f1db224af0f14b971ba8be3e33482322b2f821695a4bbe2782b956217da383ad

Resubmissions

30-11-2024 05:05

241130-fq1p3ayken 8

15-11-2024 21:39

241115-1hzs1ssgnf 8

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2024 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JJSploit_8.10.10_x64_en-US.msi
Size

5.0MB
MD5

8cb1e85b5723e3d186cc1742b6c71122
SHA1

f4638a9849b2bea46c8120930c7727cfae70b4d2
SHA256

f1db224af0f14b971ba8be3e33482322b2f821695a4bbe2782b956217da383ad
SHA512

b447f7b4e6590120ed50eaad798b271e7ebbe52ad61dbe5e621e0c99a6314fbcfd10ce8e6f837a7ca76e1084651c65dcb0eafcdac6cce6eebe2d1729249add5b
SSDEEP

98304:6jmBVvK7NEfE6nal/6r5mzaB325gGiU9fh8ztt8xuvuUnm18uHwCEtFW+VAv8m:srNEfulImzfh8IquKq8uA

Score

8^/10

discovery evasion execution persistence phishing privilege_escalation trojan

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
43	1060	powershell.exe
45	1060	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1060	powershell.exe
1060	powershell.exe

A potential corporate email address has been identified in the URL: httpswww.youtube.com@Omnidevcbrd1
phishing
A potential corporate email address has been identified in the URL: httpswww.youtube.com@WeAreDevsExploitscbrd1
phishing
Downloads MZ/PE file

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\Locales\vi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Locales\it.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Trust Protection Lists\Mu\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Locales\ja.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Locales\km.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\VisualElements\Logo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\Locales\am.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\edge_feedback\camera_mf_trace.wprp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\vk_swiftshader_icd.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_sr-Cyrl-RS.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\131.0.2903.48.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Locales\lb.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\msedge.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\msedge.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Locales\am.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\Locales\bg.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\Locales\hr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\msedge.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\VisualElements\SmallLogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\Trust Protection Lists\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\Trust Protection Lists\Sigma\Social	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\Locales\el.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Locales\af.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Locales\ta.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\VisualElements\Logo.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\vk_swiftshader_icd.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Locales\eu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\Trust Protection Lists\Sigma\LICENSE	setup.exe
File created	C:\Program Files\JJSploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Program Files\JJSploit\Uninstall JJSploit.lnk	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_fa.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_iw.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_mi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Locales\lv.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\ffmpeg.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\psmachine_arm64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_ne.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\identity_proxy\stable.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Trust Protection Lists\Mu\Analytics	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\Locales\ko.pak	setup.exe
File created	C:\Program Files\JJSploit\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_el.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_nb.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_sl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Locales\ga.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Locales\mk.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\Locales\ug.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_hi.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\Locales\fil.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_te.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\vulkan-1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Locales\tr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Locales\vi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_sr-Cyrl-BA.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Locales\cy.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\notification_helper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\Locales\sr-Cyrl-BA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\Locales\en-GB.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\Locales\zh-TW.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_is.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_gd.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_lo.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\cookie_exporter.exe	setup.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5851a5.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FFBDBA95-DF8A-4611-9643-F1D13013482B}	msiexec.exe
File created	C:\Windows\Installer\{FFBDBA95-DF8A-4611-9643-F1D13013482B}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{FFBDBA95-DF8A-4611-9643-F1D13013482B}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e5851a5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI52BF.tmp	msiexec.exe
File created	C:\Windows\Installer\e5851a7.msi	msiexec.exe

Executes dropped EXE 22 IoCs

pid	Process
3788	MicrosoftEdgeWebview2Setup.exe
3892	MicrosoftEdgeUpdate.exe
1924	MicrosoftEdgeUpdate.exe
3936	MicrosoftEdgeUpdate.exe
1360	MicrosoftEdgeUpdateComRegisterShell64.exe
4420	MicrosoftEdgeUpdateComRegisterShell64.exe
3280	MicrosoftEdgeUpdateComRegisterShell64.exe
4424	MicrosoftEdgeUpdate.exe
4644	MicrosoftEdgeUpdate.exe
2924	MicrosoftEdgeUpdate.exe
392	MicrosoftEdgeUpdate.exe
1052	MicrosoftEdge_X64_131.0.2903.48.exe
3864	setup.exe
5116	setup.exe
5032	MicrosoftEdgeUpdate.exe
1000	JJSploit.exe
3508	msedgewebview2.exe
4508	msedgewebview2.exe
1992	msedgewebview2.exe
4564	msedgewebview2.exe
4720	msedgewebview2.exe
3404	msedgewebview2.exe

Loads dropped DLL 38 IoCs

pid	Process
2616	MsiExec.exe
3892	MicrosoftEdgeUpdate.exe
1924	MicrosoftEdgeUpdate.exe
3936	MicrosoftEdgeUpdate.exe
1360	MicrosoftEdgeUpdateComRegisterShell64.exe
3936	MicrosoftEdgeUpdate.exe
4420	MicrosoftEdgeUpdateComRegisterShell64.exe
3936	MicrosoftEdgeUpdate.exe
3280	MicrosoftEdgeUpdateComRegisterShell64.exe
3936	MicrosoftEdgeUpdate.exe
4424	MicrosoftEdgeUpdate.exe
4644	MicrosoftEdgeUpdate.exe
2924	MicrosoftEdgeUpdate.exe
2924	MicrosoftEdgeUpdate.exe
4644	MicrosoftEdgeUpdate.exe
392	MicrosoftEdgeUpdate.exe
5032	MicrosoftEdgeUpdate.exe
2616	MsiExec.exe
1000	JJSploit.exe
3508	msedgewebview2.exe
4508	msedgewebview2.exe
3508	msedgewebview2.exe
3508	msedgewebview2.exe
3508	msedgewebview2.exe
1992	msedgewebview2.exe
1992	msedgewebview2.exe
4564	msedgewebview2.exe
4564	msedgewebview2.exe
4720	msedgewebview2.exe
4720	msedgewebview2.exe
3404	msedgewebview2.exe
1992	msedgewebview2.exe
1992	msedgewebview2.exe
1992	msedgewebview2.exe
3404	msedgewebview2.exe
1992	msedgewebview2.exe
3404	msedgewebview2.exe
3508	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	JJSploit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4484	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4424	MicrosoftEdgeUpdate.exe
392	MicrosoftEdgeUpdate.exe
5032	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c4d65e62b69e8e0b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c4d65e620000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c4d65e62000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc4d65e62000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c4d65e6200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 49 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133761806258596873"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ELEVATION	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\CLSID\ = "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ProgID\ = "MicrosoftEdgeUpdate.CoreClass.1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\59ABDBFFA8FD116469341F1D033184B2\ProductIcon = "C:\\Windows\\Installer\\{FFBDBA95-DF8A-4611-9643-F1D13013482B}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35725228-BF11-429E-B5B8-ED0F2BCABF82}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35725228-BF11-429E-B5B8-ED0F2BCABF82}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.31\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35725228-BF11-429E-B5B8-ED0F2BCABF82}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C76C02A1-BCDF-4632-88E6-55698920001E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1768	msiexec.exe
1768	msiexec.exe
1060	powershell.exe
1060	powershell.exe
1060	powershell.exe
3892	MicrosoftEdgeUpdate.exe
3892	MicrosoftEdgeUpdate.exe
3892	MicrosoftEdgeUpdate.exe
3892	MicrosoftEdgeUpdate.exe
3892	MicrosoftEdgeUpdate.exe
3892	MicrosoftEdgeUpdate.exe
4588	msedge.exe
4588	msedge.exe
3968	msedge.exe
3968	msedge.exe
5372	msedge.exe
5372	msedge.exe
5140	identity_helper.exe
5140	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3508	msedgewebview2.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4484	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4484	msiexec.exe
Token: SeSecurityPrivilege	1768	msiexec.exe
Token: SeCreateTokenPrivilege	4484	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4484	msiexec.exe
Token: SeLockMemoryPrivilege	4484	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4484	msiexec.exe
Token: SeMachineAccountPrivilege	4484	msiexec.exe
Token: SeTcbPrivilege	4484	msiexec.exe
Token: SeSecurityPrivilege	4484	msiexec.exe
Token: SeTakeOwnershipPrivilege	4484	msiexec.exe
Token: SeLoadDriverPrivilege	4484	msiexec.exe
Token: SeSystemProfilePrivilege	4484	msiexec.exe
Token: SeSystemtimePrivilege	4484	msiexec.exe
Token: SeProfSingleProcessPrivilege	4484	msiexec.exe
Token: SeIncBasePriorityPrivilege	4484	msiexec.exe
Token: SeCreatePagefilePrivilege	4484	msiexec.exe
Token: SeCreatePermanentPrivilege	4484	msiexec.exe
Token: SeBackupPrivilege	4484	msiexec.exe
Token: SeRestorePrivilege	4484	msiexec.exe
Token: SeShutdownPrivilege	4484	msiexec.exe
Token: SeDebugPrivilege	4484	msiexec.exe
Token: SeAuditPrivilege	4484	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4484	msiexec.exe
Token: SeChangeNotifyPrivilege	4484	msiexec.exe
Token: SeRemoteShutdownPrivilege	4484	msiexec.exe
Token: SeUndockPrivilege	4484	msiexec.exe
Token: SeSyncAgentPrivilege	4484	msiexec.exe
Token: SeEnableDelegationPrivilege	4484	msiexec.exe
Token: SeManageVolumePrivilege	4484	msiexec.exe
Token: SeImpersonatePrivilege	4484	msiexec.exe
Token: SeCreateGlobalPrivilege	4484	msiexec.exe
Token: SeCreateTokenPrivilege	4484	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4484	msiexec.exe
Token: SeLockMemoryPrivilege	4484	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4484	msiexec.exe
Token: SeMachineAccountPrivilege	4484	msiexec.exe
Token: SeTcbPrivilege	4484	msiexec.exe
Token: SeSecurityPrivilege	4484	msiexec.exe
Token: SeTakeOwnershipPrivilege	4484	msiexec.exe
Token: SeLoadDriverPrivilege	4484	msiexec.exe
Token: SeSystemProfilePrivilege	4484	msiexec.exe
Token: SeSystemtimePrivilege	4484	msiexec.exe
Token: SeProfSingleProcessPrivilege	4484	msiexec.exe
Token: SeIncBasePriorityPrivilege	4484	msiexec.exe
Token: SeCreatePagefilePrivilege	4484	msiexec.exe
Token: SeCreatePermanentPrivilege	4484	msiexec.exe
Token: SeBackupPrivilege	4484	msiexec.exe
Token: SeRestorePrivilege	4484	msiexec.exe
Token: SeShutdownPrivilege	4484	msiexec.exe
Token: SeDebugPrivilege	4484	msiexec.exe
Token: SeAuditPrivilege	4484	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4484	msiexec.exe
Token: SeChangeNotifyPrivilege	4484	msiexec.exe
Token: SeRemoteShutdownPrivilege	4484	msiexec.exe
Token: SeUndockPrivilege	4484	msiexec.exe
Token: SeSyncAgentPrivilege	4484	msiexec.exe
Token: SeEnableDelegationPrivilege	4484	msiexec.exe
Token: SeManageVolumePrivilege	4484	msiexec.exe
Token: SeImpersonatePrivilege	4484	msiexec.exe
Token: SeCreateGlobalPrivilege	4484	msiexec.exe
Token: SeCreateTokenPrivilege	4484	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4484	msiexec.exe
Token: SeLockMemoryPrivilege	4484	msiexec.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
4484	msiexec.exe
4484	msiexec.exe
1000	JJSploit.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2616	1768	msiexec.exe	102
PID 1768 wrote to memory of 2616	1768	msiexec.exe	102
PID 1768 wrote to memory of 2616	1768	msiexec.exe	102
PID 1768 wrote to memory of 2000	1768	msiexec.exe	111
PID 1768 wrote to memory of 2000	1768	msiexec.exe	111
PID 1768 wrote to memory of 1060	1768	msiexec.exe	113
PID 1768 wrote to memory of 1060	1768	msiexec.exe	113
PID 1060 wrote to memory of 3788	1060	powershell.exe	117
PID 1060 wrote to memory of 3788	1060	powershell.exe	117
PID 1060 wrote to memory of 3788	1060	powershell.exe	117
PID 3788 wrote to memory of 3892	3788	MicrosoftEdgeWebview2Setup.exe	118
PID 3788 wrote to memory of 3892	3788	MicrosoftEdgeWebview2Setup.exe	118
PID 3788 wrote to memory of 3892	3788	MicrosoftEdgeWebview2Setup.exe	118
PID 3892 wrote to memory of 1924	3892	MicrosoftEdgeUpdate.exe	119
PID 3892 wrote to memory of 1924	3892	MicrosoftEdgeUpdate.exe	119
PID 3892 wrote to memory of 1924	3892	MicrosoftEdgeUpdate.exe	119
PID 3892 wrote to memory of 3936	3892	MicrosoftEdgeUpdate.exe	120
PID 3892 wrote to memory of 3936	3892	MicrosoftEdgeUpdate.exe	120
PID 3892 wrote to memory of 3936	3892	MicrosoftEdgeUpdate.exe	120
PID 3936 wrote to memory of 1360	3936	MicrosoftEdgeUpdate.exe	121
PID 3936 wrote to memory of 1360	3936	MicrosoftEdgeUpdate.exe	121
PID 3936 wrote to memory of 4420	3936	MicrosoftEdgeUpdate.exe	122
PID 3936 wrote to memory of 4420	3936	MicrosoftEdgeUpdate.exe	122
PID 3936 wrote to memory of 3280	3936	MicrosoftEdgeUpdate.exe	123
PID 3936 wrote to memory of 3280	3936	MicrosoftEdgeUpdate.exe	123
PID 3892 wrote to memory of 4424	3892	MicrosoftEdgeUpdate.exe	124
PID 3892 wrote to memory of 4424	3892	MicrosoftEdgeUpdate.exe	124
PID 3892 wrote to memory of 4424	3892	MicrosoftEdgeUpdate.exe	124
PID 3892 wrote to memory of 4644	3892	MicrosoftEdgeUpdate.exe	126
PID 3892 wrote to memory of 4644	3892	MicrosoftEdgeUpdate.exe	126
PID 3892 wrote to memory of 4644	3892	MicrosoftEdgeUpdate.exe	126
PID 2924 wrote to memory of 392	2924	MicrosoftEdgeUpdate.exe	128
PID 2924 wrote to memory of 392	2924	MicrosoftEdgeUpdate.exe	128
PID 2924 wrote to memory of 392	2924	MicrosoftEdgeUpdate.exe	128
PID 2924 wrote to memory of 1052	2924	MicrosoftEdgeUpdate.exe	132
PID 2924 wrote to memory of 1052	2924	MicrosoftEdgeUpdate.exe	132
PID 1052 wrote to memory of 3864	1052	MicrosoftEdge_X64_131.0.2903.48.exe	133
PID 1052 wrote to memory of 3864	1052	MicrosoftEdge_X64_131.0.2903.48.exe	133
PID 3864 wrote to memory of 5116	3864	setup.exe	134
PID 3864 wrote to memory of 5116	3864	setup.exe	134
PID 2924 wrote to memory of 5032	2924	MicrosoftEdgeUpdate.exe	137
PID 2924 wrote to memory of 5032	2924	MicrosoftEdgeUpdate.exe	137
PID 2924 wrote to memory of 5032	2924	MicrosoftEdgeUpdate.exe	137
PID 2616 wrote to memory of 1000	2616	MsiExec.exe	140
PID 2616 wrote to memory of 1000	2616	MsiExec.exe	140
PID 1000 wrote to memory of 3192	1000	JJSploit.exe	141
PID 1000 wrote to memory of 3192	1000	JJSploit.exe	141
PID 1000 wrote to memory of 3912	1000	JJSploit.exe	142
PID 1000 wrote to memory of 3912	1000	JJSploit.exe	142
PID 1000 wrote to memory of 3508	1000	JJSploit.exe	143
PID 1000 wrote to memory of 3508	1000	JJSploit.exe	143
PID 3508 wrote to memory of 4508	3508	msedgewebview2.exe	144
PID 3508 wrote to memory of 4508	3508	msedgewebview2.exe	144
PID 3192 wrote to memory of 2328	3192	cmd.exe	145
PID 3192 wrote to memory of 2328	3192	cmd.exe	145
PID 3912 wrote to memory of 3968	3912	cmd.exe	146
PID 3912 wrote to memory of 3968	3912	cmd.exe	146
PID 2328 wrote to memory of 3176	2328	msedge.exe	147
PID 2328 wrote to memory of 3176	2328	msedge.exe	147
PID 3968 wrote to memory of 3428	3968	msedge.exe	148
PID 3968 wrote to memory of 3428	3968	msedge.exe	148
PID 3508 wrote to memory of 1992	3508	msedgewebview2.exe	149
PID 3508 wrote to memory of 1992	3508	msedgewebview2.exe	149
PID 3508 wrote to memory of 1992	3508	msedgewebview2.exe	149

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\JJSploit_8.10.10_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4484

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DFF7B7146B2428FE98DB2C01602296F9 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Program Files\JJSploit\JJSploit.exe
    "C:\Program Files\JJSploit\JJSploit.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Windows\system32\cmd.exe
      "cmd" /C start https://www.youtube.com/@Omnidev_
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@Omnidev_
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2328
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa6fff46f8,0x7ffa6fff4708,0x7ffa6fff4718
        6⤵
        
        PID:3176
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,5776487633805113655,4991972484213450810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5372
  - - C:\Windows\system32\cmd.exe
      "cmd" /C start https://www.youtube.com/@WeAreDevsExploits
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@WeAreDevsExploits
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3968
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa6fff46f8,0x7ffa6fff4708,0x7ffa6fff4718
        6⤵
        
        PID:3428
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,4520213856098432462,15357578879796297318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        6⤵
        
        PID:4768
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,4520213856098432462,15357578879796297318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4588
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,4520213856098432462,15357578879796297318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
        6⤵
        
        PID:4524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4520213856098432462,15357578879796297318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
        6⤵
        
        PID:4432
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4520213856098432462,15357578879796297318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
        6⤵
        
        PID:5008
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4520213856098432462,15357578879796297318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
        6⤵
        
        PID:5400
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4520213856098432462,15357578879796297318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
        6⤵
        
        PID:5852
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4520213856098432462,15357578879796297318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
        6⤵
        
        PID:5872
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,4520213856098432462,15357578879796297318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8
        6⤵
        
        PID:552
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,4520213856098432462,15357578879796297318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5140
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.10 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1000.3812.15775190251856983163
      4⤵
      Checks computer location settings
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3508
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=131.0.2903.48 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffa6e8e6070,0x7ffa6e8e607c,0x7ffa6e8e6088
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4508
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\msedgewebview2.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1800,i,7370483122401176296,429492031630936171,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1992
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2040,i,7370483122401176296,429492031630936171,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4564
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2036,i,7370483122401176296,429492031630936171,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4720
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.48\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3396,i,7370483122401176296,429492031630936171,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3404
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3892
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1924
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3936
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1360
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4420
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3280
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjkzMTRDN0YtMkEwNS00MjAwLUJERTEtMkUxNTgyREZERDJDfSIgdXNlcmlkPSJ7MzVBQzY1M0MtRjBFQy00RDU2LUJEMEQtODU5MEY4MEI1RTMyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxRDY1NDc5My1EREJGLTQwM0QtOTZBNS03Qjk2QUNBRTNDMkR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjMxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzM2NTIxODEzIiBpbnN0YWxsX3RpbWVfbXM9IjYyNSIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4424
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{69314C7F-2A05-4200-BDE1-2E1582DFDD2C}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4644

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4756

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjkzMTRDN0YtMkEwNS00MjAwLUJERTEtMkUxNTgyREZERDJDfSIgdXNlcmlkPSJ7MzVBQzY1M0MtRjBFQy00RDU2LUJEMEQtODU5MEY4MEI1RTMyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Qzc2QTAzMjUtMTQzOS00M0ZBLTg4MzItRjgwMTNBQzQ4N0U0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O2xoVmkxMlFjazZTbDB1VTFPQjZZMTUyOWJSNmJzZXk0K2N1N2RIeHM2Y2s9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzOSIgaW5zdGFsbGRhdGV0aW1lPSIxNzI4MjkzNTMzIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNzI3NjYxMjM4MDMwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTM0MjE0NjU0OCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:392
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9A7ECF3D-9809-478B-B1EA-7210B9C214C6}\MicrosoftEdge_X64_131.0.2903.48.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9A7ECF3D-9809-478B-B1EA-7210B9C214C6}\MicrosoftEdge_X64_131.0.2903.48.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9A7ECF3D-9809-478B-B1EA-7210B9C214C6}\EDGEMITMP_B0E87.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9A7ECF3D-9809-478B-B1EA-7210B9C214C6}\EDGEMITMP_B0E87.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9A7ECF3D-9809-478B-B1EA-7210B9C214C6}\MicrosoftEdge_X64_131.0.2903.48.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9A7ECF3D-9809-478B-B1EA-7210B9C214C6}\EDGEMITMP_B0E87.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9A7ECF3D-9809-478B-B1EA-7210B9C214C6}\EDGEMITMP_B0E87.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9A7ECF3D-9809-478B-B1EA-7210B9C214C6}\EDGEMITMP_B0E87.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.48 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff701e92918,0x7ff701e92924,0x7ff701e92930
      4⤵
      Executes dropped EXE
      PID:5116
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjkzMTRDN0YtMkEwNS00MjAwLUJERTEtMkUxNTgyREZERDJDfSIgdXNlcmlkPSJ7MzVBQzY1M0MtRjBFQy00RDU2LUJEMEQtODU5MEY4MEI1RTMyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2OTVCNEE4Ni1FMTkxLTRFMjItODFBNS02OTE0OTc3NjE4NUZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuMjkwMy40OCIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTM0OTQ5MDIyOSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzNDk0OTAyMjkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTcxNTIxNTUxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy83MzhlOWM4YS1hMWM3LTRhZTAtYjI5Yy1mNDMyMTU0ODM0NmY_UDE9MTczMjMxMTczMiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1CcnNzN3dOS21EbjZGcFYyJTJmSVF3MmRKSHNtN2g3THFnVkpFdmlMV2JBRG5vUWhaJTJiRlZWSSUyZmlTWEhIUExpd0lsbGYzYWhwWkp3aVRYdjhvTCUyZll3M09BJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc2NTU3NjQ4IiB0b3RhbD0iMTc2NTU3NjQ4IiBkb3dubG9hZF90aW1lX21zPSIxNTMyOCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1NzE2Nzc3MjYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTg2ODM0MTIxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MjExNTQ5Njg1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzEyIiBkb3dubG9hZF90aW1lX21zPSIyMjIwMyIgZG93bmxvYWRlZD0iMTc2NTU3NjQ4IiB0b3RhbD0iMTc2NTU3NjQ4IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MjQ0MSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5851a6.rbs

Filesize
21KB

MD5
dfb927d73f860522546c82b68f5d4973

SHA1
ea1d5bca36a3c01e71a9ed94f580e3f3446bf144

SHA256
e518e7394fdd2dabb44a131b64a10d8ed266a5e0c37c082efaeb3d221b8d0e0f

SHA512
8c267b2f7fe9c404ea92f8752ac9daf515ea12d104802fa7dea3e805eebfefd0f107bef425d37a8916bc4c415b15692df3ec5e7bda479a4d4bba3b16e926a654

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.48\Installer\setup.exe

Filesize
6.6MB

MD5
d9ea5247222e4fc6b42b9536914a63e5

SHA1
1de96ed33f1a51f6804a51be71e47fb7aca3e7fb

SHA256
fbfb9cbce143d9ed8dc328f3c6d4ac071e4216373e32158f17e2454da95b25a6

SHA512
62dfceb843dc90a98e3d30a14f69313e8837707f3bb69a0c40354cc17cb14f8b0b529e8e6fdbc6651cb1c6c9ee7652b0bcf6508c6ac5dbbaa30257bbe6770c1e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
182KB

MD5
1723c5e707061e59d769c492a95d5083

SHA1
3b535b7a0df2f7a4ab5e531956dad9892adfb5e9

SHA256
e97ab6dc0ed865aa8606f5c113fd62170341d1a3d63d5618f233aea969ec49ab

SHA512
a4e3bd9ec331a27338c123a9a3ae23619fc5a5b80fc9aea38d23d3b82ca015f47669e0f3e1a6f98e7f464e6bc21e92723a04f72805e45e0dfc81540a2d299a8a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
35a79bd6de650d2c0988674344bf698b

SHA1
a0635c38472f8cc0641ceb39c148383619d221dd

SHA256
a79a81da2b8dcbe39609a9e1b4e8c81ae0bc54195c0c854b77bebe7bfa7f10c1

SHA512
afe33d38785afe489845654ba1c3ed6648b36b1ebe5f98b3d5d4bf24eba3af9bb6676af5a79d2ec570bf2b4b6ae40d14fc3d4b872c5d4577aea40f6d1a26c0cf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
215KB

MD5
c55b37823a672c86bc19099633640eab

SHA1
da5e15d773c794f8b21195e7ad012e0ed1bceb72

SHA256
3df9cd2fecf10e65be13d4b61ca0a9185845f2cb04b872adeaf41ca46af39aa0

SHA512
1252c3fde4aa4ce239103e8df7224afce093a2cbe539bd40347601980a314ea3326ea6ce4c1ebc845c125845969ad65ebca319b9df35a809ef871bad14aaf33d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
262KB

MD5
dd30f3ff486b830211df62d20348f86f

SHA1
08c7d7407dee7ed20b50e8f1a2cb1b08a9282dbf

SHA256
9d57bdc8b97e75f8a04b93a1657dfd18d4e2f68607783c9bca42140233978fa7

SHA512
af3b48ced7018c7edeabdfa998e51356d57c2d7a846c76629fed0ff2e5db8db79041184c58a5a67a10ec627f53af8e3c80bbffacaecf5dae6d989cecb82e72e4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
39ac5a029f87748e964491b97936d890

SHA1
24777aad794a13d0e7381fc6f32f0e1bcdb1ba80

SHA256
ba861524fe648ccb47b7ac57421bb07a6231a7aab5eaea332548511cce6185bc

SHA512
2ecb9b208846f84cd37f37d2100f26358d6c37128efc4010b2e7efc10202dc37b621d0c0138a8b76b23d968da324c685a41b44f4ae30cbbe243581f1904e14c6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_af.dll

Filesize
29KB

MD5
2a9524cf8afae49394379d9d9be69206

SHA1
e43d4146f8abebbb30831fbd39a39846bfb7eeef

SHA256
e5a08731963e681b6386c4e85c16bc98452ebc13c4a7de3ff6979125c609d5f0

SHA512
a0111589960cbdcb10b55c17aa82555e44f0f0f173ebad09de6364881138cb35280596f1de6d86b31044427445575630c22079c3585e34729ce461599b8979b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
1903bc250fc269e79c9f7aada2979aff

SHA1
efbf76b1259217c02c138078c56f36b2cb8543ab

SHA256
228fa3e2fcacc78111a8152d6862de2302c024e81cc8b5e3f16e31caf96cfd04

SHA512
9db527c2e26ef691c089f5d1d010298e0f47e2e0420fba03ed18c7c2793b92c5860240b214b5233dddbc150413a2649e9cf4823239b9831930c2804b143ab538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
b4c28669b9d4e56b094af6062f4db065

SHA1
4c492c03138c8a796cf0673866892b9e0c2073ec

SHA256
7fe494dd265f99f330b153ef69c51c0541016755ca1876788f7f0ede78f9cedb

SHA512
35941ab6f2dcf5f60824d172f75f9f7b8b93e65c7bd8bc441fc32e49cbb414a68d65a02e3479b096f728b2a34d3e85dfd868e8bf95ff9b1a57d10adc3da0022a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_as.dll

Filesize
29KB

MD5
16b0c8a664626da016a95fb46fdc9c0e

SHA1
c674b635cd8927511825847f3d86a5562b4155d7

SHA256
b059fc9713d3a41e9a83f0d61f8cce29546d3759def0a7b8e162a13915e51255

SHA512
ec39269fbd9e510d10d665c86b8a8161208b74f919e4fd128e365144d71f2b59d3c48c50b8f017b1d30c711ee4f63668f843539957b4643d2a488c9e17290e75

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
bf510bb9b7639af7da969f77620b480f

SHA1
17a6693a5d6aea1f3fa6f34abc46daf558cac645

SHA256
2507da222cf6c6dd608da9b569f89f8e11c47b6e16134c767cdc23b7c1f56bd3

SHA512
6cebe80005cb7759ee4fd8dd9ca41bdd073c01e969e1ebe03cb07616921e50516974019faacc2f9dcaaccdc0044eaae57a6a94f3a4a4ce044a781cd8091478a7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
4b23c7229eb43740744cfbf48c4242ca

SHA1
4938dcf6239e14db53c8f085d3c477905a9986af

SHA256
a7527b867ebc222114b679b2ac542cdc46a75f8bc24e5ca8b7ebc17b7a2963c2

SHA512
4bd8ed0ecacd3f2c69dcd0789ab8ee10dcfd6144b019dd8858c2234bebddfe42c83037fb8e2f934f3320f58796683bed5ab050ba897ba1fa409b6df60f02ec53

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
1e038b27661b303e15a39a55305e86bb

SHA1
35b48fe72d50406063f9145fea64c57f205f0084

SHA256
385665137d0dfee16ed8ef2da5ce28d826d210eb2bde1fa4ef13dac50e4b5364

SHA512
13fcfde6923b38acc2cfa530087d13725a2cabdd2e771d503f4d2f5cff93e8744f142e235dd484244d920d80cb3e7cecbbd731b473f6e509edb39159c51e9465

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
9afe531b6472cf9eb66028e9638584bb

SHA1
6212292867bd59fe376e79988c07f4db8ad26cdc

SHA256
383754fc147dc6ef5f1edd14b60bab6bebf32639dfea718aaa64b2b65ac98812

SHA512
352bec509ccd3ad15a274ddd3ccea43b76eaed885b0e7722235abd95aab8fec1c645722765d76865c1b32ed422a10e6666f220e3abcc5a24268ba94c5cc6b8d8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_bs.dll

Filesize
29KB

MD5
5e06d311c2e24b94f378c4d3b3deb260

SHA1
ef7df63f63746eb197c21694ebb21cfb86c0b2b8

SHA256
d2052450e3a3272b302d80af9f2c46b766153267100bc902dcf03a78ec609b65

SHA512
8d73b5265735aa19116cf41bb8d2bdacde5b22b286a56af58068f9579b631b044c155e625f6e1fda12e505f621f245faebe126c2557dd2ec873d7d980f8ba552

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
30KB

MD5
afdafc9f56401b662f42cef830d92b38

SHA1
b56966370ec07cd676e35d93fad001e0f6b3fb8a

SHA256
03d7a1c0d8810df4b908fcc40c8491df0e3ce19db8ee22e6be79d02fd9df8f72

SHA512
884f9cd99785ea91c5c8e26200bbf0b010ff278b52c5ac590cb73712321a9cdb645e5448bf4cf62622cdb06543b8de4a8e6956a2f6b6677c0b9befb35589d8b0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
15ee7526536790bf77317975896542f9

SHA1
365bc54203b490daa0e24a1c9813d5d99c9de720

SHA256
5e2349af6e02da1c5d18f1b3235fc5099229d2d99e1c5cf2713c21472c151f8e

SHA512
475fd9c0879c8cbc418a66441e3dc026fca983327a95763eddd1537c1f44fdf272d212c69e1b06aad55d91c68379a2beafb2908659d58a61c740731a7d047406

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
8eff4531519a4b768005b9411d4a5f9c

SHA1
59b354e3f32f0a0da8755c27b903803994f4aa31

SHA256
2e9a230a8b8a7fa437a28e2115ebf01178f3209fc0d61eb90160f49c11a16cb0

SHA512
4426ae1e2937e1f6c7364d2f437aeb83d834f9997d28cb1ffb07fe1c448dd954083aa822ff439c886249a387823a23245640a0425dd8c42b75b73912733f11ee

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
11b92ae8fe94c784480d465a37935766

SHA1
f4ead29d4b20c57bb0e4d16a7488784f61a25972

SHA256
571b0cf8b0383e33393b8b8fa79d1632688ffc2bdde794fff62c85f5e1a3f161

SHA512
b636dec2e1d48916d0c83d2fe45eb24d826c027455cf22ec78e013166e59fbdb4780ebe69de3ab4b5730dae03652d253890917f53fc835aa73f9f75b01dc4f23

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_da.dll

Filesize
29KB

MD5
19a7aee0daf68fdc1a24e3228a8bf439

SHA1
1fc6ce227a11245787c80f3932e2c311de2d44bb

SHA256
409cce12be8b7a86313bd1d9e3c6d9154cf0c5735db61d94852a128a746dab99

SHA512
0051119311316d29dbc13ace84c24283aa2eaf1d46459c81ba7b31cc6178b43165618fd7bec17de698b1431ef2b33be179c2c8b1537c1000aadf849e2c888c84

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_de.dll

Filesize
31KB

MD5
ce66ef1a806c21949b75055f81cac760

SHA1
3719e4af114a3c0baceb133d152a02bc6a1fb9f8

SHA256
23f5414d554b96db0b93c7dbe27939d294b8061e56c19ab74d59fe9135e81c8f

SHA512
04d9575c866ac28db490a291be3da41f884d3ceadbc9b7077776ea7deb1819277aadcf9c9e1b5afede3e90bafbcb00e6ef0840166228d153be7e8d8d53975593

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_el.dll

Filesize
31KB

MD5
09cf47260852ff7b2c91c65d127b9314

SHA1
b3d362f3d08f81bd1b719a1c94b54f5f9c9610da

SHA256
eb4344676280f83e6023ddc604ffa42e96eb46e765a216fbc5ecbe49ddb3c920

SHA512
114a21296d8e7e054906139102617e6cd6008337a0877053721553cfed10183f54f890c8071b1cea17bd0b2535589af7aafe5bd1d161886ad7363f89919d7300

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
39dc20ae50a0e2ba9c55dda91256b3cc

SHA1
464139f11db3fd6ae77502b183c4b59f581d6c7a

SHA256
e1891a155be133e6dd82cab3f9437bb7f047f0f80689ca724ca4d1d90d1fef14

SHA512
08b8e19528ff007b904f55872935e0de9e06e7cbcb3f3ed751264e3e20a740b477b55c818bf2b0ed213c4ed9cbaba0c8953c19f427be3e8ab8f50c9c86a74bf4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
894b6ea4b49fa390bd70167a75f3ff7b

SHA1
4f834ef6567d02f28390d63c8ca9fd3c735b2140

SHA256
a8dc2b1e32d8d3d2c321c469eed3329f7661f4fc71d14696f97106b5aa6c532a

SHA512
9b4fcbd07dc7f65c34575aaabb7a517198739f7268133f084b101edf99f0b96387f3f0248de1be5252b2466db0bc59036d40e3990d4264bfab89aa01aace7ea6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
bcafbabbfc8f810220b2ebdbb8a76d19

SHA1
58703c8355f996f2ce8ae5fd1ce4dc29318fd414

SHA256
7fef9c85b5d7dadf344ff39d82794ed252066cceb2b6531be2a45ee3d84844b7

SHA512
b02820c3088ceae9ebf19ede77e3a406483a3dc13c030860d3818e6e8a163e9f54293fd058ec9575c196d12f1465211ab7feff145faf684be6a8cc251d1c0d71

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_es.dll

Filesize
29KB

MD5
3ccb8eab53a0b4c93507bf2adff6ced5

SHA1
25fa2435e97bd0e1cf986a882ce33e68f961c139

SHA256
8bcbd325374a8cc5c1c7ea774382515316473c200baec86a65ae21073fae33b0

SHA512
4f443ded84d74e150a0be3c32edc734ca01298817933a7b1f0e5c5cd93f26987f051c4c306848301e688b9334d134a12bcdcc0ceabe1fcaaca5c4d307c697bfd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
6b03eb5b302e72727977f2431ea7f30d

SHA1
ac5cab93d3c28e46f92d2719638c739c680cc452

SHA256
b5b51fe000e0e0ce42e8dbaf4b8343a5411e2e99440726c747196a02ed736137

SHA512
362e94f79b7726b277cc90c5158d3cc5a0a890bf32e11707f9901233414b3ff22816df78276afa67f0122fc7d6fc2d09dbb1fd8602e3a01f807f93b9423bb463

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_eu.dll

Filesize
29KB

MD5
ed883bbd9e4b3de4db68e356707f3e67

SHA1
e03dde660c15a614442552f8c4d2cc5dd8425fc1

SHA256
168eb27052a559561af3ed650bc170eb471e53f05b9065f0e229672d040ae1c7

SHA512
ae48fe344b2644380e56a95d98aeb0ffeff7ddf0c914f5d14ef518a4d40bb090fee9a7fd30f7178524bcdec1a2d8fc870b4b40d5d8437e3f2577320262236126

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_fa.dll

Filesize
28KB

MD5
ba417f44f7564f1aca70cca9166f3f44

SHA1
d8f064e25038e0076bffcd1a694b58063b7268d7

SHA256
56632098f623cbb58fadddc5c7a889fbc91954f661078501e62517709b8ba703

SHA512
c35ba956e92a2298268bb6ee7a753d6b7f94bdec96118c834f028a0fa45f18b67302b0e20a26d948d1720b04461d3074ae30003bb9028790d9d2d63cb80f4467

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
7f47c9b9bc9488754579935209291c55

SHA1
470e590c6f5263a44b95abbd6d0c158fae326d21

SHA256
f0d8c44d909aed479b3e770b556eb3792c0d3ce247defff953a4dd9f7ce4cc75

SHA512
6f81ddd06f6a1c796bbf21143737bfeed8f9ca0ace82a4de00ccf79d7288586376439e0564f1cb128e5e585eaba122d406af8c3a6e3969efdadfe0cf65c3ed4b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
20134024ed75deda002dc0839b352f84

SHA1
e67bbd13a320d2b4413b283e165385c44a65ea0d

SHA256
425e0834cb73365cf78a233a5b139e1897961e5225e9cc92ab365b3efbe30d76

SHA512
7dbab9a85d852546ab8c30b3452ab8b200874eb3aac0c862bdaf5c90cc882cec11de536851693f8f115706448e3323c66affbdd7e65257395baf24a0208dc537

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
08b6c8f26644370c6dcbee63e4abf884

SHA1
e4981733831c4d31715cad1749545d21dc29acf2

SHA256
916b52a362fddae79461d1d07ff01fd3bb4f7b8916b263d62572a8ad420946d8

SHA512
31f074e494a372a1b961fa9c053b561bae9e52182866a538a734b7589cad550a42b1d88649262a7d265226288084e5ba65e9e1d6d32ffd9292258a9f65e236a5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
cf3ff14718b5e6125b956d6d9e897196

SHA1
041de2587e03f6c52dba60e9d2459ce33b263eb9

SHA256
d75ece04e40e34beaaf50cce0fef63e52918b5939c9c267fbfd1e6cdcb2a82fa

SHA512
551ed975b1afdc75f464bb742c30f239f9d18aa99bf9140ec0620c938629868b38a952041288244b6e2387748c16546a8fe55a664a9903577b8e484856583ac4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_ga.dll

Filesize
29KB

MD5
3ca8dfe9af49bdde95188002ebd5f227

SHA1
d18d7af889c4d03ea417c09bc56069f3f697c547

SHA256
6577e1a60f0fa340dcb70dcf625c877fc9502d122744782708ede0c53ceb56a5

SHA512
a61ba9baa6d0116b769c4add55aefc99a360bf85be7986ab099a424ff7a39ccee18d946128e74e39283629b52aa14821f36fe338c0e17de29694fff5138590be

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
d64f47e1971f1e9faba211ca984e550c

SHA1
6f4de57c6f174dd778788b138a9b25cf4725258b

SHA256
75fd1c674a460dcdafbbc1429a4c30c9ac28e58527c6f0797c3706012ec19e00

SHA512
722c9f1e5d27d6ac678ca13aa648aa22aaf1121b835fad5209ce3e482471724cf4920390f51c8df2d31c66898def51ad76b0c119f4de831011b56afead2fef7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_gl.dll

Filesize
29KB

MD5
31276d0895baff6976c94c549efbb47d

SHA1
4f0fe790cecc28823e6359fb3b78dde13cc17681

SHA256
d3bf99db747f3e6a2d541ecab380244c0a33ceef8655383d54e2daff37dc9a88

SHA512
413958104046b85772d4a32550ae3a7a3a50eb66dc35966554123bd9dd15fc7a76fa7511f6d2ac666d8a205a9b58042f68e2322189c2b34d372db6b180b70da8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_gu.dll

Filesize
29KB

MD5
bb4a1f9374f1c3e0cbc4788a3ce1d4c5

SHA1
30667d6dbaa689db9a08b42acacdf68435dac46e

SHA256
bdbd0882aba924075c40de48fcbbe951ea6a937c0b85541fd6f1fa5701b8e655

SHA512
d0a5260ae123d4698e2f62fdcf97a73aa038b69b200508948185bb5de5f5edb50d6859c9e6e21e84145ceebc144882d0ed5723ce1486e805c26737358ae77504

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_hi.dll

Filesize
29KB

MD5
274c267b7ee544d36698b2db119a6929

SHA1
27377267ddc09060254033c4aa9916a60a254956

SHA256
ac843711f010925cfdd60c396baafc3ead08584ed4b1b3df57b0c975cefd039f

SHA512
f9073912e9c314efe60f36dd9b2bdb4b1475aadde18e82bec971c447293a4f8dce46abe625bb9cec4dc48280fce3cf3d8175054b70b4e440e89a8c072f4a505a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
ca9abf92edc001d3c0cea4c926bd004c

SHA1
740513a325a5c15376f4b1aea402e9c54155ab33

SHA256
d6d9e064773b121fbf224252ef6c7d64f239d6b5013c119738a8240cc047e346

SHA512
7171143ee05b0e03bc936fbd98d3a37c3763bc244ffd8ae85e3229b85e13ec6262c3111b93b3a067f3d82f5fa6b6f691438c0e148efd14606cdf5a850e474a7c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
df2764d7bf9bbc6d4e96301c928566b5

SHA1
1f9adfed63fff6cd144515e8a7fbf8c4131d2f65

SHA256
3dcf3b4acc066674418e30239406abf59b85f9a00ba2a0aa7ca33036caee6514

SHA512
8c1eec6d813fe2266f0e03ce72f504f355f720e0112527fd411abd5e7fea05dd4bfa3ee9a878c882c16e8cd30224727eabc5ab38bd85cf146b21547ade988391

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_id.dll

Filesize
28KB

MD5
c80c6530280315158443cd04f89e9169

SHA1
fb87a9ff3696f0acceee6c8f1e4fb40795a8ae7d

SHA256
52957587efb4d995597541656f38e0edcd4545acfd92e3b81cc72578839021de

SHA512
bee22709e362ade03cf385c9b09d321923cc17a9e7c227fef7717da7405ea7bcc63e6f18b5e3e18e9dc19d5b0d9d4cb32c8548d9f16803959eb13b1189df9815

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
28064f47523b575c20fc85733cddf487

SHA1
0c5583888be256c8e09a396e333ad158b5f87553

SHA256
0752855a2e2a69e0f969af6c31102db513dbc390583f07d5df60746721ada58a

SHA512
d96656335024e0228a18148de4d27f354fdc90b62f977042ac20199714ef50bad271a83547d6c6823ec03422a9b598828fdc3b0f1ae81c760a57a2d1f2a543b7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
0da1fde56fc0bf63e17a891e99f559f1

SHA1
131d18d7329be3ff21c78a3921b88e910a3d5a68

SHA256
ba936fcce39c889a3cb41569f18019d99429a13e7dbd909d9d26e540ea650dec

SHA512
67aa088ea8c01b11874537ae59c150645b61072e4f2134719e833ca0c4c3cab835cb9c51bff97582280870227d99cfb72f3a0d2069f2a9a86a7f7dbaf29ad2d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
d92167a825c73bd6246483bfa1787c8c

SHA1
0a96d89226f1e694275922e5e2640bca3d7e7020

SHA256
d477fce0f7fbbe9cf86dbfb724e28c617c8c7c5bea664974593fbf0c032e8019

SHA512
12401ac374d3050f9540a3df6fae71ff8466ed3df2bf007b52eaddfea0d549601b5756477c141fd596bd19367ad30a607160957a8ad1818ff34e6da4125e530e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
0ff69dde83bf61a768bc63870d687747

SHA1
622714cb8eac68b79021800f28f5874aa23176b5

SHA256
3a3a4d24498f0f533a5f5e4f1364e7e2a1f348dac95f649951131185c64d7bc7

SHA512
e1300b6f2dd5df3385c06fb43de5aa246f3f1da942e26b86023663e07b12104f0e74b2749d4ef2dd60cabfc8eadfe5f131a8bb5ba8fffd6374f9cd4635b4bc53

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
67eb1378381ad4d1a450bd26fe51f5e3

SHA1
ae0655d07a4d0b049ed258de646199f9004963ce

SHA256
b2ecba67a708b9fc75fc4574b72218f64517dea1aeb5ac26400ac554903cccf9

SHA512
1da5356bee3e18f9033b81927368eefb8f7a0742f7f02be9ddf0f3f309d9d4f1ceeb640acac341e504d54c0d0939f1da2bac27645adf404ed2ac48a2846a919d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
d9b956ec540d8b1e528d88d8c5e5fdaa

SHA1
bb967aeba493d9ac0b3889f7bbf9136614080331

SHA256
cf008a24b53f2d62516a2944b77fd9be17a4778c0ba1b83a09ef7e83c3cf3901

SHA512
d6d6171c95c07ddef12bc40a5fda756ed3870a06ff2434bdd7abe02407720bff01fab5eb1bafeb7d4b9b661fc364c39de4a9eab01ef39c6bdce6de58ce4c1a06

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
5ef433fe15a877e530ba0a044486f200

SHA1
db1deb37392e001353f5a098d8686a17fc156b40

SHA256
896549adb3d1a38d95e743490cf6f551cac876fa1afc4b07f8eb30ad4d853502

SHA512
97839850a49a09cbc416ba1e8e9570adfcacbfccb70903cf597ad8781c7c3d11fd07e2598dccb7e88da7617e44ca99c62dfb3404c0c2a467641d1a6dcd7e8e64

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_kn.dll

Filesize
29KB

MD5
1ee9fe48904cb43a9147bf16823b16f1

SHA1
19fd9c0a2a1d919340eefca7956bd84df467b737

SHA256
a65da5bd18d6ac28c45cd11f56f8b868af98e42a69def6199d61235f6fa3d71d

SHA512
b556dff94243eeeb8dfe2c185c67ba7359877b8c0161f8fbe9a37a7e7591b0c8242a0be09255b616ac4f5560a728f1780cf6971c826ee6214a1b28c16551bffc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_ko.dll

Filesize
23KB

MD5
6c3abddca78cb3ba9f724bad9fed6165

SHA1
3114daf9295215bbeed0f4bb4e282b46ec1c74ae

SHA256
d47e586aacfa638aab5d681d8b4ce0b42f9d698e213817554b9d42441191d548

SHA512
b37b7c8d7d24ead85389ce445536ef4a68c43e2a55508801ab00e9bee2c2ef428d07eb30b62228d647508dc4f6b0d78b1b8edc25052eff0ec5a9ec87fdbcba1d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_kok.dll

Filesize
28KB

MD5
f97d285a3ba35b1395d9868e15bce4f1

SHA1
154dfcb8646bdb02b618dddf8a0dc1cbdab2269a

SHA256
33506ad10fafd8a767afcdd93cab2d91999b4e6468771379d944ff4758c2f5e4

SHA512
bae3152e85cc5e8f96299e7d45be8a85e47ea1119fd4d8d2bcb038ce293dab6820e35bcfffc03c9596b95e716e40711c47682f0c71e308755dc71b4c20c57628

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_lb.dll

Filesize
30KB

MD5
9c7c3dec8769f8b33aab63a15f642d81

SHA1
41ab17373c388d005b6d39c3ffc9fd5aac1a75cb

SHA256
c088700c358cfad6bd692233e450b8f4836a30a457c7b047e67681c10aecf2f7

SHA512
86923405fdcb2ebbf9a2dff24847d55bf1cf39550f475b1268e7edf279269e317c09b638b06e29f4d30ba59fd606f4ab5787f7d09da5ae3c5572ad41f3b3fac8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_lo.dll

Filesize
27KB

MD5
b0973b4e4407ea116a723bd7c39c1d45

SHA1
011e9126cf2fd3db3f0f810dc1d8e60891ef0695

SHA256
36e1ea95cd9663137ae49504980e00fbb311023c8f5f6f40f3cfe14a14ff183a

SHA512
574eb8426f774a7ccf860b4f0e324a2cc32581c9aecb834aa25c5f62946d15ef781a9f32feea8cd44e352d4878f3f6b8f097635bddb9df3bf2a443fecd0946e5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_lt.dll

Filesize
28KB

MD5
883f3e1c963322852aa6ce7177ba11fd

SHA1
3da37835cb54a847e3fa2edec45c4589e2c31561

SHA256
c3e3bd953b1035bcb34db9077c41643a503aafeecf99afbc92c9e4326bc6fea5

SHA512
52e7eae669ce211be72ed62cddd43f926c8d581a28a5efc167d1bb9c7f132f40a000cec02c91cd81604ca9f1cbb61952a9da8d09044703a49309a4faf2ff2f25

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6F4F.tmp\msedgeupdateres_lv.dll

Filesize
29KB

MD5
0edaf7aa97694524c60369256b17c9f8

SHA1
48a81d2c180b9dbb970dfc381b204c3e0bf11532

SHA256
74b7ff57e79ee2685709678d55a4b4b414f3fdf77ab1783c0ded0196a126c0fe

SHA512
de1ec10ba23b7f76dae78b6a98a3eee6df1eea424aa9a4800b70ee7b185e5c6a0dd30d0dc950bf7b37a9c07fd7614652258cdccd64413c49647b42351e02e90e

Download Submit
C:\Program Files\JJSploit\JJSploit.exe

Filesize
9.7MB

MD5
8c6a8bfd1adf6ccdfe9b65b514479ec7

SHA1
08f64d25974040ade826f0c79fd638c6a67627c1

SHA256
097eb40a9a1572788272298f48748e80053c9e83f2734387728ea689afc9bfa4

SHA512
8ca0ff01add66e8a5fc7db5cbee09fdf2aeda2026c7787370d6d8831c86b504bd50c587bea8ef32fb57f44ea4d9366d456fa071c30ae85708326529cb2800791

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
866dafc3234e14724a28638b58b0a0c9

SHA1
4d1447ec1fef3d52ca6b0c15c1a63f6b86142695

SHA256
6ef2c6c4df741da36cd5b9e0f26ef5fc72926e523e73c8ee3c148e240768dd0c

SHA512
fc658ee0c67bc43ddef80706c7f541c6bb2f88f4a7c69b376c1ac1c58f343a8d995022e004dcc9d659072466aaa19cdf27aeca4d887fac96b729bd2e44c14fa3

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
80KB

MD5
6c4075bbe50f22669524e8a2e9774d9b

SHA1
1f311af1b43756879d919c2c28ca87b57eaaaa9e

SHA256
76505ae7786e5fdd855b70e915ba36cb31864d7e8ed107e09f15c3ee984c5c6a

SHA512
8c94c5f312106e3567f494d35c2ba12dadf14de91a9cf2f242a7ff2143241cd52cd7502ed96b27e9f3079a3c324ae7709f78d4369cc5e97e70497131dc93e21f

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk

Filesize
1KB

MD5
836d948a0e6880f96492c28f4d677cf8

SHA1
928ff31ac7f3da36240e90811cde0a8481c35f1f

SHA256
85a9461d5b5423e4ae5b5c86b9a43df8d36c616c13fd23ee6cac1e9af6f3dc11

SHA512
fa2c01c4a2af48443a96154989b0cab7ecb6084dee67a91220c7645957a6b83d9bb903d6987035fd03aaac4b89f7b230116bd2f15573498656148dd83f626164

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk~RFe585493.TMP

Filesize
1KB

MD5
70a4664ecb7dfb7924d33627eda1261b

SHA1
5eb325db0df3198fc4d911be13b2f130774531ad

SHA256
2a258b0ce0a69da0cc64d92003567b050695450767a13ef43e28e136bd0f9e95

SHA512
60d83f69fb46659886e0596c3898413325d61eedbd838d8420e2c3a8d086b51f6b5a9091165a9136fb1ecc1bdcd96aa8399ca4231f0bbbeb606e73c982d77df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
c01b4d7302e4b29a8c0a63fc1dac02e4

SHA1
566fb2cd6431e26ec8b2e40db147670fe2021f8e

SHA256
cbb34ec686e01e89644817e4067b31c9f12b424fc09b2ed0a42ca56fe6af7d1b

SHA512
969c8ae947e0af783876b9863359c9b46eea590485d0164d7cc770cba28a26dcfb6bd10d29145aafa409fa78e7903049e3ed1bc381c6ed0e863168430ed28c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
524bf0cf75c0327d3f7ed2c6e2820698

SHA1
241a42d70726a39938474f847c76e47c1358a7fd

SHA256
b3063ac87d5cf6d161da7378e53d3b366de0e3a36b743c5acf3e466499cac2bf

SHA512
8660a0b3b11c97dadb1903dd018038e53eb03ee49c7bb5e422f1a2d347ee5232709f64b95e66a361d6e887ff2f9b145d1410d8971d5405d6ef97da490b52c730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2ea2cb4a703b9ab5202bc6fcff0c9a7d

SHA1
b10e1998e614d75cb98e974b662f298b7bf20041

SHA256
2d539daec3b5fb175b3cbd7f1759465de87a860b0f3fed641983f0145d551615

SHA512
11fd27eb7253e04e8eba50504cef3e09688a47b58fe95b57092afbe0cd810b8de4e345a57cacb55c3bed3f3ce3c95cfbf64bd30d471aa8bda81a8de5270baec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a93bba2c321677d102c38f3c555235a

SHA1
3fcecdf57e26e987ea8e8c1ae2ce228331d04c59

SHA256
57646d308f1611312a0f2ff43c0817ba1ac4ae4134863ccf9cba423ef2da72e0

SHA512
a2df5e564cba235d6438ec337bd6329e954b6211544eb2c560223c34a376e96d27877672847301646b404ff16ab7081289d08ba939c5cabf1103c9d86efca756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
e7e23b68ceaf208796317bb9f7da34d3

SHA1
022ea055148e784d06b4cb3d4d4edcb64b3e9faf

SHA256
4a94f45a4805df8e46339dfc5dceb0fd3634ed45b9915ec0cbb0594a47494db4

SHA512
fdde2768826402b66bd348aec5d4bb8ba2b33988d354c79f6115ff9e2687e01143920f98df32c5981514dc34576f73b48a2f73318a294ed1d0241af16c5b6d34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
54f21b564b41d3a7594c1b56ce750bab

SHA1
cd202c34cb682b7b12643ce6022669ba0a143fac

SHA256
b22b2725478fe059c8898519f8601454184360dab42d26a0c2ced8408a822e14

SHA512
bdd9f9cb84f29d050b33f70d26449461a48cd40a9417c7032e31b73e024f3c968e046c2d14fc31bf4b1318c9af2f8f6654a1c3139f513b408b7267dbfd0ef9ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFBF4.tmp

Filesize
132KB

MD5
cfbb8568bd3711a97e6124c56fcfa8d9

SHA1
d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57

SHA256
7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc

SHA512
860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

Filesize
1.6MB

MD5
431a51d6443439e7c3063c36e18e87d6

SHA1
5d704eb554c78f13b7a07c90e14d65f74b590e3a

SHA256
726732c59f91424e8fb9280c1e773e1db72c8607ad110113bc62c67c452154a6

SHA512
495d60ad05d1fadb2abd827d778fe94132e5bfc2ae5355e03f2551cd7a879acf50cc0526990e4ccde93bf4eff65f07953035b93cc435f743001f21b017cbfdfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f1csogy2.5d3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
a5a91ebb782f10ba08eb1880a7fc6798

SHA1
8e5663ae1254dc819edbb291d2ef7275d7510929

SHA256
a49907ca42963d92da4126376699d9d4b9c7f88f6c3af0e29bafb0a70871b909

SHA512
ba0446ecf45688e038b678b01928c7e98c229da3ce8a2491108025a9e5ba6cf540dd6f6bb07cb3e207ccabd96cbc62c6d1810ae1130ba3a8f03947b9de667490

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
3KB

MD5
ee75caeb148a75559ce30b90ea35040c

SHA1
793bd0e6e081e725abebbbd39be61dcd07c6ec23

SHA256
71499160e72757ddcd23a26cd0aab472201609c632ea2b54dea714033cb8fc9a

SHA512
11bea81e9fb60b735f8078d73ba9a3f9b2da22d2a6b42dd76e3035e994d5ae597e43ca491e4c8dca0cc2742c98f35614db8d42e4fc4b9356fbf21a1542a5a716

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
2KB

MD5
71e56322415ab0b2dc944a00aa903a1b

SHA1
7616d1e7b80f0b570610749cf7b965b90eb8d7dd

SHA256
2416f3f88105a67c689064a5ca4d50a4fac58a742393949d519b2bf935d3fc30

SHA512
341db4cb592518f373bad1f2baa256ae883fae6fc3875d29ff830fd2b7fdd5c944c38fb79888114182db2a6b88c2fe5c5077355bff3f52c849b2416561236645

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
16KB

MD5
db5636186446d4370679103881dd3c91

SHA1
dfb117054eaac4c0064ad1a427b97beb1535ef8d

SHA256
910d2931b4282315614ed6244417bd7120f1635689b8482076d2a8ade1a370d8

SHA512
337a96f591d0551fdd5c94eaa5f7623b1f5da124ae9be36d1f04e9bdad6ea4bf6108a1a6f5e9d0045c72c4271565651a6e9506ecef5deb51f01cb2f2f694169d

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
1KB

MD5
9685f7f3ad6bb8ccb0881a3185e63dfe

SHA1
b40c7875507ce73a9934ca2032f9fc968cd9b2d1

SHA256
5d8ed5d56ee6791fb99366137280205186d1edcabbdfdb4504048491950c3460

SHA512
53a200bb5e3a6615b1c72e0e6e55c11b91cee111264d7289ac6c8f64c54f84b052430d8a30ee91c6810e2b833e9487608adf8cf0bfd3310aa0b50d4ed24ebdb0

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe59de6f.TMP

Filesize
1KB

MD5
c54c3e221b080f606f20e7aa8677eab8

SHA1
ecd0f0a3f2ce3b3563c8a2530b184187b34e37e2

SHA256
33e10944b0c545e3501d08752251110f03886ec147cc3a13c817c2b0bf92650f

SHA512
e55c974d7aa98e8290a8f747471068023f10353a4f8896293b01bc5f8b4eda65b67dc67d01cea33be41de61c47cdf6d77f2c44665492bfcc54073449ba50d6b5

Download Submit
C:\Windows\Installer\e5851a5.msi

Filesize
5.0MB

MD5
8cb1e85b5723e3d186cc1742b6c71122

SHA1
f4638a9849b2bea46c8120930c7727cfae70b4d2

SHA256
f1db224af0f14b971ba8be3e33482322b2f821695a4bbe2782b956217da383ad

SHA512
b447f7b4e6590120ed50eaad798b271e7ebbe52ad61dbe5e621e0c99a6314fbcfd10ce8e6f837a7ca76e1084651c65dcb0eafcdac6cce6eebe2d1729249add5b

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
2c87848e41ea20bf393010e154a2d29a

SHA1
da64a9ef1e6329d5e888477d92efe6aec1532753

SHA256
294147e3c38b3cae5a1dd5eb0bc3b460b20d9c3baaa00baf73285e9dd46277cc

SHA512
79600e3b59783919ceb69744e5441484bd35fa11aeb220211da62a3a56bec9b866cb99fb1ca92f8a6d257f4e0fb37682ced31b1d6777f407fd660b39e18dd27e

Download Submit
\??\Volume{625ed6c4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{bde5b453-61ec-449b-8441-aef8dac9a208}_OnDiskSnapshotProp

Filesize
6KB

MD5
91376640fc9319956fa3b11e555ac14a

SHA1
90aa81a8cbb277893dee069b11241f5e84998390

SHA256
58aecfff9626ecb6bb083c78de69a7274391236f092f996a061fc24c32269bab

SHA512
4a437e7d2a12d9dec649adf3fc99568bec693f24bdb82b6b97a158c95791615c87d64052f3232a18c1a3a22ceb1c98947a388cb586ff689abeba560b7313ad43

Download Submit
memory/1060-58-0x000001ABCA700000-0x000001ABCA722000-memory.dmp

Filesize
136KB

Download
memory/1992-386-0x00007FFA8F4B0000-0x00007FFA8F4B1000-memory.dmp

Filesize
4KB

Download
memory/3404-444-0x00007FFA8F4B0000-0x00007FFA8F4B1000-memory.dmp

Filesize
4KB

Download
memory/3892-266-0x00000000740D0000-0x00000000742F6000-memory.dmp

Filesize
2.1MB

Download
memory/3892-327-0x0000000000490000-0x00000000004C5000-memory.dmp

Filesize
212KB

Download
memory/3892-310-0x00000000740D0000-0x00000000742F6000-memory.dmp

Filesize
2.1MB

Download
memory/3892-265-0x0000000000490000-0x00000000004C5000-memory.dmp

Filesize
212KB

Download
memory/4720-439-0x00007FFA8EBE0000-0x00007FFA8EBE1000-memory.dmp

Filesize
4KB

Download
memory/4720-440-0x00007FFA8F330000-0x00007FFA8F331000-memory.dmp

Filesize
4KB

Download