76c83d1bebd6b01bab76d9a94f223e1a3cf20f2040b8d58a12625074e2936f7c

Resubmissions

10-11-2024 11:50

241110-nzxzjayrep 8

10-11-2024 11:47

241110-nyb1nswdlq 8

10-11-2024 11:42

241110-nvex6ayqfj 8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2024 11:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Krnl_8.10.8_x64_en-US.msi
Size

5.0MB
MD5

b837d10b9a71425dbf3d62b2cc59f447
SHA1

85c9ba3331f7eb432c28365b0d1f36a201373a72
SHA256

76c83d1bebd6b01bab76d9a94f223e1a3cf20f2040b8d58a12625074e2936f7c
SHA512

f20999d19c470941c85912725d6f89c5073d475572ece92ce5b8e5425cdf012950f230c353870d86469ab6658bdc504abbb41260cb676f109551860433bcb405
SSDEEP

98304:XPky+agPtUpupDeOds+883iSh79bubjnvmu5/qv4eYb2Tqg9EeYImwqPY6Bvv8m:XPky9GtAcdsENbubzSJb9lyw

Score

8^/10

discovery evasion execution persistence phishing privilege_escalation trojan

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
38	1888	powershell.exe
40	1888	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1888	powershell.exe
1888	powershell.exe

A potential corporate email address has been identified in the URL: httpswww.youtube.com@Omnidevcbrd1
phishing
A potential corporate email address has been identified in the URL: httpswww.youtube.com@WeAreDevsExploitscbrd1
phishing
Downloads MZ/PE file

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\JJSploit\resources\luascripts\animations\energizegui.lua	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_es-419.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_kok.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\notification_helper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Locales\qu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\Locales\gu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\Locales\km.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_ko.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Locales\ur.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\VisualElements\LogoCanary.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\AdSelectionAttestationsPreloaded\manifest.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\identity_proxy\win11\identity_helper.Sparse.Stable.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Locales\et.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\Edge.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\WidevineCdm\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\Locales\bg.pak	setup.exe
File created	C:\Program Files\JJSploit\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_bn.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_pa.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\EBWebView\x64\EmbeddedBrowserWebView.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Locales\es-419.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Locales\gl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Locales\mi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Locales\ne.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\mip_protection_sdk.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Trust Protection Lists\Sigma\Staging	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\identity_proxy\win11\identity_helper.Sparse.Stable.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\BHO\ie_to_edge_bho_64.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\msedge_100_percent.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\identity_proxy\win10\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_pt-PT.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\mspdf.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Locales\zh-TW.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\Locales\ko.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\Locales\sq.pak	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Locales\kn.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\msedge.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Locales\sr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\VisualElements\SmallLogoCanary.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\Locales\ja.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\Locales\ro.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_nn.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\identity_proxy\beta.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Locales\uk.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\msedge.dll.sig	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Trust Protection Lists\Mu\Content	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Trust Protection Lists\Sigma\Advertising	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Trust Protection Lists\Sigma\Other	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\identity_helper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\EBWebView\x64\EmbeddedBrowserWebView.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\Locales\es-419.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_ga.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Edge.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\pwahelper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\edge_game_assist\VERSION	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_lt.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Locales\ro.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\vk_swiftshader_icd.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\webview2_integration.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\VisualElements\SmallLogo.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_et.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_ta.dll	MicrosoftEdgeWebview2Setup.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{3D33D542-D2B2-4F33-A39D-CD4F70D3442E}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e58418a.msi	msiexec.exe
File created	C:\Windows\Installer\e584188.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e584188.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{3D33D542-D2B2-4F33-A39D-CD4F70D3442E}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3D33D542-D2B2-4F33-A39D-CD4F70D3442E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI42A2.tmp	msiexec.exe

Executes dropped EXE 22 IoCs

pid	Process
2152	MicrosoftEdgeWebview2Setup.exe
3736	MicrosoftEdgeUpdate.exe
4240	MicrosoftEdgeUpdate.exe
680	MicrosoftEdgeUpdate.exe
2028	MicrosoftEdgeUpdateComRegisterShell64.exe
1288	MicrosoftEdgeUpdateComRegisterShell64.exe
4172	MicrosoftEdgeUpdateComRegisterShell64.exe
876	MicrosoftEdgeUpdate.exe
536	MicrosoftEdgeUpdate.exe
316	MicrosoftEdgeUpdate.exe
4420	MicrosoftEdgeUpdate.exe
4756	MicrosoftEdge_X64_130.0.2849.56.exe
4456	setup.exe
3488	setup.exe
1608	MicrosoftEdgeUpdate.exe
752	JJSploit.exe
980	msedgewebview2.exe
4332	msedgewebview2.exe
4572	msedgewebview2.exe
1760	msedgewebview2.exe
3856	msedgewebview2.exe
3116	msedgewebview2.exe

Loads dropped DLL 38 IoCs

pid	Process
2116	MsiExec.exe
3736	MicrosoftEdgeUpdate.exe
4240	MicrosoftEdgeUpdate.exe
680	MicrosoftEdgeUpdate.exe
2028	MicrosoftEdgeUpdateComRegisterShell64.exe
680	MicrosoftEdgeUpdate.exe
1288	MicrosoftEdgeUpdateComRegisterShell64.exe
680	MicrosoftEdgeUpdate.exe
4172	MicrosoftEdgeUpdateComRegisterShell64.exe
680	MicrosoftEdgeUpdate.exe
876	MicrosoftEdgeUpdate.exe
536	MicrosoftEdgeUpdate.exe
316	MicrosoftEdgeUpdate.exe
316	MicrosoftEdgeUpdate.exe
536	MicrosoftEdgeUpdate.exe
4420	MicrosoftEdgeUpdate.exe
1608	MicrosoftEdgeUpdate.exe
2116	MsiExec.exe
752	JJSploit.exe
980	msedgewebview2.exe
4332	msedgewebview2.exe
980	msedgewebview2.exe
980	msedgewebview2.exe
980	msedgewebview2.exe
4572	msedgewebview2.exe
4572	msedgewebview2.exe
1760	msedgewebview2.exe
1760	msedgewebview2.exe
3856	msedgewebview2.exe
3856	msedgewebview2.exe
4572	msedgewebview2.exe
4572	msedgewebview2.exe
4572	msedgewebview2.exe
4572	msedgewebview2.exe
3116	msedgewebview2.exe
3116	msedgewebview2.exe
3116	msedgewebview2.exe
980	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	JJSploit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4468	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
876	MicrosoftEdgeUpdate.exe
4420	MicrosoftEdgeUpdate.exe
1608	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000041ba55ff39bb976e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000041ba55ff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090041ba55ff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d41ba55ff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000041ba55ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133757130091979611"	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.31\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\CurVer\ = "MicrosoftEdgeUpdate.Update3COMClassService.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35725228-BF11-429E-B5B8-ED0F2BCABF82}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\245D33D32B2D33F43AD9DCF4073D44E2\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35725228-BF11-429E-B5B8-ED0F2BCABF82}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.31\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35725228-BF11-429E-B5B8-ED0F2BCABF82}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.31\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.31\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2776	msiexec.exe
2776	msiexec.exe
1888	powershell.exe
1888	powershell.exe
1888	powershell.exe
3736	MicrosoftEdgeUpdate.exe
3736	MicrosoftEdgeUpdate.exe
3736	MicrosoftEdgeUpdate.exe
3736	MicrosoftEdgeUpdate.exe
3736	MicrosoftEdgeUpdate.exe
3736	MicrosoftEdgeUpdate.exe
3652	msedge.exe
3652	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
5296	msedge.exe
5296	msedge.exe
5268	identity_helper.exe
5268	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
980	msedgewebview2.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4468	msiexec.exe
Token: SeSecurityPrivilege	2776	msiexec.exe
Token: SeCreateTokenPrivilege	4468	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4468	msiexec.exe
Token: SeLockMemoryPrivilege	4468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4468	msiexec.exe
Token: SeMachineAccountPrivilege	4468	msiexec.exe
Token: SeTcbPrivilege	4468	msiexec.exe
Token: SeSecurityPrivilege	4468	msiexec.exe
Token: SeTakeOwnershipPrivilege	4468	msiexec.exe
Token: SeLoadDriverPrivilege	4468	msiexec.exe
Token: SeSystemProfilePrivilege	4468	msiexec.exe
Token: SeSystemtimePrivilege	4468	msiexec.exe
Token: SeProfSingleProcessPrivilege	4468	msiexec.exe
Token: SeIncBasePriorityPrivilege	4468	msiexec.exe
Token: SeCreatePagefilePrivilege	4468	msiexec.exe
Token: SeCreatePermanentPrivilege	4468	msiexec.exe
Token: SeBackupPrivilege	4468	msiexec.exe
Token: SeRestorePrivilege	4468	msiexec.exe
Token: SeShutdownPrivilege	4468	msiexec.exe
Token: SeDebugPrivilege	4468	msiexec.exe
Token: SeAuditPrivilege	4468	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4468	msiexec.exe
Token: SeChangeNotifyPrivilege	4468	msiexec.exe
Token: SeRemoteShutdownPrivilege	4468	msiexec.exe
Token: SeUndockPrivilege	4468	msiexec.exe
Token: SeSyncAgentPrivilege	4468	msiexec.exe
Token: SeEnableDelegationPrivilege	4468	msiexec.exe
Token: SeManageVolumePrivilege	4468	msiexec.exe
Token: SeImpersonatePrivilege	4468	msiexec.exe
Token: SeCreateGlobalPrivilege	4468	msiexec.exe
Token: SeCreateTokenPrivilege	4468	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4468	msiexec.exe
Token: SeLockMemoryPrivilege	4468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4468	msiexec.exe
Token: SeMachineAccountPrivilege	4468	msiexec.exe
Token: SeTcbPrivilege	4468	msiexec.exe
Token: SeSecurityPrivilege	4468	msiexec.exe
Token: SeTakeOwnershipPrivilege	4468	msiexec.exe
Token: SeLoadDriverPrivilege	4468	msiexec.exe
Token: SeSystemProfilePrivilege	4468	msiexec.exe
Token: SeSystemtimePrivilege	4468	msiexec.exe
Token: SeProfSingleProcessPrivilege	4468	msiexec.exe
Token: SeIncBasePriorityPrivilege	4468	msiexec.exe
Token: SeCreatePagefilePrivilege	4468	msiexec.exe
Token: SeCreatePermanentPrivilege	4468	msiexec.exe
Token: SeBackupPrivilege	4468	msiexec.exe
Token: SeRestorePrivilege	4468	msiexec.exe
Token: SeShutdownPrivilege	4468	msiexec.exe
Token: SeDebugPrivilege	4468	msiexec.exe
Token: SeAuditPrivilege	4468	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4468	msiexec.exe
Token: SeChangeNotifyPrivilege	4468	msiexec.exe
Token: SeRemoteShutdownPrivilege	4468	msiexec.exe
Token: SeUndockPrivilege	4468	msiexec.exe
Token: SeSyncAgentPrivilege	4468	msiexec.exe
Token: SeEnableDelegationPrivilege	4468	msiexec.exe
Token: SeManageVolumePrivilege	4468	msiexec.exe
Token: SeImpersonatePrivilege	4468	msiexec.exe
Token: SeCreateGlobalPrivilege	4468	msiexec.exe
Token: SeCreateTokenPrivilege	4468	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4468	msiexec.exe
Token: SeLockMemoryPrivilege	4468	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4468	msiexec.exe
752	JJSploit.exe
4468	msiexec.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2116	2776	msiexec.exe	96
PID 2776 wrote to memory of 2116	2776	msiexec.exe	96
PID 2776 wrote to memory of 2116	2776	msiexec.exe	96
PID 2776 wrote to memory of 5012	2776	msiexec.exe	101
PID 2776 wrote to memory of 5012	2776	msiexec.exe	101
PID 2776 wrote to memory of 1888	2776	msiexec.exe	103
PID 2776 wrote to memory of 1888	2776	msiexec.exe	103
PID 1888 wrote to memory of 2152	1888	powershell.exe	106
PID 1888 wrote to memory of 2152	1888	powershell.exe	106
PID 1888 wrote to memory of 2152	1888	powershell.exe	106
PID 2152 wrote to memory of 3736	2152	MicrosoftEdgeWebview2Setup.exe	107
PID 2152 wrote to memory of 3736	2152	MicrosoftEdgeWebview2Setup.exe	107
PID 2152 wrote to memory of 3736	2152	MicrosoftEdgeWebview2Setup.exe	107
PID 3736 wrote to memory of 4240	3736	MicrosoftEdgeUpdate.exe	108
PID 3736 wrote to memory of 4240	3736	MicrosoftEdgeUpdate.exe	108
PID 3736 wrote to memory of 4240	3736	MicrosoftEdgeUpdate.exe	108
PID 3736 wrote to memory of 680	3736	MicrosoftEdgeUpdate.exe	109
PID 3736 wrote to memory of 680	3736	MicrosoftEdgeUpdate.exe	109
PID 3736 wrote to memory of 680	3736	MicrosoftEdgeUpdate.exe	109
PID 680 wrote to memory of 2028	680	MicrosoftEdgeUpdate.exe	110
PID 680 wrote to memory of 2028	680	MicrosoftEdgeUpdate.exe	110
PID 680 wrote to memory of 1288	680	MicrosoftEdgeUpdate.exe	112
PID 680 wrote to memory of 1288	680	MicrosoftEdgeUpdate.exe	112
PID 680 wrote to memory of 4172	680	MicrosoftEdgeUpdate.exe	113
PID 680 wrote to memory of 4172	680	MicrosoftEdgeUpdate.exe	113
PID 3736 wrote to memory of 876	3736	MicrosoftEdgeUpdate.exe	114
PID 3736 wrote to memory of 876	3736	MicrosoftEdgeUpdate.exe	114
PID 3736 wrote to memory of 876	3736	MicrosoftEdgeUpdate.exe	114
PID 3736 wrote to memory of 536	3736	MicrosoftEdgeUpdate.exe	115
PID 3736 wrote to memory of 536	3736	MicrosoftEdgeUpdate.exe	115
PID 3736 wrote to memory of 536	3736	MicrosoftEdgeUpdate.exe	115
PID 316 wrote to memory of 4420	316	MicrosoftEdgeUpdate.exe	117
PID 316 wrote to memory of 4420	316	MicrosoftEdgeUpdate.exe	117
PID 316 wrote to memory of 4420	316	MicrosoftEdgeUpdate.exe	117
PID 316 wrote to memory of 4756	316	MicrosoftEdgeUpdate.exe	119
PID 316 wrote to memory of 4756	316	MicrosoftEdgeUpdate.exe	119
PID 4756 wrote to memory of 4456	4756	MicrosoftEdge_X64_130.0.2849.56.exe	120
PID 4756 wrote to memory of 4456	4756	MicrosoftEdge_X64_130.0.2849.56.exe	120
PID 4456 wrote to memory of 3488	4456	setup.exe	121
PID 4456 wrote to memory of 3488	4456	setup.exe	121
PID 316 wrote to memory of 1608	316	MicrosoftEdgeUpdate.exe	122
PID 316 wrote to memory of 1608	316	MicrosoftEdgeUpdate.exe	122
PID 316 wrote to memory of 1608	316	MicrosoftEdgeUpdate.exe	122
PID 2116 wrote to memory of 752	2116	MsiExec.exe	124
PID 2116 wrote to memory of 752	2116	MsiExec.exe	124
PID 752 wrote to memory of 1456	752	JJSploit.exe	125
PID 752 wrote to memory of 1456	752	JJSploit.exe	125
PID 752 wrote to memory of 2064	752	JJSploit.exe	126
PID 752 wrote to memory of 2064	752	JJSploit.exe	126
PID 752 wrote to memory of 980	752	JJSploit.exe	127
PID 752 wrote to memory of 980	752	JJSploit.exe	127
PID 980 wrote to memory of 4332	980	msedgewebview2.exe	128
PID 980 wrote to memory of 4332	980	msedgewebview2.exe	128
PID 1456 wrote to memory of 3772	1456	cmd.exe	129
PID 1456 wrote to memory of 3772	1456	cmd.exe	129
PID 2064 wrote to memory of 1036	2064	cmd.exe	130
PID 2064 wrote to memory of 1036	2064	cmd.exe	130
PID 3772 wrote to memory of 1216	3772	msedge.exe	131
PID 3772 wrote to memory of 1216	3772	msedge.exe	131
PID 1036 wrote to memory of 4988	1036	msedge.exe	132
PID 1036 wrote to memory of 4988	1036	msedge.exe	132
PID 980 wrote to memory of 4572	980	msedgewebview2.exe	133
PID 980 wrote to memory of 4572	980	msedgewebview2.exe	133
PID 980 wrote to memory of 4572	980	msedgewebview2.exe	133

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Krnl_8.10.8_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4468

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DB22C109C999EB86D5B4042F1AB173BF C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Program Files\JJSploit\JJSploit.exe
    "C:\Program Files\JJSploit\JJSploit.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\system32\cmd.exe
      "cmd" /C start https://www.youtube.com/@Omnidev_
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@Omnidev_
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3772
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff99edd46f8,0x7ff99edd4708,0x7ff99edd4718
        6⤵
        
        PID:1216
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,12852694520489297871,8517788568732106365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5296
  - - C:\Windows\system32\cmd.exe
      "cmd" /C start https://www.youtube.com/@WeAreDevsExploits
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@WeAreDevsExploits
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1036
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99edd46f8,0x7ff99edd4708,0x7ff99edd4718
        6⤵
        
        PID:4988
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2020962838381783751,13825050123693314938,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
        6⤵
        
        PID:3340
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,2020962838381783751,13825050123693314938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3652
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,2020962838381783751,13825050123693314938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8
        6⤵
        
        PID:1824
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2020962838381783751,13825050123693314938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
        6⤵
        
        PID:2700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2020962838381783751,13825050123693314938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
        6⤵
        
        PID:2764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2020962838381783751,13825050123693314938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
        6⤵
        
        PID:5396
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2020962838381783751,13825050123693314938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
        6⤵
        
        PID:5644
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2020962838381783751,13825050123693314938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
        6⤵
        
        PID:5728
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2020962838381783751,13825050123693314938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
        6⤵
        
        PID:6028
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2020962838381783751,13825050123693314938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
        6⤵
        
        PID:5976
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,2020962838381783751,13825050123693314938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:8
        6⤵
        
        PID:676
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,2020962838381783751,13825050123693314938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5268
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2020962838381783751,13825050123693314938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
        6⤵
        
        PID:4876
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2020962838381783751,13825050123693314938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
        6⤵
        
        PID:5368
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.8 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=752.3852.13678820700377444710
      4⤵
      Checks computer location settings
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:980
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=130.0.2849.56 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff9848b4dc0,0x7ff9848b4dcc,0x7ff9848b4dd8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4332
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\msedgewebview2.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1768,i,11914530930179288612,9206862416664093651,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4572
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2004,i,11914530930179288612,9206862416664093651,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1760
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2296,i,11914530930179288612,9206862416664093651,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3856
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.56\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3360,i,11914530930179288612,9206862416664093651,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3116
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3736
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4240
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:680
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2028
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1288
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4172
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjI1Rjg2OTYtNURDRC00MERBLUIxMDMtQTgwMjRGQ0M2MjU5fSIgdXNlcmlkPSJ7Qjc1RDEzRDAtQTE2QS00RDkwLTk3QjctMzRFNkUzQ0ZDODZFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4NEZGNUE5My1EM0Y3LTRDQzktOEI4Qi1DMjUyRUJBMDFGMTd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjMxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzI3Njg4NzE3IiBpbnN0YWxsX3RpbWVfbXM9IjcwMyIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:876
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{625F8696-5DCD-40DA-B103-A8024FCC6259}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:536

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:936

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:316
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjI1Rjg2OTYtNURDRC00MERBLUIxMDMtQTgwMjRGQ0M2MjU5fSIgdXNlcmlkPSJ7Qjc1RDEzRDAtQTE2QS00RDkwLTk3QjctMzRFNkUzQ0ZDODZFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Rjc3MTk0NTAtRUMxNy00QkQxLUFBMDEtNDBDOTJEMjg4Q0JDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMzQiIGluc3RhbGxkYXRldGltZT0iMTcyODI5Mjg0OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzcyNzY1NDUzNTMyMDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzMzIzNzY1MDAiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4420
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5AB2ADC5-F9F6-42C6-8824-14F3869C2AEF}\MicrosoftEdge_X64_130.0.2849.56.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5AB2ADC5-F9F6-42C6-8824-14F3869C2AEF}\MicrosoftEdge_X64_130.0.2849.56.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5AB2ADC5-F9F6-42C6-8824-14F3869C2AEF}\EDGEMITMP_AD090.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5AB2ADC5-F9F6-42C6-8824-14F3869C2AEF}\EDGEMITMP_AD090.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5AB2ADC5-F9F6-42C6-8824-14F3869C2AEF}\MicrosoftEdge_X64_130.0.2849.56.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5AB2ADC5-F9F6-42C6-8824-14F3869C2AEF}\EDGEMITMP_AD090.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5AB2ADC5-F9F6-42C6-8824-14F3869C2AEF}\EDGEMITMP_AD090.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5AB2ADC5-F9F6-42C6-8824-14F3869C2AEF}\EDGEMITMP_AD090.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.56 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff7e792d730,0x7ff7e792d73c,0x7ff7e792d748
      4⤵
      Executes dropped EXE
      PID:3488
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjI1Rjg2OTYtNURDRC00MERBLUIxMDMtQTgwMjRGQ0M2MjU5fSIgdXNlcmlkPSJ7Qjc1RDEzRDAtQTE2QS00RDkwLTk3QjctMzRFNkUzQ0ZDODZFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3NjFGNzNDMi1CRjNELTRGMTUtQTNFNC0zQUQ1QTU4MUEzN0J9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMwLjAuMjg0OS41NiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTM4NTgxMzgzNyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzODU4MTM4MzciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzI5ODc2Mzc2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8zNDZhZDlkMS03NDZlLTQ1YzctOGZlMC1kNmM4N2E3M2EyNjE_UDE9MTczMTg0NDEzOCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1nN1MzY2Y4eXpYN3BIaHRZTVZvZ1dtWiUyZloyd1lzQTJaNDMxaWU5T0thVlhROWhKUmVudm5MSEczSWh3R1dsTmpOY2VMQlJMR2hqckxobjVvUlNRNVNnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc0OTMzNjAwIiB0b3RhbD0iMTc0OTMzNjAwIiBkb3dubG9hZF90aW1lX21zPSIyNzczNSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3MzAwMzI1MTYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzQzOTM4ODg3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MDM2NzUxNDI1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTQzNyIgZG93bmxvYWRfdGltZV9tcz0iMzQ0MjEiIGRvd25sb2FkZWQ9IjE3NDkzMzYwMCIgdG90YWw9IjE3NDkzMzYwMCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMjkyNjUiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e584189.rbs

Filesize
21KB

MD5
4eeef352d7d63da956cd7464ed124b34

SHA1
8cd5a70785b928cf9ed92a68640c7c4e811321b0

SHA256
eab8c2e74ad47d7ecb1a1701ab6571fb3cd7e1290be01ed9049393bce6019d2d

SHA512
26f711bd22f423cc77b4be2f69833873e39b739f5aa3678c27c60c2a7bd2ee73bb9fdefba4fbbe234adcc4652e6a8cbea33854e8a126164122c5fc213fc2ad94

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.56\Installer\setup.exe

Filesize
6.5MB

MD5
9a98f71bb7812ab88c517ba0d278d4c9

SHA1
459b635444042ad0eeb453cdba5078c52ddba161

SHA256
273f8406a9622ddd0e92762837af4598770b5efe6aa8a999da809e77b7b7882f

SHA512
5685717b2192b477b5c5708687462aa2d23999f565a43b7d67388f48eb9a3d33d9a3da54474ce632a0aee1bc4de8a6172a818239033d4a035f045e15947868f3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
182KB

MD5
1723c5e707061e59d769c492a95d5083

SHA1
3b535b7a0df2f7a4ab5e531956dad9892adfb5e9

SHA256
e97ab6dc0ed865aa8606f5c113fd62170341d1a3d63d5618f233aea969ec49ab

SHA512
a4e3bd9ec331a27338c123a9a3ae23619fc5a5b80fc9aea38d23d3b82ca015f47669e0f3e1a6f98e7f464e6bc21e92723a04f72805e45e0dfc81540a2d299a8a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
35a79bd6de650d2c0988674344bf698b

SHA1
a0635c38472f8cc0641ceb39c148383619d221dd

SHA256
a79a81da2b8dcbe39609a9e1b4e8c81ae0bc54195c0c854b77bebe7bfa7f10c1

SHA512
afe33d38785afe489845654ba1c3ed6648b36b1ebe5f98b3d5d4bf24eba3af9bb6676af5a79d2ec570bf2b4b6ae40d14fc3d4b872c5d4577aea40f6d1a26c0cf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
215KB

MD5
c55b37823a672c86bc19099633640eab

SHA1
da5e15d773c794f8b21195e7ad012e0ed1bceb72

SHA256
3df9cd2fecf10e65be13d4b61ca0a9185845f2cb04b872adeaf41ca46af39aa0

SHA512
1252c3fde4aa4ce239103e8df7224afce093a2cbe539bd40347601980a314ea3326ea6ce4c1ebc845c125845969ad65ebca319b9df35a809ef871bad14aaf33d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
262KB

MD5
dd30f3ff486b830211df62d20348f86f

SHA1
08c7d7407dee7ed20b50e8f1a2cb1b08a9282dbf

SHA256
9d57bdc8b97e75f8a04b93a1657dfd18d4e2f68607783c9bca42140233978fa7

SHA512
af3b48ced7018c7edeabdfa998e51356d57c2d7a846c76629fed0ff2e5db8db79041184c58a5a67a10ec627f53af8e3c80bbffacaecf5dae6d989cecb82e72e4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
39ac5a029f87748e964491b97936d890

SHA1
24777aad794a13d0e7381fc6f32f0e1bcdb1ba80

SHA256
ba861524fe648ccb47b7ac57421bb07a6231a7aab5eaea332548511cce6185bc

SHA512
2ecb9b208846f84cd37f37d2100f26358d6c37128efc4010b2e7efc10202dc37b621d0c0138a8b76b23d968da324c685a41b44f4ae30cbbe243581f1904e14c6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_af.dll

Filesize
29KB

MD5
2a9524cf8afae49394379d9d9be69206

SHA1
e43d4146f8abebbb30831fbd39a39846bfb7eeef

SHA256
e5a08731963e681b6386c4e85c16bc98452ebc13c4a7de3ff6979125c609d5f0

SHA512
a0111589960cbdcb10b55c17aa82555e44f0f0f173ebad09de6364881138cb35280596f1de6d86b31044427445575630c22079c3585e34729ce461599b8979b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
1903bc250fc269e79c9f7aada2979aff

SHA1
efbf76b1259217c02c138078c56f36b2cb8543ab

SHA256
228fa3e2fcacc78111a8152d6862de2302c024e81cc8b5e3f16e31caf96cfd04

SHA512
9db527c2e26ef691c089f5d1d010298e0f47e2e0420fba03ed18c7c2793b92c5860240b214b5233dddbc150413a2649e9cf4823239b9831930c2804b143ab538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
b4c28669b9d4e56b094af6062f4db065

SHA1
4c492c03138c8a796cf0673866892b9e0c2073ec

SHA256
7fe494dd265f99f330b153ef69c51c0541016755ca1876788f7f0ede78f9cedb

SHA512
35941ab6f2dcf5f60824d172f75f9f7b8b93e65c7bd8bc441fc32e49cbb414a68d65a02e3479b096f728b2a34d3e85dfd868e8bf95ff9b1a57d10adc3da0022a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_as.dll

Filesize
29KB

MD5
16b0c8a664626da016a95fb46fdc9c0e

SHA1
c674b635cd8927511825847f3d86a5562b4155d7

SHA256
b059fc9713d3a41e9a83f0d61f8cce29546d3759def0a7b8e162a13915e51255

SHA512
ec39269fbd9e510d10d665c86b8a8161208b74f919e4fd128e365144d71f2b59d3c48c50b8f017b1d30c711ee4f63668f843539957b4643d2a488c9e17290e75

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
bf510bb9b7639af7da969f77620b480f

SHA1
17a6693a5d6aea1f3fa6f34abc46daf558cac645

SHA256
2507da222cf6c6dd608da9b569f89f8e11c47b6e16134c767cdc23b7c1f56bd3

SHA512
6cebe80005cb7759ee4fd8dd9ca41bdd073c01e969e1ebe03cb07616921e50516974019faacc2f9dcaaccdc0044eaae57a6a94f3a4a4ce044a781cd8091478a7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
4b23c7229eb43740744cfbf48c4242ca

SHA1
4938dcf6239e14db53c8f085d3c477905a9986af

SHA256
a7527b867ebc222114b679b2ac542cdc46a75f8bc24e5ca8b7ebc17b7a2963c2

SHA512
4bd8ed0ecacd3f2c69dcd0789ab8ee10dcfd6144b019dd8858c2234bebddfe42c83037fb8e2f934f3320f58796683bed5ab050ba897ba1fa409b6df60f02ec53

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
1e038b27661b303e15a39a55305e86bb

SHA1
35b48fe72d50406063f9145fea64c57f205f0084

SHA256
385665137d0dfee16ed8ef2da5ce28d826d210eb2bde1fa4ef13dac50e4b5364

SHA512
13fcfde6923b38acc2cfa530087d13725a2cabdd2e771d503f4d2f5cff93e8744f142e235dd484244d920d80cb3e7cecbbd731b473f6e509edb39159c51e9465

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
9afe531b6472cf9eb66028e9638584bb

SHA1
6212292867bd59fe376e79988c07f4db8ad26cdc

SHA256
383754fc147dc6ef5f1edd14b60bab6bebf32639dfea718aaa64b2b65ac98812

SHA512
352bec509ccd3ad15a274ddd3ccea43b76eaed885b0e7722235abd95aab8fec1c645722765d76865c1b32ed422a10e6666f220e3abcc5a24268ba94c5cc6b8d8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_bs.dll

Filesize
29KB

MD5
5e06d311c2e24b94f378c4d3b3deb260

SHA1
ef7df63f63746eb197c21694ebb21cfb86c0b2b8

SHA256
d2052450e3a3272b302d80af9f2c46b766153267100bc902dcf03a78ec609b65

SHA512
8d73b5265735aa19116cf41bb8d2bdacde5b22b286a56af58068f9579b631b044c155e625f6e1fda12e505f621f245faebe126c2557dd2ec873d7d980f8ba552

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
30KB

MD5
afdafc9f56401b662f42cef830d92b38

SHA1
b56966370ec07cd676e35d93fad001e0f6b3fb8a

SHA256
03d7a1c0d8810df4b908fcc40c8491df0e3ce19db8ee22e6be79d02fd9df8f72

SHA512
884f9cd99785ea91c5c8e26200bbf0b010ff278b52c5ac590cb73712321a9cdb645e5448bf4cf62622cdb06543b8de4a8e6956a2f6b6677c0b9befb35589d8b0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
15ee7526536790bf77317975896542f9

SHA1
365bc54203b490daa0e24a1c9813d5d99c9de720

SHA256
5e2349af6e02da1c5d18f1b3235fc5099229d2d99e1c5cf2713c21472c151f8e

SHA512
475fd9c0879c8cbc418a66441e3dc026fca983327a95763eddd1537c1f44fdf272d212c69e1b06aad55d91c68379a2beafb2908659d58a61c740731a7d047406

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
8eff4531519a4b768005b9411d4a5f9c

SHA1
59b354e3f32f0a0da8755c27b903803994f4aa31

SHA256
2e9a230a8b8a7fa437a28e2115ebf01178f3209fc0d61eb90160f49c11a16cb0

SHA512
4426ae1e2937e1f6c7364d2f437aeb83d834f9997d28cb1ffb07fe1c448dd954083aa822ff439c886249a387823a23245640a0425dd8c42b75b73912733f11ee

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
11b92ae8fe94c784480d465a37935766

SHA1
f4ead29d4b20c57bb0e4d16a7488784f61a25972

SHA256
571b0cf8b0383e33393b8b8fa79d1632688ffc2bdde794fff62c85f5e1a3f161

SHA512
b636dec2e1d48916d0c83d2fe45eb24d826c027455cf22ec78e013166e59fbdb4780ebe69de3ab4b5730dae03652d253890917f53fc835aa73f9f75b01dc4f23

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_da.dll

Filesize
29KB

MD5
19a7aee0daf68fdc1a24e3228a8bf439

SHA1
1fc6ce227a11245787c80f3932e2c311de2d44bb

SHA256
409cce12be8b7a86313bd1d9e3c6d9154cf0c5735db61d94852a128a746dab99

SHA512
0051119311316d29dbc13ace84c24283aa2eaf1d46459c81ba7b31cc6178b43165618fd7bec17de698b1431ef2b33be179c2c8b1537c1000aadf849e2c888c84

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_de.dll

Filesize
31KB

MD5
ce66ef1a806c21949b75055f81cac760

SHA1
3719e4af114a3c0baceb133d152a02bc6a1fb9f8

SHA256
23f5414d554b96db0b93c7dbe27939d294b8061e56c19ab74d59fe9135e81c8f

SHA512
04d9575c866ac28db490a291be3da41f884d3ceadbc9b7077776ea7deb1819277aadcf9c9e1b5afede3e90bafbcb00e6ef0840166228d153be7e8d8d53975593

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_el.dll

Filesize
31KB

MD5
09cf47260852ff7b2c91c65d127b9314

SHA1
b3d362f3d08f81bd1b719a1c94b54f5f9c9610da

SHA256
eb4344676280f83e6023ddc604ffa42e96eb46e765a216fbc5ecbe49ddb3c920

SHA512
114a21296d8e7e054906139102617e6cd6008337a0877053721553cfed10183f54f890c8071b1cea17bd0b2535589af7aafe5bd1d161886ad7363f89919d7300

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
39dc20ae50a0e2ba9c55dda91256b3cc

SHA1
464139f11db3fd6ae77502b183c4b59f581d6c7a

SHA256
e1891a155be133e6dd82cab3f9437bb7f047f0f80689ca724ca4d1d90d1fef14

SHA512
08b8e19528ff007b904f55872935e0de9e06e7cbcb3f3ed751264e3e20a740b477b55c818bf2b0ed213c4ed9cbaba0c8953c19f427be3e8ab8f50c9c86a74bf4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
894b6ea4b49fa390bd70167a75f3ff7b

SHA1
4f834ef6567d02f28390d63c8ca9fd3c735b2140

SHA256
a8dc2b1e32d8d3d2c321c469eed3329f7661f4fc71d14696f97106b5aa6c532a

SHA512
9b4fcbd07dc7f65c34575aaabb7a517198739f7268133f084b101edf99f0b96387f3f0248de1be5252b2466db0bc59036d40e3990d4264bfab89aa01aace7ea6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
bcafbabbfc8f810220b2ebdbb8a76d19

SHA1
58703c8355f996f2ce8ae5fd1ce4dc29318fd414

SHA256
7fef9c85b5d7dadf344ff39d82794ed252066cceb2b6531be2a45ee3d84844b7

SHA512
b02820c3088ceae9ebf19ede77e3a406483a3dc13c030860d3818e6e8a163e9f54293fd058ec9575c196d12f1465211ab7feff145faf684be6a8cc251d1c0d71

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_es.dll

Filesize
29KB

MD5
3ccb8eab53a0b4c93507bf2adff6ced5

SHA1
25fa2435e97bd0e1cf986a882ce33e68f961c139

SHA256
8bcbd325374a8cc5c1c7ea774382515316473c200baec86a65ae21073fae33b0

SHA512
4f443ded84d74e150a0be3c32edc734ca01298817933a7b1f0e5c5cd93f26987f051c4c306848301e688b9334d134a12bcdcc0ceabe1fcaaca5c4d307c697bfd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
6b03eb5b302e72727977f2431ea7f30d

SHA1
ac5cab93d3c28e46f92d2719638c739c680cc452

SHA256
b5b51fe000e0e0ce42e8dbaf4b8343a5411e2e99440726c747196a02ed736137

SHA512
362e94f79b7726b277cc90c5158d3cc5a0a890bf32e11707f9901233414b3ff22816df78276afa67f0122fc7d6fc2d09dbb1fd8602e3a01f807f93b9423bb463

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_eu.dll

Filesize
29KB

MD5
ed883bbd9e4b3de4db68e356707f3e67

SHA1
e03dde660c15a614442552f8c4d2cc5dd8425fc1

SHA256
168eb27052a559561af3ed650bc170eb471e53f05b9065f0e229672d040ae1c7

SHA512
ae48fe344b2644380e56a95d98aeb0ffeff7ddf0c914f5d14ef518a4d40bb090fee9a7fd30f7178524bcdec1a2d8fc870b4b40d5d8437e3f2577320262236126

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_fa.dll

Filesize
28KB

MD5
ba417f44f7564f1aca70cca9166f3f44

SHA1
d8f064e25038e0076bffcd1a694b58063b7268d7

SHA256
56632098f623cbb58fadddc5c7a889fbc91954f661078501e62517709b8ba703

SHA512
c35ba956e92a2298268bb6ee7a753d6b7f94bdec96118c834f028a0fa45f18b67302b0e20a26d948d1720b04461d3074ae30003bb9028790d9d2d63cb80f4467

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
7f47c9b9bc9488754579935209291c55

SHA1
470e590c6f5263a44b95abbd6d0c158fae326d21

SHA256
f0d8c44d909aed479b3e770b556eb3792c0d3ce247defff953a4dd9f7ce4cc75

SHA512
6f81ddd06f6a1c796bbf21143737bfeed8f9ca0ace82a4de00ccf79d7288586376439e0564f1cb128e5e585eaba122d406af8c3a6e3969efdadfe0cf65c3ed4b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
20134024ed75deda002dc0839b352f84

SHA1
e67bbd13a320d2b4413b283e165385c44a65ea0d

SHA256
425e0834cb73365cf78a233a5b139e1897961e5225e9cc92ab365b3efbe30d76

SHA512
7dbab9a85d852546ab8c30b3452ab8b200874eb3aac0c862bdaf5c90cc882cec11de536851693f8f115706448e3323c66affbdd7e65257395baf24a0208dc537

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
08b6c8f26644370c6dcbee63e4abf884

SHA1
e4981733831c4d31715cad1749545d21dc29acf2

SHA256
916b52a362fddae79461d1d07ff01fd3bb4f7b8916b263d62572a8ad420946d8

SHA512
31f074e494a372a1b961fa9c053b561bae9e52182866a538a734b7589cad550a42b1d88649262a7d265226288084e5ba65e9e1d6d32ffd9292258a9f65e236a5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
cf3ff14718b5e6125b956d6d9e897196

SHA1
041de2587e03f6c52dba60e9d2459ce33b263eb9

SHA256
d75ece04e40e34beaaf50cce0fef63e52918b5939c9c267fbfd1e6cdcb2a82fa

SHA512
551ed975b1afdc75f464bb742c30f239f9d18aa99bf9140ec0620c938629868b38a952041288244b6e2387748c16546a8fe55a664a9903577b8e484856583ac4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_ga.dll

Filesize
29KB

MD5
3ca8dfe9af49bdde95188002ebd5f227

SHA1
d18d7af889c4d03ea417c09bc56069f3f697c547

SHA256
6577e1a60f0fa340dcb70dcf625c877fc9502d122744782708ede0c53ceb56a5

SHA512
a61ba9baa6d0116b769c4add55aefc99a360bf85be7986ab099a424ff7a39ccee18d946128e74e39283629b52aa14821f36fe338c0e17de29694fff5138590be

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
d64f47e1971f1e9faba211ca984e550c

SHA1
6f4de57c6f174dd778788b138a9b25cf4725258b

SHA256
75fd1c674a460dcdafbbc1429a4c30c9ac28e58527c6f0797c3706012ec19e00

SHA512
722c9f1e5d27d6ac678ca13aa648aa22aaf1121b835fad5209ce3e482471724cf4920390f51c8df2d31c66898def51ad76b0c119f4de831011b56afead2fef7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_gl.dll

Filesize
29KB

MD5
31276d0895baff6976c94c549efbb47d

SHA1
4f0fe790cecc28823e6359fb3b78dde13cc17681

SHA256
d3bf99db747f3e6a2d541ecab380244c0a33ceef8655383d54e2daff37dc9a88

SHA512
413958104046b85772d4a32550ae3a7a3a50eb66dc35966554123bd9dd15fc7a76fa7511f6d2ac666d8a205a9b58042f68e2322189c2b34d372db6b180b70da8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_gu.dll

Filesize
29KB

MD5
bb4a1f9374f1c3e0cbc4788a3ce1d4c5

SHA1
30667d6dbaa689db9a08b42acacdf68435dac46e

SHA256
bdbd0882aba924075c40de48fcbbe951ea6a937c0b85541fd6f1fa5701b8e655

SHA512
d0a5260ae123d4698e2f62fdcf97a73aa038b69b200508948185bb5de5f5edb50d6859c9e6e21e84145ceebc144882d0ed5723ce1486e805c26737358ae77504

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_hi.dll

Filesize
29KB

MD5
274c267b7ee544d36698b2db119a6929

SHA1
27377267ddc09060254033c4aa9916a60a254956

SHA256
ac843711f010925cfdd60c396baafc3ead08584ed4b1b3df57b0c975cefd039f

SHA512
f9073912e9c314efe60f36dd9b2bdb4b1475aadde18e82bec971c447293a4f8dce46abe625bb9cec4dc48280fce3cf3d8175054b70b4e440e89a8c072f4a505a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
ca9abf92edc001d3c0cea4c926bd004c

SHA1
740513a325a5c15376f4b1aea402e9c54155ab33

SHA256
d6d9e064773b121fbf224252ef6c7d64f239d6b5013c119738a8240cc047e346

SHA512
7171143ee05b0e03bc936fbd98d3a37c3763bc244ffd8ae85e3229b85e13ec6262c3111b93b3a067f3d82f5fa6b6f691438c0e148efd14606cdf5a850e474a7c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
df2764d7bf9bbc6d4e96301c928566b5

SHA1
1f9adfed63fff6cd144515e8a7fbf8c4131d2f65

SHA256
3dcf3b4acc066674418e30239406abf59b85f9a00ba2a0aa7ca33036caee6514

SHA512
8c1eec6d813fe2266f0e03ce72f504f355f720e0112527fd411abd5e7fea05dd4bfa3ee9a878c882c16e8cd30224727eabc5ab38bd85cf146b21547ade988391

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_id.dll

Filesize
28KB

MD5
c80c6530280315158443cd04f89e9169

SHA1
fb87a9ff3696f0acceee6c8f1e4fb40795a8ae7d

SHA256
52957587efb4d995597541656f38e0edcd4545acfd92e3b81cc72578839021de

SHA512
bee22709e362ade03cf385c9b09d321923cc17a9e7c227fef7717da7405ea7bcc63e6f18b5e3e18e9dc19d5b0d9d4cb32c8548d9f16803959eb13b1189df9815

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
28064f47523b575c20fc85733cddf487

SHA1
0c5583888be256c8e09a396e333ad158b5f87553

SHA256
0752855a2e2a69e0f969af6c31102db513dbc390583f07d5df60746721ada58a

SHA512
d96656335024e0228a18148de4d27f354fdc90b62f977042ac20199714ef50bad271a83547d6c6823ec03422a9b598828fdc3b0f1ae81c760a57a2d1f2a543b7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
0da1fde56fc0bf63e17a891e99f559f1

SHA1
131d18d7329be3ff21c78a3921b88e910a3d5a68

SHA256
ba936fcce39c889a3cb41569f18019d99429a13e7dbd909d9d26e540ea650dec

SHA512
67aa088ea8c01b11874537ae59c150645b61072e4f2134719e833ca0c4c3cab835cb9c51bff97582280870227d99cfb72f3a0d2069f2a9a86a7f7dbaf29ad2d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
d92167a825c73bd6246483bfa1787c8c

SHA1
0a96d89226f1e694275922e5e2640bca3d7e7020

SHA256
d477fce0f7fbbe9cf86dbfb724e28c617c8c7c5bea664974593fbf0c032e8019

SHA512
12401ac374d3050f9540a3df6fae71ff8466ed3df2bf007b52eaddfea0d549601b5756477c141fd596bd19367ad30a607160957a8ad1818ff34e6da4125e530e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
0ff69dde83bf61a768bc63870d687747

SHA1
622714cb8eac68b79021800f28f5874aa23176b5

SHA256
3a3a4d24498f0f533a5f5e4f1364e7e2a1f348dac95f649951131185c64d7bc7

SHA512
e1300b6f2dd5df3385c06fb43de5aa246f3f1da942e26b86023663e07b12104f0e74b2749d4ef2dd60cabfc8eadfe5f131a8bb5ba8fffd6374f9cd4635b4bc53

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
67eb1378381ad4d1a450bd26fe51f5e3

SHA1
ae0655d07a4d0b049ed258de646199f9004963ce

SHA256
b2ecba67a708b9fc75fc4574b72218f64517dea1aeb5ac26400ac554903cccf9

SHA512
1da5356bee3e18f9033b81927368eefb8f7a0742f7f02be9ddf0f3f309d9d4f1ceeb640acac341e504d54c0d0939f1da2bac27645adf404ed2ac48a2846a919d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
d9b956ec540d8b1e528d88d8c5e5fdaa

SHA1
bb967aeba493d9ac0b3889f7bbf9136614080331

SHA256
cf008a24b53f2d62516a2944b77fd9be17a4778c0ba1b83a09ef7e83c3cf3901

SHA512
d6d6171c95c07ddef12bc40a5fda756ed3870a06ff2434bdd7abe02407720bff01fab5eb1bafeb7d4b9b661fc364c39de4a9eab01ef39c6bdce6de58ce4c1a06

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
5ef433fe15a877e530ba0a044486f200

SHA1
db1deb37392e001353f5a098d8686a17fc156b40

SHA256
896549adb3d1a38d95e743490cf6f551cac876fa1afc4b07f8eb30ad4d853502

SHA512
97839850a49a09cbc416ba1e8e9570adfcacbfccb70903cf597ad8781c7c3d11fd07e2598dccb7e88da7617e44ca99c62dfb3404c0c2a467641d1a6dcd7e8e64

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_kn.dll

Filesize
29KB

MD5
1ee9fe48904cb43a9147bf16823b16f1

SHA1
19fd9c0a2a1d919340eefca7956bd84df467b737

SHA256
a65da5bd18d6ac28c45cd11f56f8b868af98e42a69def6199d61235f6fa3d71d

SHA512
b556dff94243eeeb8dfe2c185c67ba7359877b8c0161f8fbe9a37a7e7591b0c8242a0be09255b616ac4f5560a728f1780cf6971c826ee6214a1b28c16551bffc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_ko.dll

Filesize
23KB

MD5
6c3abddca78cb3ba9f724bad9fed6165

SHA1
3114daf9295215bbeed0f4bb4e282b46ec1c74ae

SHA256
d47e586aacfa638aab5d681d8b4ce0b42f9d698e213817554b9d42441191d548

SHA512
b37b7c8d7d24ead85389ce445536ef4a68c43e2a55508801ab00e9bee2c2ef428d07eb30b62228d647508dc4f6b0d78b1b8edc25052eff0ec5a9ec87fdbcba1d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_kok.dll

Filesize
28KB

MD5
f97d285a3ba35b1395d9868e15bce4f1

SHA1
154dfcb8646bdb02b618dddf8a0dc1cbdab2269a

SHA256
33506ad10fafd8a767afcdd93cab2d91999b4e6468771379d944ff4758c2f5e4

SHA512
bae3152e85cc5e8f96299e7d45be8a85e47ea1119fd4d8d2bcb038ce293dab6820e35bcfffc03c9596b95e716e40711c47682f0c71e308755dc71b4c20c57628

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_lb.dll

Filesize
30KB

MD5
9c7c3dec8769f8b33aab63a15f642d81

SHA1
41ab17373c388d005b6d39c3ffc9fd5aac1a75cb

SHA256
c088700c358cfad6bd692233e450b8f4836a30a457c7b047e67681c10aecf2f7

SHA512
86923405fdcb2ebbf9a2dff24847d55bf1cf39550f475b1268e7edf279269e317c09b638b06e29f4d30ba59fd606f4ab5787f7d09da5ae3c5572ad41f3b3fac8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_lo.dll

Filesize
27KB

MD5
b0973b4e4407ea116a723bd7c39c1d45

SHA1
011e9126cf2fd3db3f0f810dc1d8e60891ef0695

SHA256
36e1ea95cd9663137ae49504980e00fbb311023c8f5f6f40f3cfe14a14ff183a

SHA512
574eb8426f774a7ccf860b4f0e324a2cc32581c9aecb834aa25c5f62946d15ef781a9f32feea8cd44e352d4878f3f6b8f097635bddb9df3bf2a443fecd0946e5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_lt.dll

Filesize
28KB

MD5
883f3e1c963322852aa6ce7177ba11fd

SHA1
3da37835cb54a847e3fa2edec45c4589e2c31561

SHA256
c3e3bd953b1035bcb34db9077c41643a503aafeecf99afbc92c9e4326bc6fea5

SHA512
52e7eae669ce211be72ed62cddd43f926c8d581a28a5efc167d1bb9c7f132f40a000cec02c91cd81604ca9f1cbb61952a9da8d09044703a49309a4faf2ff2f25

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU684A.tmp\msedgeupdateres_lv.dll

Filesize
29KB

MD5
0edaf7aa97694524c60369256b17c9f8

SHA1
48a81d2c180b9dbb970dfc381b204c3e0bf11532

SHA256
74b7ff57e79ee2685709678d55a4b4b414f3fdf77ab1783c0ded0196a126c0fe

SHA512
de1ec10ba23b7f76dae78b6a98a3eee6df1eea424aa9a4800b70ee7b185e5c6a0dd30d0dc950bf7b37a9c07fd7614652258cdccd64413c49647b42351e02e90e

Download Submit
C:\Program Files\JJSploit\JJSploit.exe

Filesize
9.7MB

MD5
d0d04bc3cb9e341925f36736c7730dc5

SHA1
c958e77cd69768e3753835dbfcb66a903b373c21

SHA256
bc360c4a540aad33bcd8a358566bb4e0844ca36138ef36fb5dd8084d36517495

SHA512
2f04c151d57826a89b52f82c6b8c4ae5c0a45b83556c9aa6c45aa520f312d1a0edd2bb36c90c94b5a4967ea1b498634c4673828ef4afbdb63ab0e9d76609b31a

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
3d46607ba9131ea5e38dd0c6dc899128

SHA1
96c6cb0b771db3add8d5320f8cd32038b9d59fcd

SHA256
173071bc8487e64138281df0818c4e39a2590b3fc59858ea3f06b406bff4360a

SHA512
725c6930aa85239d715626896f41e357df024f8108a68513d1d0a04e85b56d7fec65e39e2d70b162468b498ca0412914110c3c7313b180ea520feb7c1eb87147

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
94KB

MD5
82aac4de4d88edd69bc531e5b510684c

SHA1
effa0ecaef381fd4970cff70176221fd15dd1505

SHA256
f4126e38c6851a4f6c3ffce47702122fb52893bfffe707653be1dee320df8718

SHA512
d450efa080f21952c9aef861c0e1cd7eb410072001e3fe22c43dfe3cc43a16540081da4515007e83b3753bbd81b01ba06c73688506ae228f1cd26405b85dd9be

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk

Filesize
1KB

MD5
def2f180e0b2b0fce8a9e31c1beaa814

SHA1
d620a13286275a292686e0272086c3b35e1c5fcd

SHA256
26075452ac93ab322462d378d70b28165f4a7689a927f9d64ce55b0b69dc286d

SHA512
f1305bba3a7cfa57bba04970dcff09a1e661ef10471a1a07ca8afca326f84f56eb64ba468113c250f9bdb5710d5b772267880f92791b27b121b8d5e7f28bc192

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk~RFe584561.TMP

Filesize
1KB

MD5
e91eda7371d6e626d0b27f51b3c6b9ef

SHA1
eff480956c1da8d50e0c1fc67349bbe40fdab270

SHA256
12d9b6c8f1dd68a16d629cea7ba6e4c6b4e4411a8db477e754a2bd0dacfc6672

SHA512
d34ae96a7d97f4e6b931572646e848d982af578ecd221a13fe89cc4e264a76743f489d4656986eb698fd20d927624394fd28b51d8a2febf276e4e609eb35d574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
7697e6667efb0d32386939b23f1f0753

SHA1
dbdbe5d6cdd58719952c6e2f413c58764604a515

SHA256
1d0a6c0451eace10126e5b5122f0589cc512488294336c3b78f7f020b1df99cc

SHA512
ae1d2989c3a961672d37d63f173b5155065b218c5291d3ce06460f640ead0c10239adfb2ca73478ea3572f3d53a2cd59fdd1accd8339f88c505e505c6ac901f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bf352468ee203ea89d5d423efc48afb2

SHA1
5dd38d2e50413c9f8dfda80aa11298c0326592bf

SHA256
f6612dc4c0212ec81b3aedd889d3cfe8d27801f0b9f8538be4c84fbe66129f70

SHA512
6cbef9f4127609c95cb7d3e383b53ed88d1bea968e732c52cd0164e6d2f0794d2ca4b63697b929b2407981f80be154e3da27e082a6123906bf4fdd8f9fa5800b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
230f28219a806209fcac07755552acda

SHA1
73cb5359af4d4cb5eaeab0b2a0e44667010497a1

SHA256
80eb84dea33fcbc7091295d13057bc0a56b25532973b75a9a7f395de1df305bd

SHA512
03f658a955e6296372aabb831401b31e200d85f8737c62d5fe9d348e89911ab4709ec2ce6c34d48ef0fa38ece13bdbea62a1531eccdbb3986230fac5598a616d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
3b77dcbb18c6c3a0e054a07518c02d6b

SHA1
35620bd37911b263e2c5b23b393ad15125d0c53e

SHA256
3145b16be7ad6cb2b8be529da6e0ed328f6425a263885e76195e0e08cb2a8c48

SHA512
4f100a6735471b5437f6071cb7dfdcb02a9d5c49581e04b46bfaf1cb23d17e31d75fdc7b864032661b4a085f8b716964689f9b1b90c43dc2beb741d0720d2449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b6f64142c0f910ec98545334da127abd

SHA1
9c4b96a6afd093076be19ee5d68030671f274aad

SHA256
48545e91b7ce1e4322d455f33b70f9334c3d85ca0e09c8770d02126ef61d23d3

SHA512
64553d21774df78c0f6619c0ca5750af6400983a4e74e8168b736930992307527e3ad6e1f88a97463696ccbd9d309377c77c568da1727c3a488b10b75a3741e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE416.tmp

Filesize
132KB

MD5
cfbb8568bd3711a97e6124c56fcfa8d9

SHA1
d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57

SHA256
7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc

SHA512
860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

Filesize
1.6MB

MD5
431a51d6443439e7c3063c36e18e87d6

SHA1
5d704eb554c78f13b7a07c90e14d65f74b590e3a

SHA256
726732c59f91424e8fb9280c1e773e1db72c8607ad110113bc62c67c452154a6

SHA512
495d60ad05d1fadb2abd827d778fe94132e5bfc2ae5355e03f2551cd7a879acf50cc0526990e4ccde93bf4eff65f07953035b93cc435f743001f21b017cbfdfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s4okd4gx.s14.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
cc307260e63a4f45391122957635730e

SHA1
d2ffcc6cc4b9f7e0eb5cd551c7eb1003182f6f05

SHA256
476716f4877195549d18e8d886a188b94a1e53756d807e5da467c8be6d94bc20

SHA512
19aef503242742fa645c6aadfff4b3133a67ce974fe8822b9f79f1ebfc6d031b17175b85d280ab3f1e2f98a619b27b2d550b29fbfc68370b2570c5e31eda673c

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
16KB

MD5
434bf4561d01ef16e4848b76009ad9b2

SHA1
023fefeeb3f2b84373c99152e99cfbd939b6e557

SHA256
3fce4c871042362261bdccf41c7e8df3283274e719dcc099c05372fc0caa7bd9

SHA512
8c0cef4ad2a8b953add16b1a87bc320c241153f8fbff601ba2577400585f22783455e7b9ffe4cbc31d6d5f8ccae410de86bfea1c3f9e1e2e77c67b64ab14a537

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
1KB

MD5
635a71dd20b1954fdddbd7208cd98536

SHA1
3bcbcc4d1a242af7227df54df1f80f80e2dbc45d

SHA256
621e6f24ec88c360c8cfab502a1125f09221a7bb929c978d04de9b622fb814a8

SHA512
f418d59afbc33befee8c653aef05611e5efb52f5e827ef11817b62be50e6d2950802c7b842cce7570e2bb6b7c08edbbce7f97838a8607cca2713be795e210d6d

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
2KB

MD5
7397fe8075f6b65d5e8843c91e06e950

SHA1
359dcb264a1f55a5844673fb580ce2034193f8d6

SHA256
495ca9f47cf281287202907f3cb50123f7e6cd70af4e2259022e8fec876cc421

SHA512
54874d6139ee5ff4039ae09a6d6d07fdc88e08b726f53eb5f901e22d0d8b7b934f30088daa0b72fe0156518fc7e7448e278692245a4eb3d437e3641aa0c07b03

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
3KB

MD5
92d1e41a8dbe1af6993e7e2fc544ead5

SHA1
a228b3cb7e9f8dd8bef7531ee0d9c19b87c4c4fa

SHA256
33ce0b7a204686dc6fcab6f9c6d8151a2728a4d15614fa9f127ac1d0c62f5073

SHA512
2bdf572b4702c31adf8e0c6030b0abd37f8f1e4ec32fc68a2217787fa25c79a9e694ada8676c4e9931e55d9d78fbac987b7f8e310b8ccafb0384a778fd16379c

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe599551.TMP

Filesize
1KB

MD5
7cd7dd8fde32552a6511966dca3f2da4

SHA1
b585f6e0add323ac9a899f1dbfc1c170d67a1d4e

SHA256
8c9adce96c61fb293d3dc47fff8653fafc7ecc08e7ed0999eff0893bcb89d5d9

SHA512
00477e23750bc4967d145efcf50450ac8da41ce3a528d72a4450fd785fcf79bf5ae9b8081b1bce3ae528a6fcfd15ce95a9bc026aa7ea3f407a1104e478866f01

Download Submit
C:\Windows\Installer\e584188.msi

Filesize
5.0MB

MD5
b837d10b9a71425dbf3d62b2cc59f447

SHA1
85c9ba3331f7eb432c28365b0d1f36a201373a72

SHA256
76c83d1bebd6b01bab76d9a94f223e1a3cf20f2040b8d58a12625074e2936f7c

SHA512
f20999d19c470941c85912725d6f89c5073d475572ece92ce5b8e5425cdf012950f230c353870d86469ab6658bdc504abbb41260cb676f109551860433bcb405

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
928caa52092de058e5ece0a144214bc8

SHA1
b28128a4c32df2882b6fb371d863474a64d12265

SHA256
d64ff1036613b2bdee65faca7fe8fd688276a6cffbe39b0e01b173441e7ad31e

SHA512
bac9ed78e9f9e33978ddd48e8bb8f808b211b2b6e04fa02e22c793bf8af142e3e19f9fdfdd19586a7c0a327ffff5e97633289a89ebc2b841738ce8d6b2ef1cc5

Download Submit
\??\Volume{ff55ba41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0377a962-5039-47d2-8d68-5ce8352cbce5}_OnDiskSnapshotProp

Filesize
6KB

MD5
04aa4d5760e14b9adaafe10e73e53dc3

SHA1
9ab8836627cd00f1bf4a9295b5e129c440da0892

SHA256
91cc3705bf0fbd5417e15e7049f1f7b1abf32a269e0d6b83259007bb16548f1e

SHA512
ab683017e24a4840a043629ed8d3e5f843424d01c0b139fe94d968eacb3e94f85b893b760a20ca8aaaaa62f2735bc2da03aa88b23f8df5809a4464fa4f55ca53

Download Submit
memory/1888-65-0x00000197D94C0000-0x00000197D94E2000-memory.dmp

Filesize
136KB

Download
memory/3116-415-0x00007FF9A5610000-0x00007FF9A5611000-memory.dmp

Filesize
4KB

Download
memory/3736-325-0x0000000000130000-0x0000000000165000-memory.dmp

Filesize
212KB

Download
memory/3736-279-0x0000000074A10000-0x0000000074C36000-memory.dmp

Filesize
2.1MB

Download
memory/3736-266-0x0000000074A10000-0x0000000074C36000-memory.dmp

Filesize
2.1MB

Download
memory/3736-265-0x0000000000130000-0x0000000000165000-memory.dmp

Filesize
212KB

Download
memory/3856-390-0x00007FF9A5AC0000-0x00007FF9A5AC1000-memory.dmp

Filesize
4KB

Download
memory/3856-389-0x00007FF9A3E90000-0x00007FF9A3E91000-memory.dmp

Filesize
4KB

Download
memory/4572-379-0x00007FF9A5610000-0x00007FF9A5611000-memory.dmp

Filesize
4KB

Download