd604bbad1e

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk

Filesize
2KB

MD5
14364441ae4d4e22bb595760443e7c60

SHA1
2d818e59f08204e2a019a93e3ea57dacae868ccd

SHA256
30d4546f5691f73354e47b7199d1feb8401c0a7611f9abb35fa27ba6d8e3d916

SHA512
3274ba6e424c755d5cd6f100f985aecd73e3b14d17dc2b98aa10503107f2d2d55e91a45ef403a9fab4af4d23e5dea80e6be794a73de83b5aa89afd9f70a30186

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk~RFe57e05d.TMP

Filesize
1KB

MD5
2c68fe06df7609c0553352b1e249e22c

SHA1
91d6f578c2d6a1ac6bc7997ff889f4f528e0e6e1

SHA256
6207a2bd98e342593e6cdcd7ada966073da09d52198841ea4774360d62a2b5c3

SHA512
c42b9c6cc6d444b1d9dfb285bada7cc8dfd61967700ef1088b3a8d8401bc3d9c2594767413e566d83108aa5338085c0f405132c4974e6529ba6d2bdf482a431e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
148KB

MD5
d2f84c8efdf93a6ea5aed33438940c35

SHA1
7c5c2f70d6e3a19b894f0a45e0bcf9ea81afa921

SHA256
983cc9f11f82045f73ab47625d2e8e11f440cf4396215fae0ecfdc198b51ee81

SHA512
c589a0a9c1fefaf3d4744b5e62f84a96d61bdd262aa06a9c6a344eb4d0da0e6e8e203c9f666202677c30b1eaa6b5a45599603768320a24a4dfe240e43c8bbb35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
8aa3d963cc63b6df4e1e1815c36bc6b9

SHA1
e0a3027e20b6a1aa9692aaaae97ec672e2b7a466

SHA256
49e97ebfefeac34521b1b77161f5627915ae3d70b8a5ddf150e70ee22abbfd7e

SHA512
7a25e4c3a880a9a50105fd54056bc69ae12d9b1bd5079fa665684452a4815cf7d6ae6e2b1f75a05c85636c38c6ae3afc0b2f3c6ac8f31ed8c222c755ff814a0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
64KB

MD5
add9dce7c4828801f845ec416c87e8fc

SHA1
8104424a0917352036ef9b6fe8dc103b72222147

SHA256
db35d419b0e9445f031d0fc0532a5d177f3031d969cb6dec1b1ebbcd3b418f23

SHA512
df2cb96c1b1277ec9ee1a56e3e378183659193e9c33923d5fecea04acf2d3c74f95ab3bdbdcd310a87493d92c049826cec65842daa07c9c8a80d2aee35e5bc1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
1bcdbe2afa0c8aeda9af414be6c616bf

SHA1
f8d14ea08b0ce7e55de4d01323859da917aa580d

SHA256
254c172b3fb4f690d6e03455c99385ad4c5af03db8a37ddeea00e10f87126338

SHA512
58948d26175038c06327f2c3fc4da209b65241528941141ffa5393cd9c365a0d07c0e2592e8a45ef79d884a7f6aade9da5e3230cfad3be531c70ba6fc4654a72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b0e7b6159d3f2fe3c125159b713fe2cb

SHA1
9833145c21f222c3ff75e7fb81f3eda1d24de479

SHA256
3895a0c6db0854afbdc06ace1ee088ad4c21293a4377d688e52bb501152863cd

SHA512
c26978c92921892ce2a59f48d0b046f2817e8c6865f4c457ac8c19684a2b13aadbae1bcc32bc0d363ca02733d45f5dbabb5c0e0e4779a0415ed1e8358a0d0daa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
e0b470c4141c591f74716c7cf8adb2fd

SHA1
12877b3ef7bf8c8f998a3cb2031d7c4e155ac202

SHA256
806385c48129379c399d786cc88351fde593e501ba66c003049d6df71d17ff20

SHA512
5777ce084030314c1d1b883f5229a30f9983527e432bff73a1ca077b7e419122c1689938e03ebc015c95be9d38a8f741a83b903137523337b0a825455f1a5abd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
a0cae7bee50313374e1df00c80864371

SHA1
39e504b5821501ea0fd6547e075a4b69c956253b

SHA256
08399ccd1c0dce1468ff10efb00c825dcb866be62c828c5315e88c6c5e349a75

SHA512
a0b3b7605859806439301d072250507c3360d076719639e5608ee11fb37f50e371c9d4c3e1c4e08c977b3b7d1c756a9f60660bcc811efa394eecfa9401e7cbb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0b444d749fb628c6621b983fbba67c00

SHA1
1803f1179e0cd233d7ede59eb84ae727d6b6b785

SHA256
572b47b92f928d99214376600cd2fbe93991e67e9d9735404054f98697793d80

SHA512
30a240f4b4cfdd922ad0f8f457e9d3646febe668d0ae4a722c2ab89b811897668a06d49ab9b14e63a5338968bd4998a8d49135d9379c7172874002a118e02230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
25694d81d1b1162e30306b99024e9e46

SHA1
21fcb212ba06563b2848edbc611396e35e7d8781

SHA256
e683c40d430e726d74ffb2596ee0f35ac7532de22b1784b27e8347988c14f0dc

SHA512
9aeaf19adfd3d19c43d9176fcfbbb7361abe20ffde8f1062176a9c6013e540e16f9b18d3e93e01379753e1e0222b976ce68fd7c17221ec3bfc20ebf5e5ccb408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
7e15f5e6531fb3d025de0f7c203da6e2

SHA1
46bbe8e891ac94b0d9505e04ab6c1e9f123ce3ee

SHA256
2ada8371c79ef7c6015269f0fa6593bcc96cbc1f4cfd44d9640c10ab19674d58

SHA512
d5ca19421517b9c5588aba2a6592b0a2c5aabab81346888757bb81e95fb504fc879f84a2cd1539390f269ecc08e20d304f2cf5b7ea71e5c4c18bc1e2d7d4aa1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4e4a230dd8e9c5628a04cd72003744d6

SHA1
fb61f9211a22520bd80f96772d4d157edf8e3e95

SHA256
53bcd1aeef2acefa173ae933f9150fa43823c6d3df5527239b14b4a8537c2be4

SHA512
eb9307c3676f94120028228a41a456e68c7612c622d0a92740ca3c292eb5aceab188554f1778023225d384e4e676ad417beb4b31c8f2972219aae262c8699033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
519bc1130596cba1114514972601c08b

SHA1
51f39132c475d72a32717208c45dd5a89b2e311b

SHA256
6826fc919e6ac49473c0ae067d5f4410eaf60ac823b6ca48d8ee0f7b67e7057e

SHA512
046ee82bc22e195097decbaeda77481840b2015a072c6b71836857d1c59c6f7e256563b5e079536b7ba3a7ecf309fcf2286d6cadbd687ec2aa90fe1da809209c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4f49020c0cc56bb342c0f82d38397ef1

SHA1
214b60959cc1f83e491c66db2f575367a4158334

SHA256
b484ef52197823bbbc496c0041072c79337d6acb77f026b7addd43032b3962ac

SHA512
c92297e4ceaf58d6b9b706833317dbe42f35f4670243f99d1a1403ccd3f2785a962f5f844d1d1a60fd9c71c761726655cf01640aa9e78c826356a3a9ba4b8268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
fa10a966b33b675c8f3302544566ac6f

SHA1
2ad207513e4c8a4a55dfeb9617d7998868e2109d

SHA256
5408886860dae30efcc494a9349ad1333b4229d021fed517d0550db9667aea51

SHA512
93ff1f637dbb8f67a0860f3be993006d7c9a309e44e0fc12d8ec0af2e757f90045422f4161aa85a333779be12d97353f2767554586e720d52f9642bea8c7e36e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
702B

MD5
7224b10e8ea25b825811ac7644c8cc98

SHA1
fc05895b7bc91f79551d9e65a4bd47a34d9ba0d1

SHA256
831ef968aabb321dda878379f7d6912fdd972f66ce8230c4249c16248692b92c

SHA512
7b169c336391b7af19ef2235af50432f109065ff6ecb96b305a3c7c11db40bd3a1298627440938f5b660ffc6f3878d56e15475dcf75ba73e546fbdfe4eb1c496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
60fdebae3873dcb1318ac8868d0d7b52

SHA1
3d697cdb50d4d2cbae0797e37aea735f9c12a04f

SHA256
224e7de1f0c416aca0dc82cb310fa633cb2881d7c3fb42a4490707988f2b13a7

SHA512
d463fb6786193e57c58c0332e8eb2999dbd0873e4bb0b7166f50c7c57593732ec35f002a57a0acfbf850446fc5baa37343fb21be810a91da33a42646d9760b9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
90cde083afe68eaf5c82255d6c80aa52

SHA1
e55305ad7cc4e05850c6635e6648a6d6b4143d50

SHA256
f405a67e14ef18d038ea4421b20df8939db97e99d7e2f16fdaa9bef383f7217d

SHA512
908106f5f1f3d152ce68e25291399e993f62a68937ef0ebd3d68d049bb359eec5c5874631af4d47704c15748fcc2b239152716c2330a3d01980e6dd3c618a52c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
2abc20080815d4634e0dacd5456caead

SHA1
d66df79fafdc803cc037cf325728f0813b5d7564

SHA256
63af3306c2d7959943f4e1d97be5fbb5db845b54445f7fa9befb714eb1676cef

SHA512
c977ce9e9b691786fa6c4abf7b6ee4746435ed1579a3cec2957064fc70ea4c69431b94046efb7921fbab2744c46568f50e0e3ad2a68bb2c2a077c249d1cebeb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
8396f87d680528744e16dc1167896f6b

SHA1
76aa1f53319cdf32cfea2f5bb1c139a550a3d0c7

SHA256
bfd80d0cceac3a31f5c0552fb4b8d588ef702669cae5f09688a6f72d6c16e1fb

SHA512
9dfea36ed9fcfd61408e734e71c7edd816657d0396caeb72e2cda2bf3f993a8f7ca331757416aee005e5f8adf515bca5fe7dfed9d83a117fd9f0f60c07ebffcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
973a29ca8937c9773ed48cf1c2d66552

SHA1
d0f9012f57615f7d33bc952c6833550f4ccda39a

SHA256
7dbbcf4182aea055f24c973bb1a01c79dc8ef97a363531bb311534b7ff7054c7

SHA512
478e88db941ca558db67bf2aa2156fa629e82d9730b7d6f6fb3a5d449f0abde743755c54cdddf0ff94d454e2618405c08aa1f2c197a58e3cdb02fd4693c74301

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a2c9f.TMP

Filesize
202B

MD5
2d87002f08981628f708f500a3129915

SHA1
84d6f62866ed65e2ebccb747904cdec7c74e08f2

SHA256
85bcab79a5565a7e33de136ce18ad29e1e54364d1cf7ffb8f75bf2c7378fbe33

SHA512
ee6fd1ae3f8a7d37fc8459598dd65a6096acd10f800300ccbe6cf66d0d1a693aa3593a223eea6ef76d6e32198b95ff64c0b7ac3e48a03d089a8fff5fb75ea918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5f2b07a78ac8b616b56b69ba1eaadd5e

SHA1
eb8e8a6af2f4daa357775d639d395887de6fb9ab

SHA256
5f2a13e687b4ec246e679e4c06c7f7975101777f6138a840d39c8cd57c88b5e3

SHA512
c598ad21c4e1e076ccf61b817c7b57c2fa599d2e440afcc51dc0cbdd3d586c0809ec18d53d8ebe25907b9292c198f11f8f81bd8b9d46cc5cc6c7668a3d10d81d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b7f8ac1bfc9289ad905d2b47d0db1332

SHA1
0428f59192573d2baf6d2ce59f85f6db2ccbd30e

SHA256
c8fd5fdae44de5b65b807a92ef28cdfa992f19f134cf9438e1f6731980bbe739

SHA512
92973f50c286927f403cb9a05365ac168fee66a891ce18ad6c4f9cad617ea845ec4ae1de809400202d5dd12edc4f69049bf5b3a3bb5f30264e48eac0cdd9245e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
490f85de76a7af2e9bab5e4006aa747c

SHA1
a89d33a9a616e32380e050b19a3db3b73e38fb89

SHA256
4290cc2ab13335897bfe54bc5a7dcbb4b4a9f642e2891cdf72975fe0a9945594

SHA512
7470098ec64b04f3e5f97007bf5f433a31ba9d9e1678d645b5848220b67e8586606833493490beccae121d44a68131d0ca799ba6576cb95618b5472837574369

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9CBD.tmp

Filesize
113KB

MD5
4fdd16752561cf585fed1506914d73e0

SHA1
f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

SHA256
aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

SHA512
3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

Filesize
1.6MB

MD5
d2ebd82a5d3fac11d44d90d8df253bb9

SHA1
ba94b456e111ea9573fe150ad4090a66540c9938

SHA256
04b65aa7b23d0c7ebbd6e022a600fbc43c0ee896ed280e48ac59e17fb0a2311d

SHA512
49e9ef8066200cd6ec079943c1fbcda95cab2d3042f635ed57949e0c0701ecdf34ea8f16324994dc77bc3ec9fc67882ea88b4d543974e90bf4e8cf69b15e073c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3bnrx4bx.sho.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json

Filesize
3KB

MD5
6bbb18bb210b0af189f5d76a65f7ad80

SHA1
87b804075e78af64293611a637504273fadfe718

SHA256
01594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c

SHA512
4788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\CertificateRevocation\6498.2023.8.1\crl-set

Filesize
21KB

MD5
d246e8dc614619ad838c649e09969503

SHA1
70b7cf937136e17d8cf325b7212f58cba5975b53

SHA256
9dd9fba7c78050b841643e8d12e58ba9cca9084c98039f1ebff13245655652e1

SHA512
736933316ee05520e7839db46da466ef94e5624ba61b414452b818b47d18dcd80d3404b750269da04912dde8f23118f6dfc9752c7bdf1afc5e07016d9c055fdb

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
31cb9e17ed0eb765067f9552d3ce2d9d

SHA1
c2742afc66483f3c23324b20e9471619e64c7282

SHA256
113a5ca8b418014541c2bd1c44a9fc862da9142deff48037e1272ac57fc322fc

SHA512
9099eb881c927be75689baecde7dadfbc10339c349fcdbadcc11cf538dfb5e3477ece5a01c54711ce24d58f5cb06b2262b22b1a48eb7e8178ab4d23792983111

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\70dc3257-e9a4-4d30-8031-3c717dc96665.tmp

Filesize
6KB

MD5
d704e98ac9a884ebdd898595722e1d9b

SHA1
33354b43d4fe202337351c1e1ed6ae9c75b21dee

SHA256
f2289637ee4344a4f6b5b9cc26433a24671632839e52ee827efefd73c9f607c7

SHA512
c7db52252cebb8b72ac9e897066549e97eb4f04f7d1629cc3ebf76a0407d2b59ee6d209f7041d8bba4203e185ea7ed96d5f7f8b6c4d7dfceb791ba73f2688385

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
a061ad8f80825ff1870057ab232620f3

SHA1
393c5bf5cddead617fd8308af987d4501d84f121

SHA256
802cc39f66dd00739e379cffb5fac6c1abe8a398f6821be084123c15394c3272

SHA512
0440faa7fa6b42051931259c70ca796dacd40d59d3f03408149f706309cfffec651935b2a6327410b551791b2908f8b1a22b00d428e5fc7cd805d54982f9e4d8

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
710715bcb3d4fea648cbe9e396af9639

SHA1
d00aa4ef0c58794419586a3fc97b071c45e7d6be

SHA256
0e258e9637fdb07b486c1cad159ff04d5035a65e0d551812a520a9166b2f9a4a

SHA512
cb5e8348726fdf63a5a4b4579b690c49f922d1a6ec9085bb53f0f7c0fe0d09c04d8bd6b04251e3c02eba30de39dcd8ff24241a0f9c554e65bca0c32be7611203

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
19f8828c8370f204ab8f50f3d0fdb3fb

SHA1
2ef5ea29bd6cd8dc8bbe856961472a9fe466cc4a

SHA256
6d1b3f306e00db6c586549d3ab7a04f35160c160beafe643270915f13ebd1c28

SHA512
57d9df6183d0499ff6e1307fa9ac9b0e3f253b1d1bca64cbed81bdf55b94694ad23db77290a8d98f09dd1e7317daef48fe34f11e728da9ccb4d7556e699f6149

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Network Persistent State~RFe5ae08e.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\TransportSecurity

Filesize
188B

MD5
3f52b7b2fd9de515d61c7aa695f06e88

SHA1
a11b17d5e475e01abd5926b555695ae7114f070d

SHA256
395e2cd625d87153a5ca42dc94f7884fd46d907218ae1b5a5d121de9e63dd845

SHA512
a686b499337ba2cf5c7527fd2250be8f3bd6f9ed0aa0f7d80d29522f8908a9e8208376b0347c1789940b3cc3f6e7cad4370c404228dde51876e6aec1b7fced63

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\TransportSecurity~RFe5c1bcd.TMP

Filesize
188B

MD5
71abfdffbdc8e5bc50510755be1c97ff

SHA1
ca36d1558d2cb3559283b01433e8a461cbc2a6ae

SHA256
9ce491bab776b5368129175a0440aefa097fa892b9e81df3f6b45ad75ce52eca

SHA512
d3e6948798d0e7d58e91565b30596e421956de5c316c9afdf6c8f0c23dfaac50c38cb926494ca981f9e8963cacce54f5dc62af86b3850d15b3e0a8f1bdc3963e

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Preferences

Filesize
6KB

MD5
ac66931ce198b4318630b231643f561d

SHA1
94f650e91b17a24531822b662c54a4fb6074c857

SHA256
6979e126e627809c518973fb24260d3cf60445693c25d4dfd56edf1881bf68b4

SHA512
508930ca56d03382937243df299e33fc8ab7f92adda3377bc4b419cba57c2df5ac7be39861b93416d0f084424d38fa4f215f922008fa27ea4d549b75927d36fe

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Preferences

Filesize
6KB

MD5
3cfa56a918fe59c56a0cf179807472f9

SHA1
688728173844c5b482c080836069f2c8079455c6

SHA256
a67f1716fc930dffc3f343964745190d65a4cbe4b297a616bca8a89a58012aea

SHA512
c823aca2a176b19a47b54e8a8e628f7fb7b2ca3fd2483f7fd7177b50157e124be33f822899efa8d711a02642f6a782bf8f05a158e57aca5e1b72e63acf583b47

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State

Filesize
1KB

MD5
56d7c62060a1a0edbd25af37cf1cdc11

SHA1
cd06677fe538ab84dce63c0621ecab6969d55e27

SHA256
b1e98ffd69d58d402dcda5f1068665a56e00dac13dde01765c817d632f6b7b8c

SHA512
ab449759bb2082160f8ba0c76c539cb6e891083da3cd74eb1af515754985fce71eea864674f854c8b5d9e261757a85314f6c44bd904faf0b3f10aea44a898a06

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State

Filesize
3KB

MD5
ed93a2f63f1a35834f8bde4ab09d9bbb

SHA1
f4dd4d302a5c6912c8123ab49071039e54763acf

SHA256
870b38ad443892b7ff33283050858830fe5429565198a7588e62bb102b698b52

SHA512
35cee3742db84b342971c4024abb989c780741a1105131fad62c94498c7166534e97999eb64c308d6c501afd8ed3830837cf61596c6d0882149f7ed01be59e65

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State

Filesize
16KB

MD5
4de4daa226086455cb10d4121ea5a116

SHA1
a7044d87d046b1ff959d1dfc2fad790335827fa7

SHA256
a088be1b19b20fac9b7c746d40b1567070ffa6a795b3404907d848520378ac79

SHA512
a0c4a85be5e592d1bcd5476db6699c0e0a043db4810d8c93869868afab0c178b39f46afcd7bc7983c53dac3b695ce6661ae6617e8a2bb505fc8fc407ec95de8e

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State

Filesize
17KB

MD5
367de7d34987b6e9f70ad1bf613f884c

SHA1
60e87e04a91665a7e5b87540082ad6daed422c43

SHA256
1d968988399a572619630a1d43e27c48fb22b299621d76a0ce9d58c985656fd7

SHA512
03c1b93176761b1e6e87a5d52e5d88c062d1948688a4ffe57a0ceb273bd8e75589941dac3fdcad3d79f34c1edb1d0deb08107c9fb097d5f3d45daafca3832e26

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State

Filesize
2KB

MD5
057b8aa7ee786aeb8cb6156a33ae377a

SHA1
9c96ec9778ed759c919241e042e299168a589b53

SHA256
e9f2f9afda1b16af7554f60ed5de37d0b5c4602f9a9e306e45f82d65e75784a9

SHA512
c94920f79d0af0696834e2bdd28940631c2864cf76029a92ce4fa2022d9bcc6eb960a619026bedb9c3cb73662421c156323be7f549c46c03904ca855c0ce8a25

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State~RFe59ba1f.TMP

Filesize
1KB

MD5
e53b8cd3040115541b2893b73cf138d0

SHA1
5dc3146c656fdbb8b31606a4ec73fd9fd0b8cffb

SHA256
04ed1a77f48343c9e8f1b600b22d976d10055acf9b3d9c60d1ef8521150241d2

SHA512
c17d76801ed6c0d1bb536b6a3e0ff5b01f24d2b9bc526de746c7e7db7e82d40536cd1ca3f4ee1077987edaeb3ef08bedaf865a76ed38d7a04846ee7a6b47097f

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\PKIMetadata\13.0.0.0\crs.pb

Filesize
278KB

MD5
981a9155cad975103b6a26acef33a866

SHA1
1965290a94d172c4def1ac7199736c26dccca33e

SHA256
971393390616fbe53c63865274a40a0b4a8e731c529664275bdc764f09a28e2d

SHA512
2d75ce25cb3a78f69f90fbd23f6e5c9f1a6ed92025f83ce0ab3e0320b64130d586fc2cd960f763e1ab2c82d35ef9650ebd7ff2a42a928a293e0e7428cc669119

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\PKIMetadata\13.0.0.0\ct_config.pb

Filesize
7KB

MD5
df3d937079b894c891f9b0b741874928

SHA1
ed93fc386807b3a28fcc7988a88ae4741bfe1b15

SHA256
c7cbb0db6e924cbfccf4a6e8223e3fed4d93f5d78a3122c30213b6e38ee195f4

SHA512
5728bdd930283a4906e7e07acd3eadecb813a3154ffb41729738444bf13aab27dceb01e05a27c77bb13cc498c1d5c2d492ac653ddbfe4b14004b1c7a5bc54f1b

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\PKIMetadata\13.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
d43d041e531dc757a69a90cb657ef437

SHA1
09138b427565bc276cfd3ba9f59b0c8bad78e91d

SHA256
9431360a5534ad2f8eddde157cce39704b99da035fcb6d2cca11220700b11ccb

SHA512
476a98122059b9cc19492b7ae557c61381842c8c347f85c686e0a493bfd0e8707ce3491b690e7978b3fb7d7d2a4daa2767e4a590398a50562519bf32e8d12ec6

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\SmartScreen\local\uriCache

Filesize
9B

MD5
b6f7a6b03164d4bf8e3531a5cf721d30

SHA1
a2134120d4712c7c629cdceef9de6d6e48ca13fa

SHA256
3d6f3f8f1456d7ce78dd9dfa8187318b38e731a658e513f561ee178766e74d39

SHA512
4b473f45a5d45d420483ea1d9e93047794884f26781bbfe5370a554d260e80ad462e7eeb74d16025774935c3a80cbb2fd1293941ee3d7b64045b791b365f2b63

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.55\Filtering Rules

Filesize
1.8MB

MD5
a97ea939d1b6d363d1a41c4ab55b9ecb

SHA1
3669e6477eddf2521e874269769b69b042620332

SHA256
97115a369f33b66a7ffcfb3d67c935c1e7a24fc723bb8380ad01971c447cfa9f

SHA512
399cb37e5790effcd4d62b9b09f706c4fb19eb2ab220f1089698f1e1c6f1efdd2f55d9f4c6d58ddbcc64d7a7cf689ab0dbbfae52ce96d5baa53c43775e018279

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.55\LICENSE

Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\TrustTokenKeyCommitments\2024.9.20.1\keys.json

Filesize
6KB

MD5
997fb5b01c6e849ff4517aa54942aec1

SHA1
9f0ade3959dbc40127ce1980e26e542f3e1bd2ec

SHA256
51786c8be1450371db61fa5ab11f772b45e8b67c6f1daa44969d69e99d1dfbc7

SHA512
880fbe405889c7faef3b1e9218bff837b99df38e149c509cf9e5b712ff1a81baf270a47d5f746f8c5a333423109936466fc8f937be68cdb630ea3c2aa5977094

Download Submit
C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\hyphen-data\101.0.4906.0\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Windows\Installer\e57de1b.msi

Filesize
8.8MB

MD5
c094ae439f4a97409d752fa64f6eab86

SHA1
e607d4616a2262bb245c43269d7c3f769269e5d0

SHA256
9ab1f0f955d23c0a2a0e3727a9f778bef9057d4b615df3f6194906dac49e2c26

SHA512
df8bd4db2130cdf94493caa170801cfc1e273aa22253d33b066db3be56b164c904f54172bb6f60afd131f9459a8e9895d718bb905420f067936862d86ed9506e

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
bc8736a264435cbc89afe27137110844

SHA1
a1837e91806797efac68301ac0a4e1a1671497e4

SHA256
6b70324c37b85320f1bf7764d52a17739291a78b70dabff0655408908008141d

SHA512
f21ab7063c13e6152bb92f71bbb4be09774cffaefa0c077ee6cff0e59a5b8bd3ae2be9083b6817c700387c18106905baff979d3dc726ad492d5e4367604ea435

Download Submit
\??\Volume{f1c94fa5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{588872d6-efd6-42cb-a03c-a1d10e4dfdee}_OnDiskSnapshotProp

Filesize
6KB

MD5
0937582c55ce9019bb77684b68eef574

SHA1
fa99ff1a9d0b107588fd74c8a7b7fd5c9555e73a

SHA256
34405b11379d36d9a2aa932e2ee9505d548046e18b1d2cfbd2e0d4e9dc9ae1b2

SHA512
9fcdc1b9617e64a64e98894382b326ca899d45f58e923a38cd8c6d515f45f352669ceb992836d3cbe28af9561b3a6071be1051fc0d2ecdb351dd4520e9eaa496

Download Submit
memory/1536-379-0x00007FFC37150000-0x00007FFC37151000-memory.dmp

Filesize
4KB

Download
memory/1728-66-0x000001837E930000-0x000001837E952000-memory.dmp

Filesize
136KB

Download
memory/3160-264-0x0000000000580000-0x00000000005B5000-memory.dmp

Filesize
212KB

Download
memory/3160-265-0x0000000074590000-0x00000000747B5000-memory.dmp

Filesize
2.1MB

Download
memory/3160-312-0x0000000074590000-0x00000000747B5000-memory.dmp

Filesize
2.1MB

Download
memory/3160-326-0x0000000000580000-0x00000000005B5000-memory.dmp

Filesize
212KB

Download
memory/4784-364-0x00007FFC37150000-0x00007FFC37151000-memory.dmp

Filesize
4KB

Download
memory/4920-378-0x00007FFC358F0000-0x00007FFC358F1000-memory.dmp

Filesize
4KB

Download
memory/4920-377-0x00007FFC35D30000-0x00007FFC35D31000-memory.dmp

Filesize
4KB

Download
memory/5196-1825-0x000001B271580000-0x000001B271581000-memory.dmp

Filesize
4KB

Download
memory/5196-1830-0x000001B271580000-0x000001B271581000-memory.dmp

Filesize
4KB

Download
memory/5196-1835-0x000001B271580000-0x000001B271581000-memory.dmp

Filesize
4KB

Download
memory/5196-1824-0x000001B271580000-0x000001B271581000-memory.dmp

Filesize
4KB

Download
memory/5196-1823-0x000001B271580000-0x000001B271581000-memory.dmp

Filesize
4KB

Download
memory/5196-1834-0x000001B271580000-0x000001B271581000-memory.dmp

Filesize
4KB

Download
memory/5196-1833-0x000001B271580000-0x000001B271581000-memory.dmp

Filesize
4KB

Download
memory/5196-1829-0x000001B271580000-0x000001B271581000-memory.dmp

Filesize
4KB

Download
memory/5196-1832-0x000001B271580000-0x000001B271581000-memory.dmp

Filesize
4KB

Download
memory/5196-1831-0x000001B271580000-0x000001B271581000-memory.dmp

Filesize
4KB

Download