Overview

overview

8

Static

static

3

Assist-win-Setup.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    1196s
  • max time network
    1156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2024 21:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Assist-win-Setup.exe

  • Size

    18.9MB

  • MD5

    ad82c45b85eb505d487a170c767765df

  • SHA1

    cd341460c5e348ac4129b74e7f3b66c04919629c

  • SHA256

    aa23c1f9140207af1cc00b8fc786c628758ed88f0ab7292c558f160efe5500dd

  • SHA512

    4bf0f67be348b6ed872dde6abb641906ac42cb88e87a1b1e5d2afb6c9de3a640569260f8b75955aea5e6c6d9200b58ba4515fcbf0fbc8c51e5503fae70dd0d07

  • SSDEEP

    393216:/8flUO+/aokj2bdvNw9Bm9aIhNq9KoiPT1I8Coyhd8owBlCsjtkLZc:/8yK2yI0KnPT1sdtDZc

Score
8/10
adwarediscoverypersistencephishingprivilege_escalationstealer

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 33 IoCs
  • Loads dropped DLL 24 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Checks system information in the registry 2 TTPs 16 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Assist-win-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Assist-win-Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4344
    • C:\Users\Admin\Downloads\inst-webview2-evergreen.exe
      "C:\Users\Admin\Downloads\inst-webview2-evergreen.exe" /install
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2632
      • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\MicrosoftEdgeUpdate.exe" /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3736
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4588
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4400
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:4528
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:976
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:1116
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzQ2RjQwQjQtQjBDNS00QkRGLUFENUMtOTQ2MDQxQ0FCOUM2fSIgdXNlcmlkPSJ7REEyOTgyMTItNUZCRC00MzNCLUJCM0ItRTBBNDU3ODE2QUVCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxRUI4NkMzQS00NDgwLTQwQkEtOTQ4Ni05MkI4NTNGMzE5M0F9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjMxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0Nzc0OTM3MzY5IiBpbnN0YWxsX3RpbWVfbXM9IjU5NCIvPjwvYXBwPjwvcmVxdWVzdD4
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks system information in the registry
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2268
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{746F40B4-B0C5-4BDF-AD5C-946041CAB9C6}"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:628
    • C:\Users\Admin\AppData\Local\Assist\current\Assist.exe
      "C:\Users\Admin\AppData\Local\Assist\current\Assist.exe" --veloapp-install 1.0.18-live
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4920
    • C:\Users\Admin\AppData\Local\Assist\current\Assist.exe
      "C:\Users\Admin\AppData\Local\Assist\current\Assist.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Users\Admin\AppData\Local\Assist\Update.exe
        "C:\Users\Admin\AppData\Local\Assist\Update.exe" apply --waitPid 2680 --package C:\Users\Admin\AppData\Local\Assist\packages\Assist-1.0.25-live-full.nupkg --restart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3940
        • C:\Users\Admin\AppData\Local\Assist\current\Assist.exe
          "C:\Users\Admin\AppData\Local\Assist\current\Assist.exe" --veloapp-obsolete 1.0.18-live
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3068
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:400
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzQ2RjQwQjQtQjBDNS00QkRGLUFENUMtOTQ2MDQxQ0FCOUM2fSIgdXNlcmlkPSJ7REEyOTgyMTItNUZCRC00MzNCLUJCM0ItRTBBNDU3ODE2QUVCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RjRCOTE5QjktMDE5NS00RkRBLUJGNTgtNTJDNTUxRDFFMTY1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O2xoVmkxMlFjazZTbDB1VTFPQjZZMTUyOWJSNmJzZXk0K2N1N2RIeHM2Y2s9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzMSIgaW5zdGFsbGRhdGV0aW1lPSIxNzI4MjkyOTAyIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNzI3NjU0Njg2NTIwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDc4MTE4NzMwNCIvPjwvYXBwPjwvcmVxdWVzdD4
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4492
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7D1FCF1B-70F9-4832-96C7-A032803A4EB7}\MicrosoftEdge_X64_130.0.2849.56.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7D1FCF1B-70F9-4832-96C7-A032803A4EB7}\MicrosoftEdge_X64_130.0.2849.56.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3860
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7D1FCF1B-70F9-4832-96C7-A032803A4EB7}\EDGEMITMP_DB515.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7D1FCF1B-70F9-4832-96C7-A032803A4EB7}\EDGEMITMP_DB515.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7D1FCF1B-70F9-4832-96C7-A032803A4EB7}\MicrosoftEdge_X64_130.0.2849.56.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:3712
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7D1FCF1B-70F9-4832-96C7-A032803A4EB7}\EDGEMITMP_DB515.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7D1FCF1B-70F9-4832-96C7-A032803A4EB7}\EDGEMITMP_DB515.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7D1FCF1B-70F9-4832-96C7-A032803A4EB7}\EDGEMITMP_DB515.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.56 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff6dc34d730,0x7ff6dc34d73c,0x7ff6dc34d748
          4⤵
          • Executes dropped EXE
          PID:3032
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzQ2RjQwQjQtQjBDNS00QkRGLUFENUMtOTQ2MDQxQ0FCOUM2fSIgdXNlcmlkPSJ7REEyOTgyMTItNUZCRC00MzNCLUJCM0ItRTBBNDU3ODE2QUVCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBQkRBODA4Ni1ERkRFLTRFQUMtOTZBNC05RkQxNUYwMTdDNDl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMwLjAuMjg0OS41NiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDc5MjI4MTMyMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ3OTIyODEzMjIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDUxNDc2MTAyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8zNDZhZDlkMS03NDZlLTQ1YzctOGZlMC1kNmM4N2E3M2EyNjE_UDE9MTczMTYxOTkzOCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1YUW51emhUUnZnR0czYzJ1Q3c4WkluN01tWVpoVlFBeCUyZk1ORUlkQzdvVlE3VHVtakU4WSUyYkNrbEFxcGI1a0d2T1BKcGs0RDF5RE9xTDhoeHpTelVqQVElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzQ5MzM2MDAiIHRvdGFsPSIxNzQ5MzM2MDAiIGRvd25sb2FkX3RpbWVfbXM9IjE5MjUwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA1MTQ3NjEwMiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwNjU2OTQ4NjUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU2NzQ2MDExNTMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI3NjYiIGRvd25sb2FkX3RpbWVfbXM9IjI1ODg5IiBkb3dubG9hZGVkPSIxNzQ5MzM2MDAiIHRvdGFsPSIxNzQ5MzM2MDAiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjYwODc1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4948
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4316
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1BB2EBA7-C1C7-414F-B151-258E005A057D}\MicrosoftEdge_X64_130.0.2849.68.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1BB2EBA7-C1C7-414F-B151-258E005A057D}\MicrosoftEdge_X64_130.0.2849.68.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3764
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1BB2EBA7-C1C7-414F-B151-258E005A057D}\EDGEMITMP_CA5CA.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1BB2EBA7-C1C7-414F-B151-258E005A057D}\EDGEMITMP_CA5CA.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1BB2EBA7-C1C7-414F-B151-258E005A057D}\MicrosoftEdge_X64_130.0.2849.68.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:4332
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1BB2EBA7-C1C7-414F-B151-258E005A057D}\EDGEMITMP_CA5CA.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1BB2EBA7-C1C7-414F-B151-258E005A057D}\EDGEMITMP_CA5CA.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.92 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1BB2EBA7-C1C7-414F-B151-258E005A057D}\EDGEMITMP_CA5CA.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.68 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff75d01d730,0x7ff75d01d73c,0x7ff75d01d748
          4⤵
          • Executes dropped EXE
          PID:1768
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1BB2EBA7-C1C7-414F-B151-258E005A057D}\EDGEMITMP_CA5CA.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1BB2EBA7-C1C7-414F-B151-258E005A057D}\EDGEMITMP_CA5CA.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:3440
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1BB2EBA7-C1C7-414F-B151-258E005A057D}\EDGEMITMP_CA5CA.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1BB2EBA7-C1C7-414F-B151-258E005A057D}\EDGEMITMP_CA5CA.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.92 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1BB2EBA7-C1C7-414F-B151-258E005A057D}\EDGEMITMP_CA5CA.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.68 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff75d01d730,0x7ff75d01d73c,0x7ff75d01d748
            5⤵
            • Executes dropped EXE
            PID:4784
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2676
          • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.92 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.68 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7e8ded730,0x7ff7e8ded73c,0x7ff7e8ded748
            5⤵
            • Executes dropped EXE
            PID:3112
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2424
          • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.92 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.68 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7e8ded730,0x7ff7e8ded73c,0x7ff7e8ded748
            5⤵
            • Executes dropped EXE
            PID:4148
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:1564
          • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.92 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.68\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.68 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7e8ded730,0x7ff7e8ded73c,0x7ff7e8ded748
            5⤵
            • Executes dropped EXE
            PID:644
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTAyN0YxMDgtNDYzQy00ODJFLUFDMjktN0I0OTVDRUJCRDdGfSIgdXNlcmlkPSJ7REEyOTgyMTItNUZCRC00MzNCLUJCM0ItRTBBNDU3ODE2QUVCfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntBOEU2Qjc0NC1FNjg3LTQwRDYtODc1RS01REFGRDBGQTRBMTB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7bGhWaTEyUWNrNlNsMHVVMU9CNlkxNTI5YlI2YnNleTQrY3U3ZEh4czZjaz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4zMSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJJc09uSW50ZXJ2YWxDb21tYW5kc0FsbG93ZWQ9JTVCJTIyLXRhcmdldF9kZXYlMjAtbWluX2Jyb3dzZXJfdmVyc2lvbl9jYW5hcnlfZGV2JTIwMTMxLjAuMjg3MS4wJTIyJTVEIiBpbnN0YWxsYWdlPSIwIiBjb2hvcnQ9InJyZkAwLjQ2Ij48dXBkYXRlY2hlY2svPjxwaW5nIHI9IjMxIiByZD0iNjQ4OSIgcGluZ19mcmVzaG5lc3M9Ins4MDhEQTZDMi03NkQ5LTQ3OUUtQTNBNy0yMDVCNzJGM0ZDQUJ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iMTMwLjAuMjg0OS42OCIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpc19waW5uZWRfc3lzdGVtPSJ0cnVlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNzI3Njk3MDk4Nzk2NTAwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTQ4OTQ2MDExIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgxNDkxMDIxMjYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg3OTk1ODMzODgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy83ZmFhMDBkOC1mZWExLTQ5NmEtODE2My1hZjQ0OTdhNzZiMTY_UDE9MTczMTYyMDI3NCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1VeDBFQllOWTlaZVhkNmphc1RvRHNSbWVQYkZoZ1NnTkFKNTNsbTBycmNYdVRKUHhiJTJmcUltS1haMEtpVmJFbnJ3eGtpUGhkYkVmaVQxM2lBMEQzajdBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODc5OTU4MzM4OCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvN2ZhYTAwZDgtZmVhMS00OTZhLTgxNjMtYWY0NDk3YTc2YjE2P1AxPTE3MzE2MjAyNzQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9VXgwRUJZTlk5WmVYZDZqYXNUb0RzUm1lUGJGaGdTZ05BSjUzbG0wcnJjWHVUSlB4YiUyZnFJbUtYWjBLaVZiRW5yd3hraVBoZGJFZmlUMTNpQTBEM2o3QSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3NTA0NjIwMCIgdG90YWw9IjE3NTA0NjIwMCIgZG93bmxvYWRfdGltZV9tcz0iNTg5NTQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODc5OTczOTY3MSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4ODEzNDg5ODc3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5NDIyODEyMzQyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMjgyIiBkb3dubG9hZF90aW1lX21zPSI2NTAzMyIgZG93bmxvYWRlZD0iMTc1MDQ2MjAwIiB0b3RhbD0iMTc1MDQ2MjAwIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MDkxNiIvPjxwaW5nIGFjdGl2ZT0iMSIgYT0iMzEiIHI9IjMxIiBhZD0iNjQ4OSIgcmQ9IjY0ODkiIHBpbmdfZnJlc2huZXNzPSJ7MDUzNzQ3RTQtNzUyMy00NDQxLThBRUItMkE2MkQ5NTBBOUZDfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMzAuMC4yODQ5LjU2IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjY1MTciIGNvaG9ydD0icnJmQDAuMzkiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9InsxQUM0NkMzNS0yM0Q5LTQxRkMtQjUwMS1CNzdEN0FGNUZEMjl9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:3772
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:2884
    • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
      "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4876
    • C:\Windows\system32\wwahost.exe
      "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2160

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Active Setup

    1
    T1547.014

    Browser Extensions

    1
    T1176

    Event Triggered Execution

    2
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Image File Execution Options Injection

    1
    T1546.012

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Active Setup

    1
    T1547.014

    Event Triggered Execution

    2
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Image File Execution Options Injection

    1
    T1546.012

    Defense Evasion

    Modify Registry

    4
    T1112

    Credential Access

    Discovery

    Query Registry

    4
    T1012

    System Information Discovery

    3
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    System Network Configuration Discovery

    1
    T1016

    Internet Connection Discovery

    1
    T1016.001

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Installer\setup.exe
      Filesize

      6.5MB

      MD5

      9a98f71bb7812ab88c517ba0d278d4c9

      SHA1

      459b635444042ad0eeb453cdba5078c52ddba161

      SHA256

      273f8406a9622ddd0e92762837af4598770b5efe6aa8a999da809e77b7b7882f

      SHA512

      5685717b2192b477b5c5708687462aa2d23999f565a43b7d67388f48eb9a3d33d9a3da54474ce632a0aee1bc4de8a6172a818239033d4a035f045e15947868f3

      Download Submit

    • C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.68\Installer\setup.exe
      Filesize

      6.5MB

      MD5

      f6718e31d7d4f5533d0e37f10be482be

      SHA1

      86d7ecb6ea92632fba9aea98c8cacc34e16f2974

      SHA256

      9e6148a3fe08dc8292f4df78e79a3ccbaf69099ce92acc01aedd371b90a06827

      SHA512

      52080bce605eaeceae6e3ca854ebec2923454e82fb26fa2fa707d521244f598bf9612834d8db402b52cee383b53ee8969f47c234ff2a8c138486b28ae598e9bd

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\EdgeUpdate.dat
      Filesize

      12KB

      MD5

      369bbc37cff290adb8963dc5e518b9b8

      SHA1

      de0ef569f7ef55032e4b18d3a03542cc2bbac191

      SHA256

      3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

      SHA512

      4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\MicrosoftEdgeComRegisterShellARM64.exe
      Filesize

      182KB

      MD5

      1723c5e707061e59d769c492a95d5083

      SHA1

      3b535b7a0df2f7a4ab5e531956dad9892adfb5e9

      SHA256

      e97ab6dc0ed865aa8606f5c113fd62170341d1a3d63d5618f233aea969ec49ab

      SHA512

      a4e3bd9ec331a27338c123a9a3ae23619fc5a5b80fc9aea38d23d3b82ca015f47669e0f3e1a6f98e7f464e6bc21e92723a04f72805e45e0dfc81540a2d299a8a

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\MicrosoftEdgeUpdate.exe
      Filesize

      201KB

      MD5

      35a79bd6de650d2c0988674344bf698b

      SHA1

      a0635c38472f8cc0641ceb39c148383619d221dd

      SHA256

      a79a81da2b8dcbe39609a9e1b4e8c81ae0bc54195c0c854b77bebe7bfa7f10c1

      SHA512

      afe33d38785afe489845654ba1c3ed6648b36b1ebe5f98b3d5d4bf24eba3af9bb6676af5a79d2ec570bf2b4b6ae40d14fc3d4b872c5d4577aea40f6d1a26c0cf

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
      Filesize

      215KB

      MD5

      c55b37823a672c86bc19099633640eab

      SHA1

      da5e15d773c794f8b21195e7ad012e0ed1bceb72

      SHA256

      3df9cd2fecf10e65be13d4b61ca0a9185845f2cb04b872adeaf41ca46af39aa0

      SHA512

      1252c3fde4aa4ce239103e8df7224afce093a2cbe539bd40347601980a314ea3326ea6ce4c1ebc845c125845969ad65ebca319b9df35a809ef871bad14aaf33d

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\MicrosoftEdgeUpdateCore.exe
      Filesize

      262KB

      MD5

      dd30f3ff486b830211df62d20348f86f

      SHA1

      08c7d7407dee7ed20b50e8f1a2cb1b08a9282dbf

      SHA256

      9d57bdc8b97e75f8a04b93a1657dfd18d4e2f68607783c9bca42140233978fa7

      SHA512

      af3b48ced7018c7edeabdfa998e51356d57c2d7a846c76629fed0ff2e5db8db79041184c58a5a67a10ec627f53af8e3c80bbffacaecf5dae6d989cecb82e72e4

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\NOTICE.TXT
      Filesize

      4KB

      MD5

      6dd5bf0743f2366a0bdd37e302783bcd

      SHA1

      e5ff6e044c40c02b1fc78304804fe1f993fed2e6

      SHA256

      91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

      SHA512

      f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdate.dll
      Filesize

      2.1MB

      MD5

      39ac5a029f87748e964491b97936d890

      SHA1

      24777aad794a13d0e7381fc6f32f0e1bcdb1ba80

      SHA256

      ba861524fe648ccb47b7ac57421bb07a6231a7aab5eaea332548511cce6185bc

      SHA512

      2ecb9b208846f84cd37f37d2100f26358d6c37128efc4010b2e7efc10202dc37b621d0c0138a8b76b23d968da324c685a41b44f4ae30cbbe243581f1904e14c6

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_af.dll
      Filesize

      29KB

      MD5

      2a9524cf8afae49394379d9d9be69206

      SHA1

      e43d4146f8abebbb30831fbd39a39846bfb7eeef

      SHA256

      e5a08731963e681b6386c4e85c16bc98452ebc13c4a7de3ff6979125c609d5f0

      SHA512

      a0111589960cbdcb10b55c17aa82555e44f0f0f173ebad09de6364881138cb35280596f1de6d86b31044427445575630c22079c3585e34729ce461599b8979b1

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_am.dll
      Filesize

      24KB

      MD5

      1903bc250fc269e79c9f7aada2979aff

      SHA1

      efbf76b1259217c02c138078c56f36b2cb8543ab

      SHA256

      228fa3e2fcacc78111a8152d6862de2302c024e81cc8b5e3f16e31caf96cfd04

      SHA512

      9db527c2e26ef691c089f5d1d010298e0f47e2e0420fba03ed18c7c2793b92c5860240b214b5233dddbc150413a2649e9cf4823239b9831930c2804b143ab538

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_ar.dll
      Filesize

      26KB

      MD5

      b4c28669b9d4e56b094af6062f4db065

      SHA1

      4c492c03138c8a796cf0673866892b9e0c2073ec

      SHA256

      7fe494dd265f99f330b153ef69c51c0541016755ca1876788f7f0ede78f9cedb

      SHA512

      35941ab6f2dcf5f60824d172f75f9f7b8b93e65c7bd8bc441fc32e49cbb414a68d65a02e3479b096f728b2a34d3e85dfd868e8bf95ff9b1a57d10adc3da0022a

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_as.dll
      Filesize

      29KB

      MD5

      16b0c8a664626da016a95fb46fdc9c0e

      SHA1

      c674b635cd8927511825847f3d86a5562b4155d7

      SHA256

      b059fc9713d3a41e9a83f0d61f8cce29546d3759def0a7b8e162a13915e51255

      SHA512

      ec39269fbd9e510d10d665c86b8a8161208b74f919e4fd128e365144d71f2b59d3c48c50b8f017b1d30c711ee4f63668f843539957b4643d2a488c9e17290e75

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_az.dll
      Filesize

      29KB

      MD5

      bf510bb9b7639af7da969f77620b480f

      SHA1

      17a6693a5d6aea1f3fa6f34abc46daf558cac645

      SHA256

      2507da222cf6c6dd608da9b569f89f8e11c47b6e16134c767cdc23b7c1f56bd3

      SHA512

      6cebe80005cb7759ee4fd8dd9ca41bdd073c01e969e1ebe03cb07616921e50516974019faacc2f9dcaaccdc0044eaae57a6a94f3a4a4ce044a781cd8091478a7

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_bg.dll
      Filesize

      29KB

      MD5

      4b23c7229eb43740744cfbf48c4242ca

      SHA1

      4938dcf6239e14db53c8f085d3c477905a9986af

      SHA256

      a7527b867ebc222114b679b2ac542cdc46a75f8bc24e5ca8b7ebc17b7a2963c2

      SHA512

      4bd8ed0ecacd3f2c69dcd0789ab8ee10dcfd6144b019dd8858c2234bebddfe42c83037fb8e2f934f3320f58796683bed5ab050ba897ba1fa409b6df60f02ec53

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_bn-IN.dll
      Filesize

      29KB

      MD5

      1e038b27661b303e15a39a55305e86bb

      SHA1

      35b48fe72d50406063f9145fea64c57f205f0084

      SHA256

      385665137d0dfee16ed8ef2da5ce28d826d210eb2bde1fa4ef13dac50e4b5364

      SHA512

      13fcfde6923b38acc2cfa530087d13725a2cabdd2e771d503f4d2f5cff93e8744f142e235dd484244d920d80cb3e7cecbbd731b473f6e509edb39159c51e9465

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_bn.dll
      Filesize

      29KB

      MD5

      9afe531b6472cf9eb66028e9638584bb

      SHA1

      6212292867bd59fe376e79988c07f4db8ad26cdc

      SHA256

      383754fc147dc6ef5f1edd14b60bab6bebf32639dfea718aaa64b2b65ac98812

      SHA512

      352bec509ccd3ad15a274ddd3ccea43b76eaed885b0e7722235abd95aab8fec1c645722765d76865c1b32ed422a10e6666f220e3abcc5a24268ba94c5cc6b8d8

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_bs.dll
      Filesize

      29KB

      MD5

      5e06d311c2e24b94f378c4d3b3deb260

      SHA1

      ef7df63f63746eb197c21694ebb21cfb86c0b2b8

      SHA256

      d2052450e3a3272b302d80af9f2c46b766153267100bc902dcf03a78ec609b65

      SHA512

      8d73b5265735aa19116cf41bb8d2bdacde5b22b286a56af58068f9579b631b044c155e625f6e1fda12e505f621f245faebe126c2557dd2ec873d7d980f8ba552

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
      Filesize

      30KB

      MD5

      afdafc9f56401b662f42cef830d92b38

      SHA1

      b56966370ec07cd676e35d93fad001e0f6b3fb8a

      SHA256

      03d7a1c0d8810df4b908fcc40c8491df0e3ce19db8ee22e6be79d02fd9df8f72

      SHA512

      884f9cd99785ea91c5c8e26200bbf0b010ff278b52c5ac590cb73712321a9cdb645e5448bf4cf62622cdb06543b8de4a8e6956a2f6b6677c0b9befb35589d8b0

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_ca.dll
      Filesize

      30KB

      MD5

      15ee7526536790bf77317975896542f9

      SHA1

      365bc54203b490daa0e24a1c9813d5d99c9de720

      SHA256

      5e2349af6e02da1c5d18f1b3235fc5099229d2d99e1c5cf2713c21472c151f8e

      SHA512

      475fd9c0879c8cbc418a66441e3dc026fca983327a95763eddd1537c1f44fdf272d212c69e1b06aad55d91c68379a2beafb2908659d58a61c740731a7d047406

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_cs.dll
      Filesize

      28KB

      MD5

      8eff4531519a4b768005b9411d4a5f9c

      SHA1

      59b354e3f32f0a0da8755c27b903803994f4aa31

      SHA256

      2e9a230a8b8a7fa437a28e2115ebf01178f3209fc0d61eb90160f49c11a16cb0

      SHA512

      4426ae1e2937e1f6c7364d2f437aeb83d834f9997d28cb1ffb07fe1c448dd954083aa822ff439c886249a387823a23245640a0425dd8c42b75b73912733f11ee

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_cy.dll
      Filesize

      28KB

      MD5

      11b92ae8fe94c784480d465a37935766

      SHA1

      f4ead29d4b20c57bb0e4d16a7488784f61a25972

      SHA256

      571b0cf8b0383e33393b8b8fa79d1632688ffc2bdde794fff62c85f5e1a3f161

      SHA512

      b636dec2e1d48916d0c83d2fe45eb24d826c027455cf22ec78e013166e59fbdb4780ebe69de3ab4b5730dae03652d253890917f53fc835aa73f9f75b01dc4f23

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_da.dll
      Filesize

      29KB

      MD5

      19a7aee0daf68fdc1a24e3228a8bf439

      SHA1

      1fc6ce227a11245787c80f3932e2c311de2d44bb

      SHA256

      409cce12be8b7a86313bd1d9e3c6d9154cf0c5735db61d94852a128a746dab99

      SHA512

      0051119311316d29dbc13ace84c24283aa2eaf1d46459c81ba7b31cc6178b43165618fd7bec17de698b1431ef2b33be179c2c8b1537c1000aadf849e2c888c84

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_de.dll
      Filesize

      31KB

      MD5

      ce66ef1a806c21949b75055f81cac760

      SHA1

      3719e4af114a3c0baceb133d152a02bc6a1fb9f8

      SHA256

      23f5414d554b96db0b93c7dbe27939d294b8061e56c19ab74d59fe9135e81c8f

      SHA512

      04d9575c866ac28db490a291be3da41f884d3ceadbc9b7077776ea7deb1819277aadcf9c9e1b5afede3e90bafbcb00e6ef0840166228d153be7e8d8d53975593

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_el.dll
      Filesize

      31KB

      MD5

      09cf47260852ff7b2c91c65d127b9314

      SHA1

      b3d362f3d08f81bd1b719a1c94b54f5f9c9610da

      SHA256

      eb4344676280f83e6023ddc604ffa42e96eb46e765a216fbc5ecbe49ddb3c920

      SHA512

      114a21296d8e7e054906139102617e6cd6008337a0877053721553cfed10183f54f890c8071b1cea17bd0b2535589af7aafe5bd1d161886ad7363f89919d7300

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_en-GB.dll
      Filesize

      27KB

      MD5

      39dc20ae50a0e2ba9c55dda91256b3cc

      SHA1

      464139f11db3fd6ae77502b183c4b59f581d6c7a

      SHA256

      e1891a155be133e6dd82cab3f9437bb7f047f0f80689ca724ca4d1d90d1fef14

      SHA512

      08b8e19528ff007b904f55872935e0de9e06e7cbcb3f3ed751264e3e20a740b477b55c818bf2b0ed213c4ed9cbaba0c8953c19f427be3e8ab8f50c9c86a74bf4

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_en.dll
      Filesize

      27KB

      MD5

      894b6ea4b49fa390bd70167a75f3ff7b

      SHA1

      4f834ef6567d02f28390d63c8ca9fd3c735b2140

      SHA256

      a8dc2b1e32d8d3d2c321c469eed3329f7661f4fc71d14696f97106b5aa6c532a

      SHA512

      9b4fcbd07dc7f65c34575aaabb7a517198739f7268133f084b101edf99f0b96387f3f0248de1be5252b2466db0bc59036d40e3990d4264bfab89aa01aace7ea6

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_es-419.dll
      Filesize

      29KB

      MD5

      bcafbabbfc8f810220b2ebdbb8a76d19

      SHA1

      58703c8355f996f2ce8ae5fd1ce4dc29318fd414

      SHA256

      7fef9c85b5d7dadf344ff39d82794ed252066cceb2b6531be2a45ee3d84844b7

      SHA512

      b02820c3088ceae9ebf19ede77e3a406483a3dc13c030860d3818e6e8a163e9f54293fd058ec9575c196d12f1465211ab7feff145faf684be6a8cc251d1c0d71

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_es.dll
      Filesize

      29KB

      MD5

      3ccb8eab53a0b4c93507bf2adff6ced5

      SHA1

      25fa2435e97bd0e1cf986a882ce33e68f961c139

      SHA256

      8bcbd325374a8cc5c1c7ea774382515316473c200baec86a65ae21073fae33b0

      SHA512

      4f443ded84d74e150a0be3c32edc734ca01298817933a7b1f0e5c5cd93f26987f051c4c306848301e688b9334d134a12bcdcc0ceabe1fcaaca5c4d307c697bfd

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_et.dll
      Filesize

      28KB

      MD5

      6b03eb5b302e72727977f2431ea7f30d

      SHA1

      ac5cab93d3c28e46f92d2719638c739c680cc452

      SHA256

      b5b51fe000e0e0ce42e8dbaf4b8343a5411e2e99440726c747196a02ed736137

      SHA512

      362e94f79b7726b277cc90c5158d3cc5a0a890bf32e11707f9901233414b3ff22816df78276afa67f0122fc7d6fc2d09dbb1fd8602e3a01f807f93b9423bb463

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_eu.dll
      Filesize

      29KB

      MD5

      ed883bbd9e4b3de4db68e356707f3e67

      SHA1

      e03dde660c15a614442552f8c4d2cc5dd8425fc1

      SHA256

      168eb27052a559561af3ed650bc170eb471e53f05b9065f0e229672d040ae1c7

      SHA512

      ae48fe344b2644380e56a95d98aeb0ffeff7ddf0c914f5d14ef518a4d40bb090fee9a7fd30f7178524bcdec1a2d8fc870b4b40d5d8437e3f2577320262236126

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_fa.dll
      Filesize

      28KB

      MD5

      ba417f44f7564f1aca70cca9166f3f44

      SHA1

      d8f064e25038e0076bffcd1a694b58063b7268d7

      SHA256

      56632098f623cbb58fadddc5c7a889fbc91954f661078501e62517709b8ba703

      SHA512

      c35ba956e92a2298268bb6ee7a753d6b7f94bdec96118c834f028a0fa45f18b67302b0e20a26d948d1720b04461d3074ae30003bb9028790d9d2d63cb80f4467

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_fi.dll
      Filesize

      28KB

      MD5

      7f47c9b9bc9488754579935209291c55

      SHA1

      470e590c6f5263a44b95abbd6d0c158fae326d21

      SHA256

      f0d8c44d909aed479b3e770b556eb3792c0d3ce247defff953a4dd9f7ce4cc75

      SHA512

      6f81ddd06f6a1c796bbf21143737bfeed8f9ca0ace82a4de00ccf79d7288586376439e0564f1cb128e5e585eaba122d406af8c3a6e3969efdadfe0cf65c3ed4b

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_fil.dll
      Filesize

      29KB

      MD5

      20134024ed75deda002dc0839b352f84

      SHA1

      e67bbd13a320d2b4413b283e165385c44a65ea0d

      SHA256

      425e0834cb73365cf78a233a5b139e1897961e5225e9cc92ab365b3efbe30d76

      SHA512

      7dbab9a85d852546ab8c30b3452ab8b200874eb3aac0c862bdaf5c90cc882cec11de536851693f8f115706448e3323c66affbdd7e65257395baf24a0208dc537

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_fr-CA.dll
      Filesize

      30KB

      MD5

      08b6c8f26644370c6dcbee63e4abf884

      SHA1

      e4981733831c4d31715cad1749545d21dc29acf2

      SHA256

      916b52a362fddae79461d1d07ff01fd3bb4f7b8916b263d62572a8ad420946d8

      SHA512

      31f074e494a372a1b961fa9c053b561bae9e52182866a538a734b7589cad550a42b1d88649262a7d265226288084e5ba65e9e1d6d32ffd9292258a9f65e236a5

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_fr.dll
      Filesize

      30KB

      MD5

      cf3ff14718b5e6125b956d6d9e897196

      SHA1

      041de2587e03f6c52dba60e9d2459ce33b263eb9

      SHA256

      d75ece04e40e34beaaf50cce0fef63e52918b5939c9c267fbfd1e6cdcb2a82fa

      SHA512

      551ed975b1afdc75f464bb742c30f239f9d18aa99bf9140ec0620c938629868b38a952041288244b6e2387748c16546a8fe55a664a9903577b8e484856583ac4

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_ga.dll
      Filesize

      29KB

      MD5

      3ca8dfe9af49bdde95188002ebd5f227

      SHA1

      d18d7af889c4d03ea417c09bc56069f3f697c547

      SHA256

      6577e1a60f0fa340dcb70dcf625c877fc9502d122744782708ede0c53ceb56a5

      SHA512

      a61ba9baa6d0116b769c4add55aefc99a360bf85be7986ab099a424ff7a39ccee18d946128e74e39283629b52aa14821f36fe338c0e17de29694fff5138590be

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_gd.dll
      Filesize

      30KB

      MD5

      d64f47e1971f1e9faba211ca984e550c

      SHA1

      6f4de57c6f174dd778788b138a9b25cf4725258b

      SHA256

      75fd1c674a460dcdafbbc1429a4c30c9ac28e58527c6f0797c3706012ec19e00

      SHA512

      722c9f1e5d27d6ac678ca13aa648aa22aaf1121b835fad5209ce3e482471724cf4920390f51c8df2d31c66898def51ad76b0c119f4de831011b56afead2fef7e

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_gl.dll
      Filesize

      29KB

      MD5

      31276d0895baff6976c94c549efbb47d

      SHA1

      4f0fe790cecc28823e6359fb3b78dde13cc17681

      SHA256

      d3bf99db747f3e6a2d541ecab380244c0a33ceef8655383d54e2daff37dc9a88

      SHA512

      413958104046b85772d4a32550ae3a7a3a50eb66dc35966554123bd9dd15fc7a76fa7511f6d2ac666d8a205a9b58042f68e2322189c2b34d372db6b180b70da8

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_gu.dll
      Filesize

      29KB

      MD5

      bb4a1f9374f1c3e0cbc4788a3ce1d4c5

      SHA1

      30667d6dbaa689db9a08b42acacdf68435dac46e

      SHA256

      bdbd0882aba924075c40de48fcbbe951ea6a937c0b85541fd6f1fa5701b8e655

      SHA512

      d0a5260ae123d4698e2f62fdcf97a73aa038b69b200508948185bb5de5f5edb50d6859c9e6e21e84145ceebc144882d0ed5723ce1486e805c26737358ae77504

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_hi.dll
      Filesize

      29KB

      MD5

      274c267b7ee544d36698b2db119a6929

      SHA1

      27377267ddc09060254033c4aa9916a60a254956

      SHA256

      ac843711f010925cfdd60c396baafc3ead08584ed4b1b3df57b0c975cefd039f

      SHA512

      f9073912e9c314efe60f36dd9b2bdb4b1475aadde18e82bec971c447293a4f8dce46abe625bb9cec4dc48280fce3cf3d8175054b70b4e440e89a8c072f4a505a

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_hr.dll
      Filesize

      29KB

      MD5

      ca9abf92edc001d3c0cea4c926bd004c

      SHA1

      740513a325a5c15376f4b1aea402e9c54155ab33

      SHA256

      d6d9e064773b121fbf224252ef6c7d64f239d6b5013c119738a8240cc047e346

      SHA512

      7171143ee05b0e03bc936fbd98d3a37c3763bc244ffd8ae85e3229b85e13ec6262c3111b93b3a067f3d82f5fa6b6f691438c0e148efd14606cdf5a850e474a7c

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_hu.dll
      Filesize

      29KB

      MD5

      df2764d7bf9bbc6d4e96301c928566b5

      SHA1

      1f9adfed63fff6cd144515e8a7fbf8c4131d2f65

      SHA256

      3dcf3b4acc066674418e30239406abf59b85f9a00ba2a0aa7ca33036caee6514

      SHA512

      8c1eec6d813fe2266f0e03ce72f504f355f720e0112527fd411abd5e7fea05dd4bfa3ee9a878c882c16e8cd30224727eabc5ab38bd85cf146b21547ade988391

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_id.dll
      Filesize

      28KB

      MD5

      c80c6530280315158443cd04f89e9169

      SHA1

      fb87a9ff3696f0acceee6c8f1e4fb40795a8ae7d

      SHA256

      52957587efb4d995597541656f38e0edcd4545acfd92e3b81cc72578839021de

      SHA512

      bee22709e362ade03cf385c9b09d321923cc17a9e7c227fef7717da7405ea7bcc63e6f18b5e3e18e9dc19d5b0d9d4cb32c8548d9f16803959eb13b1189df9815

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_is.dll
      Filesize

      28KB

      MD5

      28064f47523b575c20fc85733cddf487

      SHA1

      0c5583888be256c8e09a396e333ad158b5f87553

      SHA256

      0752855a2e2a69e0f969af6c31102db513dbc390583f07d5df60746721ada58a

      SHA512

      d96656335024e0228a18148de4d27f354fdc90b62f977042ac20199714ef50bad271a83547d6c6823ec03422a9b598828fdc3b0f1ae81c760a57a2d1f2a543b7

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_it.dll
      Filesize

      30KB

      MD5

      0da1fde56fc0bf63e17a891e99f559f1

      SHA1

      131d18d7329be3ff21c78a3921b88e910a3d5a68

      SHA256

      ba936fcce39c889a3cb41569f18019d99429a13e7dbd909d9d26e540ea650dec

      SHA512

      67aa088ea8c01b11874537ae59c150645b61072e4f2134719e833ca0c4c3cab835cb9c51bff97582280870227d99cfb72f3a0d2069f2a9a86a7f7dbaf29ad2d2

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_iw.dll
      Filesize

      25KB

      MD5

      d92167a825c73bd6246483bfa1787c8c

      SHA1

      0a96d89226f1e694275922e5e2640bca3d7e7020

      SHA256

      d477fce0f7fbbe9cf86dbfb724e28c617c8c7c5bea664974593fbf0c032e8019

      SHA512

      12401ac374d3050f9540a3df6fae71ff8466ed3df2bf007b52eaddfea0d549601b5756477c141fd596bd19367ad30a607160957a8ad1818ff34e6da4125e530e

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_ja.dll
      Filesize

      24KB

      MD5

      0ff69dde83bf61a768bc63870d687747

      SHA1

      622714cb8eac68b79021800f28f5874aa23176b5

      SHA256

      3a3a4d24498f0f533a5f5e4f1364e7e2a1f348dac95f649951131185c64d7bc7

      SHA512

      e1300b6f2dd5df3385c06fb43de5aa246f3f1da942e26b86023663e07b12104f0e74b2749d4ef2dd60cabfc8eadfe5f131a8bb5ba8fffd6374f9cd4635b4bc53

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_ka.dll
      Filesize

      29KB

      MD5

      67eb1378381ad4d1a450bd26fe51f5e3

      SHA1

      ae0655d07a4d0b049ed258de646199f9004963ce

      SHA256

      b2ecba67a708b9fc75fc4574b72218f64517dea1aeb5ac26400ac554903cccf9

      SHA512

      1da5356bee3e18f9033b81927368eefb8f7a0742f7f02be9ddf0f3f309d9d4f1ceeb640acac341e504d54c0d0939f1da2bac27645adf404ed2ac48a2846a919d

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_kk.dll
      Filesize

      28KB

      MD5

      d9b956ec540d8b1e528d88d8c5e5fdaa

      SHA1

      bb967aeba493d9ac0b3889f7bbf9136614080331

      SHA256

      cf008a24b53f2d62516a2944b77fd9be17a4778c0ba1b83a09ef7e83c3cf3901

      SHA512

      d6d6171c95c07ddef12bc40a5fda756ed3870a06ff2434bdd7abe02407720bff01fab5eb1bafeb7d4b9b661fc364c39de4a9eab01ef39c6bdce6de58ce4c1a06

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_km.dll
      Filesize

      27KB

      MD5

      5ef433fe15a877e530ba0a044486f200

      SHA1

      db1deb37392e001353f5a098d8686a17fc156b40

      SHA256

      896549adb3d1a38d95e743490cf6f551cac876fa1afc4b07f8eb30ad4d853502

      SHA512

      97839850a49a09cbc416ba1e8e9570adfcacbfccb70903cf597ad8781c7c3d11fd07e2598dccb7e88da7617e44ca99c62dfb3404c0c2a467641d1a6dcd7e8e64

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_kn.dll
      Filesize

      29KB

      MD5

      1ee9fe48904cb43a9147bf16823b16f1

      SHA1

      19fd9c0a2a1d919340eefca7956bd84df467b737

      SHA256

      a65da5bd18d6ac28c45cd11f56f8b868af98e42a69def6199d61235f6fa3d71d

      SHA512

      b556dff94243eeeb8dfe2c185c67ba7359877b8c0161f8fbe9a37a7e7591b0c8242a0be09255b616ac4f5560a728f1780cf6971c826ee6214a1b28c16551bffc

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_ko.dll
      Filesize

      23KB

      MD5

      6c3abddca78cb3ba9f724bad9fed6165

      SHA1

      3114daf9295215bbeed0f4bb4e282b46ec1c74ae

      SHA256

      d47e586aacfa638aab5d681d8b4ce0b42f9d698e213817554b9d42441191d548

      SHA512

      b37b7c8d7d24ead85389ce445536ef4a68c43e2a55508801ab00e9bee2c2ef428d07eb30b62228d647508dc4f6b0d78b1b8edc25052eff0ec5a9ec87fdbcba1d

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_kok.dll
      Filesize

      28KB

      MD5

      f97d285a3ba35b1395d9868e15bce4f1

      SHA1

      154dfcb8646bdb02b618dddf8a0dc1cbdab2269a

      SHA256

      33506ad10fafd8a767afcdd93cab2d91999b4e6468771379d944ff4758c2f5e4

      SHA512

      bae3152e85cc5e8f96299e7d45be8a85e47ea1119fd4d8d2bcb038ce293dab6820e35bcfffc03c9596b95e716e40711c47682f0c71e308755dc71b4c20c57628

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_lb.dll
      Filesize

      30KB

      MD5

      9c7c3dec8769f8b33aab63a15f642d81

      SHA1

      41ab17373c388d005b6d39c3ffc9fd5aac1a75cb

      SHA256

      c088700c358cfad6bd692233e450b8f4836a30a457c7b047e67681c10aecf2f7

      SHA512

      86923405fdcb2ebbf9a2dff24847d55bf1cf39550f475b1268e7edf279269e317c09b638b06e29f4d30ba59fd606f4ab5787f7d09da5ae3c5572ad41f3b3fac8

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_lo.dll
      Filesize

      27KB

      MD5

      b0973b4e4407ea116a723bd7c39c1d45

      SHA1

      011e9126cf2fd3db3f0f810dc1d8e60891ef0695

      SHA256

      36e1ea95cd9663137ae49504980e00fbb311023c8f5f6f40f3cfe14a14ff183a

      SHA512

      574eb8426f774a7ccf860b4f0e324a2cc32581c9aecb834aa25c5f62946d15ef781a9f32feea8cd44e352d4878f3f6b8f097635bddb9df3bf2a443fecd0946e5

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_lt.dll
      Filesize

      28KB

      MD5

      883f3e1c963322852aa6ce7177ba11fd

      SHA1

      3da37835cb54a847e3fa2edec45c4589e2c31561

      SHA256

      c3e3bd953b1035bcb34db9077c41643a503aafeecf99afbc92c9e4326bc6fea5

      SHA512

      52e7eae669ce211be72ed62cddd43f926c8d581a28a5efc167d1bb9c7f132f40a000cec02c91cd81604ca9f1cbb61952a9da8d09044703a49309a4faf2ff2f25

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_lv.dll
      Filesize

      29KB

      MD5

      0edaf7aa97694524c60369256b17c9f8

      SHA1

      48a81d2c180b9dbb970dfc381b204c3e0bf11532

      SHA256

      74b7ff57e79ee2685709678d55a4b4b414f3fdf77ab1783c0ded0196a126c0fe

      SHA512

      de1ec10ba23b7f76dae78b6a98a3eee6df1eea424aa9a4800b70ee7b185e5c6a0dd30d0dc950bf7b37a9c07fd7614652258cdccd64413c49647b42351e02e90e

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_mi.dll
      Filesize

      28KB

      MD5

      6e072740c5627ebe87c145120bae017a

      SHA1

      471d9a05568b542484f8cc06ccdaa307d3a9aa34

      SHA256

      eb8d66977d14c532d42a8e6a25bb9fedd749b3fd4470301fb2ac750b3b030b2d

      SHA512

      3daeb9857230571fb7a7069c4b3e1f7c15bf3a3214f974de0be74eda8ae0ca33a72d53ad2fb34d35c7f39e12e0cd91f183a7638cadf66fadf8c869741a2f31bc

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_mk.dll
      Filesize

      29KB

      MD5

      fc7f6cab60b5f7162f0caaf42bc33a6a

      SHA1

      c120491f69b87858ac055de4ba79cb5450073697

      SHA256

      6925acdaea43d471b1e9c481dbdb7e5922df03bb451f8190d781520c585747bc

      SHA512

      c08ff3683fc6b909de93377688ff4b226e75c2eba1ccc10c94f2258aeed30f2ecb57889c9fd50e7a88c300a0b8ead56dddbe484cc7fab80e1bfbd70516b35dab

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_ml.dll
      Filesize

      31KB

      MD5

      cc9eb10aa9d38ea5d2d62a3fc9a21cde

      SHA1

      3522a988506ad5b5cc609ea02a18b5f75a06debb

      SHA256

      9f8112edd3397d50b8b835cba4bb2eafc4e5511cc91bd74d9ff585debc8879f8

      SHA512

      66bb6a341cb95f07ae875586d631fa09c68a920e54242fa5e36996f0c6fb2870e89fe1c959b785bf783884c967dfdd46b0e709a564b6bc911cdb73a66d193f63

      Download Submit

    • C:\Program Files (x86)\Microsoft\Temp\EU947F.tmp\msedgeupdateres_mr.dll
      Filesize

      28KB

      MD5

      98557801fbb00d5db905372d82d24a56

      SHA1

      afb1d071a351f405846e7e3a8e7d2aff4330231b

      SHA256

      4ad659437305bd4fbbad9fc5a91ba8f70065bd79dd2d74aed154a343ea2d5033

      SHA512

      6d23fb21071f1ad9c86bfeceece4638b3014e8c0c2200697782524ff9e8170a7c1654edf1447d416536283ae3aa3dcaf3ff7a2fe89d51fca0ef89ccad352e7f3

      Download Submit

    • C:\Program Files\MsEdgeCrashpad\settings.dat
      Filesize

      280B

      MD5

      81b3950b5686b7195908d616f37c7291

      SHA1

      ed9a72180ef5868c40b28c4b324a819b35e434f8

      SHA256

      5e84452576b48020f1c17de2cde5606510af3396ed61da8e9b426c053a3ac481

      SHA512

      372faa80f9414bb8c965cd3e3cb92e4245a8e04d6386a4077cd20f772873db235c3766f4bc202650ccb2b82e9dd637e51da77d2301864ed4d746c6fa2ee18f8b

      Download Submit

    • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
      Filesize

      97KB

      MD5

      45614c7cd77ada870b107b0466a0304c

      SHA1

      c6ba1f08d2db03cb0149081677fc14e5d5024224

      SHA256

      b64a3b42d8ab83e11d9bbc7a03d973d919dcdc449f5c70fe513161fc8373a140

      SHA512

      7881b12fece0434dade16f705fd253358d72ab886bee9266b563d8c72359459ff6b03549fa300d13ca20c9f9812a7182f83cd53fec4506cbea650a0809ed1395

      Download Submit

    • C:\Users\Admin\AppData\Local\Assist\current\Assist.exe
      Filesize

      19.1MB

      MD5

      2946ba3343adbcf9b419c9745b8d2b24

      SHA1

      2d3c9874c4efd9d2d95d9d63f198a882b67c5fa6

      SHA256

      cdb3c8d5bb9aa19f4517be827d456730beaa10022adb437ddce0b186d6e3c7f9

      SHA512

      4b4295f94d8695cb6316ae0ac1ae38ea5412613fe012ac3e3a0b661becb5fdebda2e569c7d153d60aa9cee6c06224a52c751d98f5f1b2288e339eac13f3a6242

      Download Submit

    • C:\Users\Admin\AppData\Local\Assist\packages\Assist-1.0.25-live-full.nupkg
      Filesize

      18.2MB

      MD5

      938dedf608d8d8c23995162770139bd2

      SHA1

      c24ea66be6cdec8c97c1990c0a02bbc9333dd683

      SHA256

      94b1432b1c99e85cda3843bbc65f22616eda7dc9bd6b3345ab84a9bbcb03c107

      SHA512

      37d3c95d87ba87fa5e2d7e98f265225c355533b709de86c4b26e95ca1a0dfada3f0b68e01d77cc44593d76bb551cf4db95788c0db663959e793e3c5865559e47

      Download Submit

    • C:\Users\Admin\AppData\Local\Assist\packages\VelopackTemp\temp.1\lib\app\WebView2Loader.dll
      Filesize

      138KB

      MD5

      ac45268e4df2cdfdc7584f52b68ec03b

      SHA1

      80824ca7f07e264cf52b34753e4a86a11e41d227

      SHA256

      46b03e278e55315f68a275c5def11a331ea04e1f8c57cf4a32550d904e98f991

      SHA512

      660f099316db714fa4234c409fc6f97af0e8263ac11176c959f999174d1e758521d1ba3dd0c08e8849b0566183eb573fbcbadea65fd4ddb3bee7859dc293dced

      Download Submit

    • C:\Users\Admin\AppData\Local\Assist\packages\VelopackTemp\temp.1\lib\app\sq.version
      Filesize

      436B

      MD5

      69b794332778de24627fa31f11edaecd

      SHA1

      fcbb47312e08cfff1c05b8a78f988143d38cda1e

      SHA256

      8f8d8a00a9ebd9212ff2fc8c023b0cdad834fbb8f557297bf93de8d96480fdbd

      SHA512

      17d61fc7e77fea4151b57bb7cf915e52b6a70020a957504fbdebc3d6ae850a097e9a4513a8f2e33d1e3fbecf84f0e5181762a22b175beaeb8fedc6a01d6c7307

      Download Submit

    • C:\Users\Admin\AppData\Local\Assist\packages\tmp_Nl61DOwX3cgHYBWT\av_libglesv2.dll
      Filesize

      4.2MB

      MD5

      73d2fb4c35d323813a86e3bf5c85c345

      SHA1

      81f751a34e0c25bdea93902a19a94a49ce1495df

      SHA256

      85b3aee47c0e0eaf3a5ea5c75ba8131387a12639b6a0ef280c28531fb77695ae

      SHA512

      e81677cc9b99ff3d54f67000a60489603e01a896f90c4ef0c883b82e2fdb7b90d2899c078958b3f060a20373b99cb6c4deb7f64cc4c7e0ba2a708209f4684ca4

      Download Submit

    • C:\Users\Admin\AppData\Local\Assist\packages\tmp_Nl61DOwX3cgHYBWT\libHarfBuzzSharp.dll
      Filesize

      1.5MB

      MD5

      f121a2afb03f1b8ca1784e544464a346

      SHA1

      9346297a66989dbe88bc459ee8bf936e7acb3d24

      SHA256

      f13d0dae00a598620a436fd991219a2e0fe6157eac90faa025d4d76845cd996c

      SHA512

      ebbb8c2d7d97521286af0f6b02195890b193e660a28e6b1e5112ed9f1fcc081c66587a7a82c8a9468d1a55d477880487d1b3edf1deb2ea285e17d70fbd56c6f1

      Download Submit

    • C:\Users\Admin\AppData\Local\Assist\packages\tmp_Nl61DOwX3cgHYBWT\libSkiaSharp.dll
      Filesize

      9.0MB

      MD5

      6b5e769126b4d38601df662bd08e7163

      SHA1

      c799c7c3b8209468bb4047b4783f691537d717e9

      SHA256

      3268b1b2de384d00ed77431fe8a1f053d2c69eee25d07dcfc352491570d63b52

      SHA512

      168c4a5981aa6513bacaa459bac26a3033315a677547eaa01d901b75e46baef91c6fd63185629a3a218a643fcacfa86ae36b8a5313e11f3bcd311bf4b0c61c6f

      Download Submit

    • C:\Users\Admin\AppData\Local\Assist\packages\tmp_Nl61DOwX3cgHYBWT\runtimes\win-arm64\native\WebView2Loader.dll
      Filesize

      125KB

      MD5

      7b533d202f6c4a111fe293d4a5879319

      SHA1

      16f691b35c878b5c3f66442e1aaa33abda5783a0

      SHA256

      dc51d7c297b2f18589a8fe9ef280ef3fcfb6dd5f7a6d54a3c25f26557cdbfd3a

      SHA512

      6c6c6e3973e0e1c0a39513fcc9e26dcf06878edd4b32c420d3f9315da643a8bda9058bdce3841b82ff6a6012f706013d7c9d9bcff0f4c6179a0d0c1cd4d7af6c

      Download Submit

    • C:\Users\Admin\AppData\Local\Assist\packages\tmp_Nl61DOwX3cgHYBWT\runtimes\win-x86\native\WebView2Loader.dll
      Filesize

      108KB

      MD5

      1b688e0370f75f0633f23530e5cba99f

      SHA1

      3b0006940fa38965a3c6c7474a0e574d3647de2b

      SHA256

      13d7bd3e67626c27e3ab427521b18da68b2b3746bf3f691f70c4c1b3b99556f1

      SHA512

      2effa83eb3bf0dd3c32f99e322e36652a185ada315983f5adde088606f46ee39991dacd41a2a1a098b0bfac33e860955b76967d7f73c85003a4e7d5f586942f9

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.~tmp
      Filesize

      104KB

      MD5

      effecce1b6868c8bd7950ef7b772038b

      SHA1

      695d5a07f59b4b72c5eca7be77d5b15ae7ae59b0

      SHA256

      003e619884dbc527e20f0aa8487daf5d7eed91d53ef6366a58c5493aaf1ce046

      SHA512

      2f129689181ffe6fff751a22d4130bb643c5868fa0e1a852c434fe6f7514e3f1e5e4048179679dec742ec505139439d98e6dcc74793c18008db36c800d728be2

      Download Submit

    • C:\Users\Admin\AppData\Roaming\AssistData\Deps\curl\curl-ca-bundle.crt
      Filesize

      221KB

      MD5

      1e305b4e910d204ab7b4c18ec0cf0f27

      SHA1

      3c4a17b6c725462993e42152c5ba97645168243a

      SHA256

      ccbdfc2fe1a0d7bbbb9cc15710271acf1bb1afe4c8f1725fe95c4c7733fcbe5a

      SHA512

      dcbfe08d39efdd8de555b31e1050757900d08448c61f8a67c055f14514e5d47e734f6874b5ae628021c35ebc8dabdfdac5808df0b3a073d4f9246cca4b725fe8

      Download Submit

    • C:\Users\Admin\AppData\Roaming\AssistData\Deps\curl\temp\curl-8.5.0_3-win64-mingw\bin\curl.exe
      Filesize

      3.2MB

      MD5

      7eb8fe702805bd0f3c83b1faabc23a40

      SHA1

      6f6d9db7e3458f0bfd1e9683f81421e09f7504f6

      SHA256

      b95714aaf20ebc7fd1aa5112b369e9a7628575e0ecb84dbf29eeb1885dad0086

      SHA512

      462604ac9d4bb1cc1c53370bde34cbf8cc4dbb2cc9a3f0f6f2ce502022e098d81dd010d97b281f12299524361a5b1eb860a0fa6c4fc1552bc1aae3e22b1c306f

      Download Submit

    • C:\Users\Admin\AppData\Roaming\AssistData\Deps\curl\temp\curl-8.5.0_3-win64-mingw\bin\libcurl-x64.def
      Filesize

      2KB

      MD5

      c9c9c68a7a8254ee7907fb765ef3be40

      SHA1

      2f20b64e1f96135d314a259d6d302c470c28c552

      SHA256

      db95b78d9512ba036e42b296a5f9ea6882b054ad37a050db8eecd527608d223b

      SHA512

      b324bb5b058315d5636119e10050e2aac0e49bd3b5050faca86d9b2b9dfe9be0f4556bba413be142b17dea1cf9052c47a9e1f2d9f4748d178c36aa65302da615

      Download Submit

    • C:\Users\Admin\AppData\Roaming\AssistData\Deps\curl\temp\curl-8.5.0_3-win64-mingw\bin\libcurl-x64.dll
      Filesize

      3.0MB

      MD5

      9dbc7262054953fa46ee9cd0e853e553

      SHA1

      8f093981c6d1275596db6efd9e538bd1e0e5d5f8

      SHA256

      b1041ccf067a7fbf0afba803fdb72e0ef18905a59970d5d6275819291b0dd805

      SHA512

      809bb54f31580c92f6294a37feb67c9543c25d03d66ed1fffc34e172e8eca71f1ffd1365c8c833c6d3a183d4995d19772cddd02857dc9ed302a79b941964bd1e

      Download Submit

    • C:\Users\Admin\Downloads\inst-webview2-evergreen.exe
      Filesize

      1.6MB

      MD5

      431a51d6443439e7c3063c36e18e87d6

      SHA1

      5d704eb554c78f13b7a07c90e14d65f74b590e3a

      SHA256

      726732c59f91424e8fb9280c1e773e1db72c8607ad110113bc62c67c452154a6

      SHA512

      495d60ad05d1fadb2abd827d778fe94132e5bfc2ae5355e03f2551cd7a879acf50cc0526990e4ccde93bf4eff65f07953035b93cc435f743001f21b017cbfdfd

      Download Submit

    • memory/3736-253-0x0000000000180000-0x00000000001B5000-memory.dmp

      Filesize

      212KB

      Download

    • memory/3736-195-0x0000000073BA0000-0x0000000073DC6000-memory.dmp

      Filesize

      2.1MB

      Download

    • memory/3736-194-0x0000000000180000-0x00000000001B5000-memory.dmp

      Filesize

      212KB

      Download

    • memory/3736-222-0x0000000073BA0000-0x0000000073DC6000-memory.dmp

      Filesize

      2.1MB

      Download

    • memory/4876-1439-0x000001EB11050000-0x000001EB1105E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/4876-1440-0x000001EB2B560000-0x000001EB2B56A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4876-1441-0x000001EB2B590000-0x000001EB2B598000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4876-1442-0x000001EB2B800000-0x000001EB2BA49000-memory.dmp

      Filesize

      2.3MB

      Download