Overview

overview

8

Static

static

1

JJSploit_8...US.msi

windows10-2004-x64

8

Analysis

  • max time kernel
    1798s
  • max time network
    1150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-11-2024 20:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JJSploit_8.10.14_x64_en-US.msi

  • Size

    5.0MB

  • MD5

    9a5e4420fd429b7444e7f02b2b52d0bc

  • SHA1

    056e5ac7ef1334698f4337435985a2d6a52ae059

  • SHA256

    44ef9c095fdc078cad8648bc9ec75f744d2c72229ee427eac65fbc1859e57172

  • SHA512

    7728f89d67bf145106d7c86dd7a1ad27aac74898210bd86d944d7a9111c41fb3df1ab2acab5a4d5bd9cf1a6dd66d9b460368c7994bfbe8807e4c21ae142f8f5e

  • SSDEEP

    98304:461sCoKXIA5gnPoEcXGwMKDHLG/mJhYheaVyvF9bmgDMjPjV+H7nHNjC3v8m:4XCXIkgP7cdPG/05bmgAjPh+7HV

Score
8/10
adwarediscoveryevasionexecutionpersistencephishingprivilege_escalationstealertrojan

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
    persistence
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 26 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Executes dropped EXE 56 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 5 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\JJSploit_8.10.14_x64_en-US.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3116
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D89BAC598963B6BB019FB5A607ED3BAB C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\Program Files\JJSploit\JJSploit.exe
        "C:\Program Files\JJSploit\JJSploit.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:676
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=676.456.12926193796156721291
          4⤵
          • Checks computer location settings
          • Checks system information in the registry
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4928
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=131.0.2903.51 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffa21726070,0x7ffa2172607c,0x7ffa21726088
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3300
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1828,i,7186143607513075163,4327010583050181604,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:940
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2020,i,7186143607513075163,4327010583050181604,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3668
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2324,i,7186143607513075163,4327010583050181604,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3632
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3416,i,7186143607513075163,4327010583050181604,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4600
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4692,i,7186143607513075163,4327010583050181604,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:852
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4852,i,7186143607513075163,4327010583050181604,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4560
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=752,i,7186143607513075163,4327010583050181604,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4436
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2172,i,7186143607513075163,4327010583050181604,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4404
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4984,i,7186143607513075163,4327010583050181604,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3852
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4988,i,7186143607513075163,4327010583050181604,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:4932
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4360,i,7186143607513075163,4327010583050181604,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=936 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2596
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4292,i,7186143607513075163,4327010583050181604,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4944
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4260,i,7186143607513075163,4327010583050181604,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4372
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2460
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait
        2⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:968
        • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2120
          • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
            4⤵
            • Event Triggered Execution: Image File Execution Options Injection
            • Checks computer location settings
            • Checks system information in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4704
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3332
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:4628
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies registry class
                PID:3476
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies registry class
                PID:4872
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies registry class
                PID:4720
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUExQjA5MEUtQkRDQi00OTA1LThGMzctQ0M0NjAzQTVFRDZFfSIgdXNlcmlkPSJ7MjQwNUFDRTItRDc2RS00RUJBLUJENTUtMDlFRENGQjRFOUMzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFODM4QUNGRi05OEExLTQ0OTctOUY5MC0yREI0MTQ4RjMwMjN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjMxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjQzMjM5MjQ4IiBpbnN0YWxsX3RpbWVfbXM9IjUzMSIvPjwvYXBwPjwvcmVxdWVzdD4
              5⤵
              • Checks system information in the registry
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2128
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{AA1B090E-BDCB-4905-8F37-CC4603A5ED6E}" /silent
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1052
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1480
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:2844
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUExQjA5MEUtQkRDQi00OTA1LThGMzctQ0M0NjAzQTVFRDZFfSIgdXNlcmlkPSJ7MjQwNUFDRTItRDc2RS00RUJBLUJENTUtMDlFRENGQjRFOUMzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QjVDNzVCQkYtQTVDNi00MTMzLUI1QTQtMzM1QTcxQTNENzk5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNDIiIGluc3RhbGxkYXRldGltZT0iMTcyODI5MzM2MSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzcyNzY2MDczOTE0MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyNDg4NjQzMjQiLz48L2FwcD48L3JlcXVlc3Q-
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:216
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D22F4AB2-0706-4C7B-8D59-F517EC514E34}\MicrosoftEdge_X64_131.0.2903.51.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D22F4AB2-0706-4C7B-8D59-F517EC514E34}\MicrosoftEdge_X64_131.0.2903.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D22F4AB2-0706-4C7B-8D59-F517EC514E34}\EDGEMITMP_27E6F.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D22F4AB2-0706-4C7B-8D59-F517EC514E34}\EDGEMITMP_27E6F.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D22F4AB2-0706-4C7B-8D59-F517EC514E34}\MicrosoftEdge_X64_131.0.2903.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
          3⤵
          • Checks computer location settings
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1708
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D22F4AB2-0706-4C7B-8D59-F517EC514E34}\EDGEMITMP_27E6F.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D22F4AB2-0706-4C7B-8D59-F517EC514E34}\EDGEMITMP_27E6F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D22F4AB2-0706-4C7B-8D59-F517EC514E34}\EDGEMITMP_27E6F.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.51 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff6f90c2918,0x7ff6f90c2924,0x7ff6f90c2930
            4⤵
            • Executes dropped EXE
            PID:2656
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUExQjA5MEUtQkRDQi00OTA1LThGMzctQ0M0NjAzQTVFRDZFfSIgdXNlcmlkPSJ7MjQwNUFDRTItRDc2RS00RUJBLUJENTUtMDlFRENGQjRFOUMzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDN0NFNzU2OS05ODA1LTRBQjktQTZGOC03OEE5MTQwNTJGMzN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuMjkwMy41MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTI2MjYxNDEzOSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyNjI2MTQxMzkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NjY2NTIwNjc0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8yNmQzOWY5Yi0wMmUxLTRlMjctODRlMi1iNTRiMjRkYzY4M2U_UDE9MTczMjU3MTQ3NSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1DZjQ5ZEJvOTdnMjJ3ZjU5Ynl2cjJ5aW56M1FDR1I5JTJianB0NDVwSDBRU0NkY3hwR3VEOUZGcVQlMmZ1dUdWYnMxY3Z2SERSZW8yM3FGYUx3bGt3ZXBEMlElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzY2MDc4MjQiIHRvdGFsPSIxNzY2MDc4MjQiIGRvd25sb2FkX3RpbWVfbXM9IjMzMzc1Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTY2NjUyMDY3NCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU2ODI5MjcxMTAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjYyOTkwMjExMjEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI4NTkiIGRvd25sb2FkX3RpbWVfbXM9IjQwMzc1IiBkb3dubG9hZGVkPSIxNzY2MDc4MjQiIHRvdGFsPSIxNzY2MDc4MjQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjYxNjEwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:2044
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1392
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:3516
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C99340DA-30BF-405A-BB19-8FD7793C7359}\MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C99340DA-30BF-405A-BB19-8FD7793C7359}\MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe" /update /sessionid "{D56E5E25-1BA7-4462-A246-97E2AB1DBA77}"
        2⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1192
        • C:\Program Files (x86)\Microsoft\Temp\EU3338.tmp\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\Temp\EU3338.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{D56E5E25-1BA7-4462-A246-97E2AB1DBA77}"
          3⤵
          • Event Triggered Execution: Image File Execution Options Injection
          • Checks system information in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1588
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:2136
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:2888
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"
              5⤵
              • Executes dropped EXE
              • Modifies registry class
              PID:4868
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"
              5⤵
              • Executes dropped EXE
              • Modifies registry class
              PID:1452
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"
              5⤵
              • Executes dropped EXE
              • Modifies registry class
              PID:5040
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDU2RTVFMjUtMUJBNy00NDYyLUEyNDYtOTdFMkFCMURCQTc3fSIgdXNlcmlkPSJ7MjQwNUFDRTItRDc2RS00RUJBLUJENTUtMDlFRENGQjRFOUMzfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7NDY4MzA4QkEtNjdENi00Q0QyLTk5OEMtRjkxOUQ2MDU0RTZFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O2xoVmkxMlFjazZTbDB1VTFPQjZZMTUyOWJSNmJzZXk0K2N1N2RIeHM2Y2s9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xOTUuMzEiIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjM1IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGV0aW1lPSIxNzMxOTY2NjcyIj48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NDU0ODgyOTgzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
            4⤵
            • Checks system information in the registry
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:4372
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDU2RTVFMjUtMUJBNy00NDYyLUEyNDYtOTdFMkFCMURCQTc3fSIgdXNlcmlkPSJ7MjQwNUFDRTItRDc2RS00RUJBLUJENTUtMDlFRENGQjRFOUMzfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins5MDgxODk3Qy0zOTQ5LTQzQTEtQkJBNy0zRUE1RjkzOEFDNEV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7bGhWaTEyUWNrNlNsMHVVMU9CNlkxNTI5YlI2YnNleTQrY3U3ZEh4czZjaz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4zMSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMzUiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iSXNPbkludGVydmFsQ29tbWFuZHNBbGxvd2VkPSU1QiUyMi10YXJnZXRfZGV2JTIwLW1pbl9icm93c2VyX3ZlcnNpb25fY2FuYXJ5X2RldiUyMDEzMS4wLjI4NzEuMCUyMiU1RCIgaW5zdGFsbGFnZT0iMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODMwODc4OTQ0NCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MzA4OTQ1NTQ1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NDM1ODIwNzYzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNjhkNTc3YTAtMWY0YS00MzRmLWJkY2UtMTQ4ZWRjMWU0YTQwP1AxPTE3MzI1NzE3ODAmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9YW42WXBhT2NkSWxIY1ZUbExkZVdwbUZ3cGREMWlIU3JBZzByMDJqUUw5Qko0QkVOOG80Qlp3UFZwTmEzRnZrRUdsYWFkcHRQb3BKbmJ5TzU2U0NZR0ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMTYiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODQzNTgyMDc2MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNjhkNTc3YTAtMWY0YS00MzRmLWJkY2UtMTQ4ZWRjMWU0YTQwP1AxPTE3MzI1NzE3ODAmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9YW42WXBhT2NkSWxIY1ZUbExkZVdwbUZ3cGREMWlIU3JBZzByMDJqUUw5Qko0QkVOOG80Qlp3UFZwTmEzRnZrRUdsYWFkcHRQb3BKbmJ5TzU2U0NZR0ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNjM1OTIwIiB0b3RhbD0iMTYzNTkyMCIgZG93bmxvYWRfdGltZV9tcz0iMTI1MTYiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODQzNTgyMDc2MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NDQwOTc3MTIxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PHBpbmcgcj0iLTEiIHJkPSItMSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpc19waW5uZWRfc3lzdGVtPSJ0cnVlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNzI3NzE2MzAyNTQ2MDUwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ii0xIiBhZD0iLTEiIHJkPSItMSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMzEuMC4yOTAzLjUxIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2NTMxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNzY0NDAzODUzNzEyOTgwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ii0xIiBhZD0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9Ins1NEQyMDdCRS1GNDM5LTQ1ODEtQTBBMy03MDI2MjRCMzU4Mzl9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Modifies data under HKEY_USERS
        PID:3844
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3156
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:4188
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{50A34E98-C619-4538-8101-E9BB7CA8915E}\MicrosoftEdge_X64_131.0.2903.51.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{50A34E98-C619-4538-8101-E9BB7CA8915E}\MicrosoftEdge_X64_131.0.2903.51.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
        2⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        PID:4308
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{50A34E98-C619-4538-8101-E9BB7CA8915E}\EDGEMITMP_F5989.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{50A34E98-C619-4538-8101-E9BB7CA8915E}\EDGEMITMP_F5989.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{50A34E98-C619-4538-8101-E9BB7CA8915E}\MicrosoftEdge_X64_131.0.2903.51.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Installs/modifies Browser Helper Object
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Modifies Internet Explorer settings
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • System policy modification
          PID:452
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{50A34E98-C619-4538-8101-E9BB7CA8915E}\EDGEMITMP_F5989.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{50A34E98-C619-4538-8101-E9BB7CA8915E}\EDGEMITMP_F5989.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{50A34E98-C619-4538-8101-E9BB7CA8915E}\EDGEMITMP_F5989.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.51 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff61f0e2918,0x7ff61f0e2924,0x7ff61f0e2930
            4⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            PID:3140
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{50A34E98-C619-4538-8101-E9BB7CA8915E}\EDGEMITMP_F5989.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{50A34E98-C619-4538-8101-E9BB7CA8915E}\EDGEMITMP_F5989.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
            4⤵
            • Drops file in System32 directory
            • Executes dropped EXE
            PID:3984
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{50A34E98-C619-4538-8101-E9BB7CA8915E}\EDGEMITMP_F5989.tmp\setup.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{50A34E98-C619-4538-8101-E9BB7CA8915E}\EDGEMITMP_F5989.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{50A34E98-C619-4538-8101-E9BB7CA8915E}\EDGEMITMP_F5989.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.51 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff61f0e2918,0x7ff61f0e2924,0x7ff61f0e2930
              5⤵
              • Executes dropped EXE
              PID:4352
          • C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:1400
            • C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.51 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff605aa2918,0x7ff605aa2924,0x7ff605aa2930
              5⤵
              • Executes dropped EXE
              PID:3296
          • C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
            4⤵
            • Executes dropped EXE
            PID:3236
            • C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.51 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff605aa2918,0x7ff605aa2924,0x7ff605aa2930
              5⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              PID:2120
          • C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
            4⤵
            • Executes dropped EXE
            PID:4868
            • C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.51 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff605aa2918,0x7ff605aa2924,0x7ff605aa2930
              5⤵
              • Executes dropped EXE
              PID:2604
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTU5RjcxMTQtMzhCMi00NTBELUEyNzEtRTlGMjk5OUFBOTQ0fSIgdXNlcmlkPSJ7MjQwNUFDRTItRDc2RS00RUJBLUJENTUtMDlFRENGQjRFOUMzfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins5ODFDMjA5MS02MUE2LTQ4QzQtOTA4NC0xNzlERDIxMDM2RkF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7bGhWaTEyUWNrNlNsMHVVMU9CNlkxNTI5YlI2YnNleTQrY3U3ZEh4czZjaz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4zNSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJJc09uSW50ZXJ2YWxDb21tYW5kc0FsbG93ZWQ9JTVCJTIyLXRhcmdldF9kZXYlMjAtbWluX2Jyb3dzZXJfdmVyc2lvbl9jYW5hcnlfZGV2JTIwMTMxLjAuMjg3MS4wJTIyJTVEIiBpbnN0YWxsYWdlPSIwIiBjb2hvcnQ9InJyZkAwLjczIj48dXBkYXRlY2hlY2svPjxwaW5nIHJkPSI2NTMxIiBwaW5nX2ZyZXNobmVzcz0ie0UxNzlBMkIzLTcwMDctNDMyQy04MDk2LThFMjJCNkEwOEM1N30iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjciIG5leHR2ZXJzaW9uPSIxMzEuMC4yOTAzLjUxIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM3Mjc3MTYzMDI1NDYwNTAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNjMzMzIwNjgyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNjMzNDc3MDE0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNjY4MzIwNjk1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNjg1MDM5OTg5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjIxMjg1MjE3OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjEwNTkiIGRvd25sb2FkZWQ9IjE3NjYwNzgyNCIgdG90YWw9IjE3NjYwNzgyNCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjIiIGluc3RhbGxfdGltZV9tcz0iNTI3ODIiLz48cGluZyBhY3RpdmU9IjAiIHJkPSI2NTMxIiBwaW5nX2ZyZXNobmVzcz0iezc4NDIxRTJGLTM5NDItNDA5NC04QTBGLThCMUQ1RDc1MkQ1OX0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTMxLjAuMjkwMy41MSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjUzMSIgY29ob3J0PSJycmZAMC42MiIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzc2NDQwMzg1MzcxMjk4MCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjAiIHJkPSI2NTMxIiBwaW5nX2ZyZXNobmVzcz0ie0NFQ0VFQjc0LUE1NzYtNDg2RC1CQzU0LTU1MzEwOUM5MTAxRn0iLz48L2FwcD48L3JlcXVlc3Q-
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:3988
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
      1⤵
        PID:1208
      • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
        "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2744
      • C:\Windows\system32\wwahost.exe
        "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3724

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      PowerShell

      1
      T1059.001

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Active Setup

      1
      T1547.014

      Browser Extensions

      1
      T1176

      Event Triggered Execution

      3
      T1546

      Component Object Model Hijacking

      1
      T1546.015

      Image File Execution Options Injection

      1
      T1546.012

      Installer Packages

      1
      T1546.016

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Active Setup

      1
      T1547.014

      Event Triggered Execution

      3
      T1546

      Component Object Model Hijacking

      1
      T1546.015

      Image File Execution Options Injection

      1
      T1546.012

      Installer Packages

      1
      T1546.016

      Defense Evasion

      Modify Registry

      4
      T1112

      System Binary Proxy Execution

      1
      T1218

      Msiexec

      1
      T1218.007

      Credential Access

      Discovery

      Network Share Discovery

      1
      T1135

      Peripheral Device Discovery

      2
      T1120

      Query Registry

      7
      T1012

      System Information Discovery

      7
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      System Network Configuration Discovery

      1
      T1016

      Internet Connection Discovery

      1
      T1016.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Config.Msi\e5830d0.rbs
        Filesize

        21KB

        MD5

        4b9140308bbe579ddb1f45fc53b969a1

        SHA1

        2c4a8ddff07dd45fbc75fd6003872554b3e38087

        SHA256

        c2543fddab541beabceb14ea7632a0227d1f7db077450dd5030e4ccc4bcd1043

        SHA512

        4030ad79c6d37d5d08af857cebe799e9359120d49434633dc55d7691565921433228a29083876bb9c1f7f8ec0e59c1df38b435384dd460ef9593baaed84d8724

        Download Submit

      • C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Installer\setup.exe
        Filesize

        6.6MB

        MD5

        e8ecc691b6b345c25ea749591911d934

        SHA1

        b54f8b8ece5c4221c4180edfdef39df38a36ba21

        SHA256

        e226aafcb47b85afe8962b885921dd982bbeb356ddd1c66e5a6f42be80dd052a

        SHA512

        9364268b3e7333a6d52e3ab1eedb15c9cee98d5139be0708790275ef05abba12f32c2a39546b4c81f799d7ee662d5f705af9de28b0fca12a64c72ebcccd4f066

        Download Submit

      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.35\MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe
        Filesize

        1.6MB

        MD5

        dc1543edd0dcd56536304bdf56ef93f1

        SHA1

        1a8b2c7791f2faa1eb0a98478edee1c45847075c

        SHA256

        ccbb3d9a4877999a55b2ca6b8128481e91c4b56780f581226f916c0fb2db0772

        SHA512

        2a6b4aa39bc3e4d234909077d5c6d75b9968c1778d505cc12431afd7aebd01eb65ed2f6f0c53c67f18eed7e97b67a93bab8c44574e3918ccd5cfcd8681767056

        Download Submit

      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{50A34E98-C619-4538-8101-E9BB7CA8915E}\EDGEMITMP_F5989.tmp\SETUP.EX_
        Filesize

        2.6MB

        MD5

        60c4164e5d4cc0649649b1241a5a14f6

        SHA1

        748d85cca4cbcd2fc5949cd5f23382a57d346091

        SHA256

        e26afbe1b5a10139c66c4950d86d357766aafb8521abfd85b525dc2348962c29

        SHA512

        f3b3337dcbc3a1b6b02420b26f6c496bd9bf01da45593e23b4a50b7be02f27e1a5b506236b097c69ce5cee90430ce677780007b7a768117912cd5b85bdbc9339

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\EdgeUpdate.dat
        Filesize

        12KB

        MD5

        369bbc37cff290adb8963dc5e518b9b8

        SHA1

        de0ef569f7ef55032e4b18d3a03542cc2bbac191

        SHA256

        3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

        SHA512

        4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\MicrosoftEdgeComRegisterShellARM64.exe
        Filesize

        182KB

        MD5

        1723c5e707061e59d769c492a95d5083

        SHA1

        3b535b7a0df2f7a4ab5e531956dad9892adfb5e9

        SHA256

        e97ab6dc0ed865aa8606f5c113fd62170341d1a3d63d5618f233aea969ec49ab

        SHA512

        a4e3bd9ec331a27338c123a9a3ae23619fc5a5b80fc9aea38d23d3b82ca015f47669e0f3e1a6f98e7f464e6bc21e92723a04f72805e45e0dfc81540a2d299a8a

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\MicrosoftEdgeUpdate.exe
        Filesize

        201KB

        MD5

        35a79bd6de650d2c0988674344bf698b

        SHA1

        a0635c38472f8cc0641ceb39c148383619d221dd

        SHA256

        a79a81da2b8dcbe39609a9e1b4e8c81ae0bc54195c0c854b77bebe7bfa7f10c1

        SHA512

        afe33d38785afe489845654ba1c3ed6648b36b1ebe5f98b3d5d4bf24eba3af9bb6676af5a79d2ec570bf2b4b6ae40d14fc3d4b872c5d4577aea40f6d1a26c0cf

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
        Filesize

        215KB

        MD5

        c55b37823a672c86bc19099633640eab

        SHA1

        da5e15d773c794f8b21195e7ad012e0ed1bceb72

        SHA256

        3df9cd2fecf10e65be13d4b61ca0a9185845f2cb04b872adeaf41ca46af39aa0

        SHA512

        1252c3fde4aa4ce239103e8df7224afce093a2cbe539bd40347601980a314ea3326ea6ce4c1ebc845c125845969ad65ebca319b9df35a809ef871bad14aaf33d

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\MicrosoftEdgeUpdateCore.exe
        Filesize

        262KB

        MD5

        dd30f3ff486b830211df62d20348f86f

        SHA1

        08c7d7407dee7ed20b50e8f1a2cb1b08a9282dbf

        SHA256

        9d57bdc8b97e75f8a04b93a1657dfd18d4e2f68607783c9bca42140233978fa7

        SHA512

        af3b48ced7018c7edeabdfa998e51356d57c2d7a846c76629fed0ff2e5db8db79041184c58a5a67a10ec627f53af8e3c80bbffacaecf5dae6d989cecb82e72e4

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\NOTICE.TXT
        Filesize

        4KB

        MD5

        6dd5bf0743f2366a0bdd37e302783bcd

        SHA1

        e5ff6e044c40c02b1fc78304804fe1f993fed2e6

        SHA256

        91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

        SHA512

        f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdate.dll
        Filesize

        2.1MB

        MD5

        39ac5a029f87748e964491b97936d890

        SHA1

        24777aad794a13d0e7381fc6f32f0e1bcdb1ba80

        SHA256

        ba861524fe648ccb47b7ac57421bb07a6231a7aab5eaea332548511cce6185bc

        SHA512

        2ecb9b208846f84cd37f37d2100f26358d6c37128efc4010b2e7efc10202dc37b621d0c0138a8b76b23d968da324c685a41b44f4ae30cbbe243581f1904e14c6

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_af.dll
        Filesize

        29KB

        MD5

        2a9524cf8afae49394379d9d9be69206

        SHA1

        e43d4146f8abebbb30831fbd39a39846bfb7eeef

        SHA256

        e5a08731963e681b6386c4e85c16bc98452ebc13c4a7de3ff6979125c609d5f0

        SHA512

        a0111589960cbdcb10b55c17aa82555e44f0f0f173ebad09de6364881138cb35280596f1de6d86b31044427445575630c22079c3585e34729ce461599b8979b1

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_am.dll
        Filesize

        24KB

        MD5

        1903bc250fc269e79c9f7aada2979aff

        SHA1

        efbf76b1259217c02c138078c56f36b2cb8543ab

        SHA256

        228fa3e2fcacc78111a8152d6862de2302c024e81cc8b5e3f16e31caf96cfd04

        SHA512

        9db527c2e26ef691c089f5d1d010298e0f47e2e0420fba03ed18c7c2793b92c5860240b214b5233dddbc150413a2649e9cf4823239b9831930c2804b143ab538

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_ar.dll
        Filesize

        26KB

        MD5

        b4c28669b9d4e56b094af6062f4db065

        SHA1

        4c492c03138c8a796cf0673866892b9e0c2073ec

        SHA256

        7fe494dd265f99f330b153ef69c51c0541016755ca1876788f7f0ede78f9cedb

        SHA512

        35941ab6f2dcf5f60824d172f75f9f7b8b93e65c7bd8bc441fc32e49cbb414a68d65a02e3479b096f728b2a34d3e85dfd868e8bf95ff9b1a57d10adc3da0022a

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_as.dll
        Filesize

        29KB

        MD5

        16b0c8a664626da016a95fb46fdc9c0e

        SHA1

        c674b635cd8927511825847f3d86a5562b4155d7

        SHA256

        b059fc9713d3a41e9a83f0d61f8cce29546d3759def0a7b8e162a13915e51255

        SHA512

        ec39269fbd9e510d10d665c86b8a8161208b74f919e4fd128e365144d71f2b59d3c48c50b8f017b1d30c711ee4f63668f843539957b4643d2a488c9e17290e75

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_az.dll
        Filesize

        29KB

        MD5

        bf510bb9b7639af7da969f77620b480f

        SHA1

        17a6693a5d6aea1f3fa6f34abc46daf558cac645

        SHA256

        2507da222cf6c6dd608da9b569f89f8e11c47b6e16134c767cdc23b7c1f56bd3

        SHA512

        6cebe80005cb7759ee4fd8dd9ca41bdd073c01e969e1ebe03cb07616921e50516974019faacc2f9dcaaccdc0044eaae57a6a94f3a4a4ce044a781cd8091478a7

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_bg.dll
        Filesize

        29KB

        MD5

        4b23c7229eb43740744cfbf48c4242ca

        SHA1

        4938dcf6239e14db53c8f085d3c477905a9986af

        SHA256

        a7527b867ebc222114b679b2ac542cdc46a75f8bc24e5ca8b7ebc17b7a2963c2

        SHA512

        4bd8ed0ecacd3f2c69dcd0789ab8ee10dcfd6144b019dd8858c2234bebddfe42c83037fb8e2f934f3320f58796683bed5ab050ba897ba1fa409b6df60f02ec53

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_bn-IN.dll
        Filesize

        29KB

        MD5

        1e038b27661b303e15a39a55305e86bb

        SHA1

        35b48fe72d50406063f9145fea64c57f205f0084

        SHA256

        385665137d0dfee16ed8ef2da5ce28d826d210eb2bde1fa4ef13dac50e4b5364

        SHA512

        13fcfde6923b38acc2cfa530087d13725a2cabdd2e771d503f4d2f5cff93e8744f142e235dd484244d920d80cb3e7cecbbd731b473f6e509edb39159c51e9465

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_bn.dll
        Filesize

        29KB

        MD5

        9afe531b6472cf9eb66028e9638584bb

        SHA1

        6212292867bd59fe376e79988c07f4db8ad26cdc

        SHA256

        383754fc147dc6ef5f1edd14b60bab6bebf32639dfea718aaa64b2b65ac98812

        SHA512

        352bec509ccd3ad15a274ddd3ccea43b76eaed885b0e7722235abd95aab8fec1c645722765d76865c1b32ed422a10e6666f220e3abcc5a24268ba94c5cc6b8d8

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_bs.dll
        Filesize

        29KB

        MD5

        5e06d311c2e24b94f378c4d3b3deb260

        SHA1

        ef7df63f63746eb197c21694ebb21cfb86c0b2b8

        SHA256

        d2052450e3a3272b302d80af9f2c46b766153267100bc902dcf03a78ec609b65

        SHA512

        8d73b5265735aa19116cf41bb8d2bdacde5b22b286a56af58068f9579b631b044c155e625f6e1fda12e505f621f245faebe126c2557dd2ec873d7d980f8ba552

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
        Filesize

        30KB

        MD5

        afdafc9f56401b662f42cef830d92b38

        SHA1

        b56966370ec07cd676e35d93fad001e0f6b3fb8a

        SHA256

        03d7a1c0d8810df4b908fcc40c8491df0e3ce19db8ee22e6be79d02fd9df8f72

        SHA512

        884f9cd99785ea91c5c8e26200bbf0b010ff278b52c5ac590cb73712321a9cdb645e5448bf4cf62622cdb06543b8de4a8e6956a2f6b6677c0b9befb35589d8b0

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_ca.dll
        Filesize

        30KB

        MD5

        15ee7526536790bf77317975896542f9

        SHA1

        365bc54203b490daa0e24a1c9813d5d99c9de720

        SHA256

        5e2349af6e02da1c5d18f1b3235fc5099229d2d99e1c5cf2713c21472c151f8e

        SHA512

        475fd9c0879c8cbc418a66441e3dc026fca983327a95763eddd1537c1f44fdf272d212c69e1b06aad55d91c68379a2beafb2908659d58a61c740731a7d047406

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_cs.dll
        Filesize

        28KB

        MD5

        8eff4531519a4b768005b9411d4a5f9c

        SHA1

        59b354e3f32f0a0da8755c27b903803994f4aa31

        SHA256

        2e9a230a8b8a7fa437a28e2115ebf01178f3209fc0d61eb90160f49c11a16cb0

        SHA512

        4426ae1e2937e1f6c7364d2f437aeb83d834f9997d28cb1ffb07fe1c448dd954083aa822ff439c886249a387823a23245640a0425dd8c42b75b73912733f11ee

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_cy.dll
        Filesize

        28KB

        MD5

        11b92ae8fe94c784480d465a37935766

        SHA1

        f4ead29d4b20c57bb0e4d16a7488784f61a25972

        SHA256

        571b0cf8b0383e33393b8b8fa79d1632688ffc2bdde794fff62c85f5e1a3f161

        SHA512

        b636dec2e1d48916d0c83d2fe45eb24d826c027455cf22ec78e013166e59fbdb4780ebe69de3ab4b5730dae03652d253890917f53fc835aa73f9f75b01dc4f23

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_da.dll
        Filesize

        29KB

        MD5

        19a7aee0daf68fdc1a24e3228a8bf439

        SHA1

        1fc6ce227a11245787c80f3932e2c311de2d44bb

        SHA256

        409cce12be8b7a86313bd1d9e3c6d9154cf0c5735db61d94852a128a746dab99

        SHA512

        0051119311316d29dbc13ace84c24283aa2eaf1d46459c81ba7b31cc6178b43165618fd7bec17de698b1431ef2b33be179c2c8b1537c1000aadf849e2c888c84

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_de.dll
        Filesize

        31KB

        MD5

        ce66ef1a806c21949b75055f81cac760

        SHA1

        3719e4af114a3c0baceb133d152a02bc6a1fb9f8

        SHA256

        23f5414d554b96db0b93c7dbe27939d294b8061e56c19ab74d59fe9135e81c8f

        SHA512

        04d9575c866ac28db490a291be3da41f884d3ceadbc9b7077776ea7deb1819277aadcf9c9e1b5afede3e90bafbcb00e6ef0840166228d153be7e8d8d53975593

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_el.dll
        Filesize

        31KB

        MD5

        09cf47260852ff7b2c91c65d127b9314

        SHA1

        b3d362f3d08f81bd1b719a1c94b54f5f9c9610da

        SHA256

        eb4344676280f83e6023ddc604ffa42e96eb46e765a216fbc5ecbe49ddb3c920

        SHA512

        114a21296d8e7e054906139102617e6cd6008337a0877053721553cfed10183f54f890c8071b1cea17bd0b2535589af7aafe5bd1d161886ad7363f89919d7300

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_en-GB.dll
        Filesize

        27KB

        MD5

        39dc20ae50a0e2ba9c55dda91256b3cc

        SHA1

        464139f11db3fd6ae77502b183c4b59f581d6c7a

        SHA256

        e1891a155be133e6dd82cab3f9437bb7f047f0f80689ca724ca4d1d90d1fef14

        SHA512

        08b8e19528ff007b904f55872935e0de9e06e7cbcb3f3ed751264e3e20a740b477b55c818bf2b0ed213c4ed9cbaba0c8953c19f427be3e8ab8f50c9c86a74bf4

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_en.dll
        Filesize

        27KB

        MD5

        894b6ea4b49fa390bd70167a75f3ff7b

        SHA1

        4f834ef6567d02f28390d63c8ca9fd3c735b2140

        SHA256

        a8dc2b1e32d8d3d2c321c469eed3329f7661f4fc71d14696f97106b5aa6c532a

        SHA512

        9b4fcbd07dc7f65c34575aaabb7a517198739f7268133f084b101edf99f0b96387f3f0248de1be5252b2466db0bc59036d40e3990d4264bfab89aa01aace7ea6

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_es-419.dll
        Filesize

        29KB

        MD5

        bcafbabbfc8f810220b2ebdbb8a76d19

        SHA1

        58703c8355f996f2ce8ae5fd1ce4dc29318fd414

        SHA256

        7fef9c85b5d7dadf344ff39d82794ed252066cceb2b6531be2a45ee3d84844b7

        SHA512

        b02820c3088ceae9ebf19ede77e3a406483a3dc13c030860d3818e6e8a163e9f54293fd058ec9575c196d12f1465211ab7feff145faf684be6a8cc251d1c0d71

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_es.dll
        Filesize

        29KB

        MD5

        3ccb8eab53a0b4c93507bf2adff6ced5

        SHA1

        25fa2435e97bd0e1cf986a882ce33e68f961c139

        SHA256

        8bcbd325374a8cc5c1c7ea774382515316473c200baec86a65ae21073fae33b0

        SHA512

        4f443ded84d74e150a0be3c32edc734ca01298817933a7b1f0e5c5cd93f26987f051c4c306848301e688b9334d134a12bcdcc0ceabe1fcaaca5c4d307c697bfd

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_et.dll
        Filesize

        28KB

        MD5

        6b03eb5b302e72727977f2431ea7f30d

        SHA1

        ac5cab93d3c28e46f92d2719638c739c680cc452

        SHA256

        b5b51fe000e0e0ce42e8dbaf4b8343a5411e2e99440726c747196a02ed736137

        SHA512

        362e94f79b7726b277cc90c5158d3cc5a0a890bf32e11707f9901233414b3ff22816df78276afa67f0122fc7d6fc2d09dbb1fd8602e3a01f807f93b9423bb463

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_eu.dll
        Filesize

        29KB

        MD5

        ed883bbd9e4b3de4db68e356707f3e67

        SHA1

        e03dde660c15a614442552f8c4d2cc5dd8425fc1

        SHA256

        168eb27052a559561af3ed650bc170eb471e53f05b9065f0e229672d040ae1c7

        SHA512

        ae48fe344b2644380e56a95d98aeb0ffeff7ddf0c914f5d14ef518a4d40bb090fee9a7fd30f7178524bcdec1a2d8fc870b4b40d5d8437e3f2577320262236126

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_fa.dll
        Filesize

        28KB

        MD5

        ba417f44f7564f1aca70cca9166f3f44

        SHA1

        d8f064e25038e0076bffcd1a694b58063b7268d7

        SHA256

        56632098f623cbb58fadddc5c7a889fbc91954f661078501e62517709b8ba703

        SHA512

        c35ba956e92a2298268bb6ee7a753d6b7f94bdec96118c834f028a0fa45f18b67302b0e20a26d948d1720b04461d3074ae30003bb9028790d9d2d63cb80f4467

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_fi.dll
        Filesize

        28KB

        MD5

        7f47c9b9bc9488754579935209291c55

        SHA1

        470e590c6f5263a44b95abbd6d0c158fae326d21

        SHA256

        f0d8c44d909aed479b3e770b556eb3792c0d3ce247defff953a4dd9f7ce4cc75

        SHA512

        6f81ddd06f6a1c796bbf21143737bfeed8f9ca0ace82a4de00ccf79d7288586376439e0564f1cb128e5e585eaba122d406af8c3a6e3969efdadfe0cf65c3ed4b

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_fil.dll
        Filesize

        29KB

        MD5

        20134024ed75deda002dc0839b352f84

        SHA1

        e67bbd13a320d2b4413b283e165385c44a65ea0d

        SHA256

        425e0834cb73365cf78a233a5b139e1897961e5225e9cc92ab365b3efbe30d76

        SHA512

        7dbab9a85d852546ab8c30b3452ab8b200874eb3aac0c862bdaf5c90cc882cec11de536851693f8f115706448e3323c66affbdd7e65257395baf24a0208dc537

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_fr-CA.dll
        Filesize

        30KB

        MD5

        08b6c8f26644370c6dcbee63e4abf884

        SHA1

        e4981733831c4d31715cad1749545d21dc29acf2

        SHA256

        916b52a362fddae79461d1d07ff01fd3bb4f7b8916b263d62572a8ad420946d8

        SHA512

        31f074e494a372a1b961fa9c053b561bae9e52182866a538a734b7589cad550a42b1d88649262a7d265226288084e5ba65e9e1d6d32ffd9292258a9f65e236a5

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_fr.dll
        Filesize

        30KB

        MD5

        cf3ff14718b5e6125b956d6d9e897196

        SHA1

        041de2587e03f6c52dba60e9d2459ce33b263eb9

        SHA256

        d75ece04e40e34beaaf50cce0fef63e52918b5939c9c267fbfd1e6cdcb2a82fa

        SHA512

        551ed975b1afdc75f464bb742c30f239f9d18aa99bf9140ec0620c938629868b38a952041288244b6e2387748c16546a8fe55a664a9903577b8e484856583ac4

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_ga.dll
        Filesize

        29KB

        MD5

        3ca8dfe9af49bdde95188002ebd5f227

        SHA1

        d18d7af889c4d03ea417c09bc56069f3f697c547

        SHA256

        6577e1a60f0fa340dcb70dcf625c877fc9502d122744782708ede0c53ceb56a5

        SHA512

        a61ba9baa6d0116b769c4add55aefc99a360bf85be7986ab099a424ff7a39ccee18d946128e74e39283629b52aa14821f36fe338c0e17de29694fff5138590be

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_gd.dll
        Filesize

        30KB

        MD5

        d64f47e1971f1e9faba211ca984e550c

        SHA1

        6f4de57c6f174dd778788b138a9b25cf4725258b

        SHA256

        75fd1c674a460dcdafbbc1429a4c30c9ac28e58527c6f0797c3706012ec19e00

        SHA512

        722c9f1e5d27d6ac678ca13aa648aa22aaf1121b835fad5209ce3e482471724cf4920390f51c8df2d31c66898def51ad76b0c119f4de831011b56afead2fef7e

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_gl.dll
        Filesize

        29KB

        MD5

        31276d0895baff6976c94c549efbb47d

        SHA1

        4f0fe790cecc28823e6359fb3b78dde13cc17681

        SHA256

        d3bf99db747f3e6a2d541ecab380244c0a33ceef8655383d54e2daff37dc9a88

        SHA512

        413958104046b85772d4a32550ae3a7a3a50eb66dc35966554123bd9dd15fc7a76fa7511f6d2ac666d8a205a9b58042f68e2322189c2b34d372db6b180b70da8

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_gu.dll
        Filesize

        29KB

        MD5

        bb4a1f9374f1c3e0cbc4788a3ce1d4c5

        SHA1

        30667d6dbaa689db9a08b42acacdf68435dac46e

        SHA256

        bdbd0882aba924075c40de48fcbbe951ea6a937c0b85541fd6f1fa5701b8e655

        SHA512

        d0a5260ae123d4698e2f62fdcf97a73aa038b69b200508948185bb5de5f5edb50d6859c9e6e21e84145ceebc144882d0ed5723ce1486e805c26737358ae77504

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_hi.dll
        Filesize

        29KB

        MD5

        274c267b7ee544d36698b2db119a6929

        SHA1

        27377267ddc09060254033c4aa9916a60a254956

        SHA256

        ac843711f010925cfdd60c396baafc3ead08584ed4b1b3df57b0c975cefd039f

        SHA512

        f9073912e9c314efe60f36dd9b2bdb4b1475aadde18e82bec971c447293a4f8dce46abe625bb9cec4dc48280fce3cf3d8175054b70b4e440e89a8c072f4a505a

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_hr.dll
        Filesize

        29KB

        MD5

        ca9abf92edc001d3c0cea4c926bd004c

        SHA1

        740513a325a5c15376f4b1aea402e9c54155ab33

        SHA256

        d6d9e064773b121fbf224252ef6c7d64f239d6b5013c119738a8240cc047e346

        SHA512

        7171143ee05b0e03bc936fbd98d3a37c3763bc244ffd8ae85e3229b85e13ec6262c3111b93b3a067f3d82f5fa6b6f691438c0e148efd14606cdf5a850e474a7c

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_hu.dll
        Filesize

        29KB

        MD5

        df2764d7bf9bbc6d4e96301c928566b5

        SHA1

        1f9adfed63fff6cd144515e8a7fbf8c4131d2f65

        SHA256

        3dcf3b4acc066674418e30239406abf59b85f9a00ba2a0aa7ca33036caee6514

        SHA512

        8c1eec6d813fe2266f0e03ce72f504f355f720e0112527fd411abd5e7fea05dd4bfa3ee9a878c882c16e8cd30224727eabc5ab38bd85cf146b21547ade988391

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_id.dll
        Filesize

        28KB

        MD5

        c80c6530280315158443cd04f89e9169

        SHA1

        fb87a9ff3696f0acceee6c8f1e4fb40795a8ae7d

        SHA256

        52957587efb4d995597541656f38e0edcd4545acfd92e3b81cc72578839021de

        SHA512

        bee22709e362ade03cf385c9b09d321923cc17a9e7c227fef7717da7405ea7bcc63e6f18b5e3e18e9dc19d5b0d9d4cb32c8548d9f16803959eb13b1189df9815

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_is.dll
        Filesize

        28KB

        MD5

        28064f47523b575c20fc85733cddf487

        SHA1

        0c5583888be256c8e09a396e333ad158b5f87553

        SHA256

        0752855a2e2a69e0f969af6c31102db513dbc390583f07d5df60746721ada58a

        SHA512

        d96656335024e0228a18148de4d27f354fdc90b62f977042ac20199714ef50bad271a83547d6c6823ec03422a9b598828fdc3b0f1ae81c760a57a2d1f2a543b7

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_it.dll
        Filesize

        30KB

        MD5

        0da1fde56fc0bf63e17a891e99f559f1

        SHA1

        131d18d7329be3ff21c78a3921b88e910a3d5a68

        SHA256

        ba936fcce39c889a3cb41569f18019d99429a13e7dbd909d9d26e540ea650dec

        SHA512

        67aa088ea8c01b11874537ae59c150645b61072e4f2134719e833ca0c4c3cab835cb9c51bff97582280870227d99cfb72f3a0d2069f2a9a86a7f7dbaf29ad2d2

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_iw.dll
        Filesize

        25KB

        MD5

        d92167a825c73bd6246483bfa1787c8c

        SHA1

        0a96d89226f1e694275922e5e2640bca3d7e7020

        SHA256

        d477fce0f7fbbe9cf86dbfb724e28c617c8c7c5bea664974593fbf0c032e8019

        SHA512

        12401ac374d3050f9540a3df6fae71ff8466ed3df2bf007b52eaddfea0d549601b5756477c141fd596bd19367ad30a607160957a8ad1818ff34e6da4125e530e

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_ja.dll
        Filesize

        24KB

        MD5

        0ff69dde83bf61a768bc63870d687747

        SHA1

        622714cb8eac68b79021800f28f5874aa23176b5

        SHA256

        3a3a4d24498f0f533a5f5e4f1364e7e2a1f348dac95f649951131185c64d7bc7

        SHA512

        e1300b6f2dd5df3385c06fb43de5aa246f3f1da942e26b86023663e07b12104f0e74b2749d4ef2dd60cabfc8eadfe5f131a8bb5ba8fffd6374f9cd4635b4bc53

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_ka.dll
        Filesize

        29KB

        MD5

        67eb1378381ad4d1a450bd26fe51f5e3

        SHA1

        ae0655d07a4d0b049ed258de646199f9004963ce

        SHA256

        b2ecba67a708b9fc75fc4574b72218f64517dea1aeb5ac26400ac554903cccf9

        SHA512

        1da5356bee3e18f9033b81927368eefb8f7a0742f7f02be9ddf0f3f309d9d4f1ceeb640acac341e504d54c0d0939f1da2bac27645adf404ed2ac48a2846a919d

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_kk.dll
        Filesize

        28KB

        MD5

        d9b956ec540d8b1e528d88d8c5e5fdaa

        SHA1

        bb967aeba493d9ac0b3889f7bbf9136614080331

        SHA256

        cf008a24b53f2d62516a2944b77fd9be17a4778c0ba1b83a09ef7e83c3cf3901

        SHA512

        d6d6171c95c07ddef12bc40a5fda756ed3870a06ff2434bdd7abe02407720bff01fab5eb1bafeb7d4b9b661fc364c39de4a9eab01ef39c6bdce6de58ce4c1a06

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_km.dll
        Filesize

        27KB

        MD5

        5ef433fe15a877e530ba0a044486f200

        SHA1

        db1deb37392e001353f5a098d8686a17fc156b40

        SHA256

        896549adb3d1a38d95e743490cf6f551cac876fa1afc4b07f8eb30ad4d853502

        SHA512

        97839850a49a09cbc416ba1e8e9570adfcacbfccb70903cf597ad8781c7c3d11fd07e2598dccb7e88da7617e44ca99c62dfb3404c0c2a467641d1a6dcd7e8e64

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_kn.dll
        Filesize

        29KB

        MD5

        1ee9fe48904cb43a9147bf16823b16f1

        SHA1

        19fd9c0a2a1d919340eefca7956bd84df467b737

        SHA256

        a65da5bd18d6ac28c45cd11f56f8b868af98e42a69def6199d61235f6fa3d71d

        SHA512

        b556dff94243eeeb8dfe2c185c67ba7359877b8c0161f8fbe9a37a7e7591b0c8242a0be09255b616ac4f5560a728f1780cf6971c826ee6214a1b28c16551bffc

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_ko.dll
        Filesize

        23KB

        MD5

        6c3abddca78cb3ba9f724bad9fed6165

        SHA1

        3114daf9295215bbeed0f4bb4e282b46ec1c74ae

        SHA256

        d47e586aacfa638aab5d681d8b4ce0b42f9d698e213817554b9d42441191d548

        SHA512

        b37b7c8d7d24ead85389ce445536ef4a68c43e2a55508801ab00e9bee2c2ef428d07eb30b62228d647508dc4f6b0d78b1b8edc25052eff0ec5a9ec87fdbcba1d

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_kok.dll
        Filesize

        28KB

        MD5

        f97d285a3ba35b1395d9868e15bce4f1

        SHA1

        154dfcb8646bdb02b618dddf8a0dc1cbdab2269a

        SHA256

        33506ad10fafd8a767afcdd93cab2d91999b4e6468771379d944ff4758c2f5e4

        SHA512

        bae3152e85cc5e8f96299e7d45be8a85e47ea1119fd4d8d2bcb038ce293dab6820e35bcfffc03c9596b95e716e40711c47682f0c71e308755dc71b4c20c57628

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_lb.dll
        Filesize

        30KB

        MD5

        9c7c3dec8769f8b33aab63a15f642d81

        SHA1

        41ab17373c388d005b6d39c3ffc9fd5aac1a75cb

        SHA256

        c088700c358cfad6bd692233e450b8f4836a30a457c7b047e67681c10aecf2f7

        SHA512

        86923405fdcb2ebbf9a2dff24847d55bf1cf39550f475b1268e7edf279269e317c09b638b06e29f4d30ba59fd606f4ab5787f7d09da5ae3c5572ad41f3b3fac8

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_lo.dll
        Filesize

        27KB

        MD5

        b0973b4e4407ea116a723bd7c39c1d45

        SHA1

        011e9126cf2fd3db3f0f810dc1d8e60891ef0695

        SHA256

        36e1ea95cd9663137ae49504980e00fbb311023c8f5f6f40f3cfe14a14ff183a

        SHA512

        574eb8426f774a7ccf860b4f0e324a2cc32581c9aecb834aa25c5f62946d15ef781a9f32feea8cd44e352d4878f3f6b8f097635bddb9df3bf2a443fecd0946e5

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_lt.dll
        Filesize

        28KB

        MD5

        883f3e1c963322852aa6ce7177ba11fd

        SHA1

        3da37835cb54a847e3fa2edec45c4589e2c31561

        SHA256

        c3e3bd953b1035bcb34db9077c41643a503aafeecf99afbc92c9e4326bc6fea5

        SHA512

        52e7eae669ce211be72ed62cddd43f926c8d581a28a5efc167d1bb9c7f132f40a000cec02c91cd81604ca9f1cbb61952a9da8d09044703a49309a4faf2ff2f25

        Download Submit

      • C:\Program Files (x86)\Microsoft\Temp\EU48AC.tmp\msedgeupdateres_lv.dll
        Filesize

        29KB

        MD5

        0edaf7aa97694524c60369256b17c9f8

        SHA1

        48a81d2c180b9dbb970dfc381b204c3e0bf11532

        SHA256

        74b7ff57e79ee2685709678d55a4b4b414f3fdf77ab1783c0ded0196a126c0fe

        SHA512

        de1ec10ba23b7f76dae78b6a98a3eee6df1eea424aa9a4800b70ee7b185e5c6a0dd30d0dc950bf7b37a9c07fd7614652258cdccd64413c49647b42351e02e90e

        Download Submit

      • C:\Program Files\JJSploit\JJSploit.exe
        Filesize

        9.7MB

        MD5

        281a79abb33f10b3f9c6c40c0e165cc3

        SHA1

        ea7bd361ca528f02f0f95c376d844af98105e218

        SHA256

        30f840be1b9249d22c6bdc943d6901ee8723284770be1b7e18ea12a844d91f77

        SHA512

        2f6deba4a2cdba68820dc8a47f20253107a3420a18cf3f0995fa12b434afe41fa6213d392cab2826517b4cf8cf59fceb2083f855531daf9310128754dab7ea1b

        Download Submit

      • C:\Program Files\MsEdgeCrashpad\settings.dat
        Filesize

        280B

        MD5

        4611d8d0f2e0b6cd0077fe6763b5e32e

        SHA1

        0374ea9208d6f25e838fc513ddec377a4ef55b05

        SHA256

        3ef32d77b031b095ae9c52a6dca4c8b4d9fd72ce579538cf060f558f77c940b4

        SHA512

        e4e0247440f7d85a8eab049d781151305741f99801e13e31b5708ffeba610b0d39626a293cec5676439da384cbef1890689731b376fcd09698b39b423add1575

        Download Submit

      • C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1137220906\manifest.json
        Filesize

        80B

        MD5

        077da41a01dde0173ebbf70d3b7210e2

        SHA1

        4b3c3deeb9522ca4ef4e42efcf63b2674f6a5c07

        SHA256

        23bed5c8ebea0c376483374bad7baf633a7e52f3e0a609371c518e06e645bda0

        SHA512

        2822d02e2b3c6306e6d71fa62e7f472b4c3cdf0cbe499b70ac60a0a50e547ed47c394d7de88bbef2e6015920442b9d30cbc0d6869d154e02ec251712f918deec

        Download Submit

      • C:\Program Files\chrome_Unpacker_BeginUnzipping4928_161902826\manifest.json
        Filesize

        113B

        MD5

        b6911958067e8d96526537faed1bb9ef

        SHA1

        a47b5be4fe5bc13948f891d8f92917e3a11ebb6e

        SHA256

        341b28d49c6b736574539180dd6de17c20831995fe29e7bc986449fbc5caa648

        SHA512

        62802f6f6481acb8b99a21631365c50a58eaf8ffdf7d9287d492a7b815c837d6a6377342e24350805fb8a01b7e67816c333ec98dcd16854894aeb7271ea39062

        Download Submit

      • C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1689092644\manifest.json
        Filesize

        43B

        MD5

        af3a9104ca46f35bb5f6123d89c25966

        SHA1

        1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

        SHA256

        81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

        SHA512

        6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

        Download Submit

      • C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1770909925\hyph-as.hyb
        Filesize

        703B

        MD5

        8961fdd3db036dd43002659a4e4a7365

        SHA1

        7b2fa321d50d5417e6c8d48145e86d15b7ff8321

        SHA256

        c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

        SHA512

        531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

        Download Submit

      • C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1770909925\hyph-hi.hyb
        Filesize

        687B

        MD5

        0807cf29fc4c5d7d87c1689eb2e0baaa

        SHA1

        d0914fb069469d47a36d339ca70164253fccf022

        SHA256

        f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

        SHA512

        5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

        Download Submit

      • C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1770909925\hyph-nb.hyb
        Filesize

        141KB

        MD5

        677edd1a17d50f0bd11783f58725d0e7

        SHA1

        98fedc5862c78f3b03daed1ff9efbe5e31c205ee

        SHA256

        c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

        SHA512

        c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

        Download Submit

      • C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1770909925\manifest.json
        Filesize

        82B

        MD5

        2617c38bed67a4190fc499142b6f2867

        SHA1

        a37f0251cd6be0a6983d9a04193b773f86d31da1

        SHA256

        d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

        SHA512

        b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

        Download Submit

      • C:\Program Files\chrome_Unpacker_BeginUnzipping4928_199642882\adblock_snippet.js
        Filesize

        2KB

        MD5

        f5c93c471485f4b9ab45260518c30267

        SHA1

        ee6e09fb23b6f3f402e409a2272521fdd7ad89ed

        SHA256

        9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690

        SHA512

        e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda

        Download Submit

      • C:\Program Files\chrome_Unpacker_BeginUnzipping4928_199642882\manifest.json
        Filesize

        116B

        MD5

        2188c7ec4e86e29013803d6b85b0d5bb

        SHA1

        5a9b4a91c63e0013f661dfc472edb01385d0e3ce

        SHA256

        ac47cc331bb96271da2140941926a8accc6cb7599a6f3c17bd31c78f46709a62

        SHA512

        37c21eaff24a54c2c7571e480ff4f349267e4404111508f241f54a41542ce06bcde4c830c6e195fc48d1bf831ed1fe78da361d1e43416cfd6c02afa8188af656

        Download Submit

      • C:\Program Files\chrome_Unpacker_BeginUnzipping4928_405782008\manifest.json
        Filesize

        102B

        MD5

        b3b44a03c34b2073a11aedbf7ff45827

        SHA1

        c35c52cc86d64e3ae31efe9ef4a59c8bdce5e694

        SHA256

        e3649c54fd5e44cbb5ba80ef343c91fd6d314c4a2660f4a82ec9409eea165aa7

        SHA512

        efa957a1979d4c815ecb91e01d17fa14f51fafdde1ab77ba78ea000ca13ec2d768f57a969aaf6260e8fd68820fd294da712f734753c0c0eda58577fe86cfe2c5

        Download Submit

      • C:\Program Files\chrome_Unpacker_BeginUnzipping4928_7057001\manifest.json
        Filesize

        134B

        MD5

        58d3ca1189df439d0538a75912496bcf

        SHA1

        99af5b6a006a6929cc08744d1b54e3623fec2f36

        SHA256

        a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437

        SHA512

        afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2

        Download Submit

      • C:\Program Files\chrome_Unpacker_BeginUnzipping4928_809557830\manifest.json
        Filesize

        76B

        MD5

        ba25fcf816a017558d3434583e9746b8

        SHA1

        be05c87f7adf6b21273a4e94b3592618b6a4a624

        SHA256

        0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

        SHA512

        3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

        Download Submit

      • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
        Filesize

        81KB

        MD5

        e33000c3f8522a235013b62035f67046

        SHA1

        db13aeec846e9c80fb28ce395a50d5be879679eb

        SHA256

        642482e083f6ebb17f1f701d0e0b139c80fbbb2c5cc552ce1373a2dc48ac085c

        SHA512

        07c01afcab22eda39481d7ea389c154669007a374e543050585b591d4a16239e0a9e5a2bb2867538740df1f22631dcb6218500bc79e292ecc6de434045f030e9

        Download Submit

      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk
        Filesize

        1KB

        MD5

        0b97a709fcb44597e7dc97c41f638568

        SHA1

        ee0d6f6ff97d0f2872f3d5c4655162282b6497c0

        SHA256

        c06329155d1e865880dbe8fe0335ba767016877f420813135d4f1f12e57c4a62

        SHA512

        a8fd16bcc8f914b7faac3d819ec428e15dc34d401d0a441d0fc2a9f3a7b9687edeef3f7fce0256c68b688cab950f33e38d6080d1cf5d4a8b980120f31a2d27d4

        Download Submit

      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk~RFe58336f.TMP
        Filesize

        1KB

        MD5

        945d64ea86dab7808b7ecfbf494db40f

        SHA1

        90ee4e4594e850cd1db6fa1560a35837c4689bea

        SHA256

        9736715930ba3a0175b9ed11c32d864badafa0cf1502ef1b59f3e21cfa440981

        SHA512

        322a4d5a2f8c707d30f6fc82e5288c69dbb1bfe604348926d4437cd906e582e1dcef8c82ed2b2bf294be5f0ee0cb3be5c763910a0333a33aa38a80f68401685c

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.~tmp
        Filesize

        104KB

        MD5

        effecce1b6868c8bd7950ef7b772038b

        SHA1

        695d5a07f59b4b72c5eca7be77d5b15ae7ae59b0

        SHA256

        003e619884dbc527e20f0aa8487daf5d7eed91d53ef6366a58c5493aaf1ce046

        SHA512

        2f129689181ffe6fff751a22d4130bb643c5868fa0e1a852c434fe6f7514e3f1e5e4048179679dec742ec505139439d98e6dcc74793c18008db36c800d728be2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\MSIDE69.tmp
        Filesize

        132KB

        MD5

        cfbb8568bd3711a97e6124c56fcfa8d9

        SHA1

        d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57

        SHA256

        7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc

        SHA512

        860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
        Filesize

        1.6MB

        MD5

        431a51d6443439e7c3063c36e18e87d6

        SHA1

        5d704eb554c78f13b7a07c90e14d65f74b590e3a

        SHA256

        726732c59f91424e8fb9280c1e773e1db72c8607ad110113bc62c67c452154a6

        SHA512

        495d60ad05d1fadb2abd827d778fe94132e5bfc2ae5355e03f2551cd7a879acf50cc0526990e4ccde93bf4eff65f07953035b93cc435f743001f21b017cbfdfd

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_knxm1gse.qgd.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json
        Filesize

        3KB

        MD5

        6bbb18bb210b0af189f5d76a65f7ad80

        SHA1

        87b804075e78af64293611a637504273fadfe718

        SHA256

        01594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c

        SHA512

        4788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\CertificateRevocation\6498.2023.8.1\crl-set
        Filesize

        21KB

        MD5

        d246e8dc614619ad838c649e09969503

        SHA1

        70b7cf937136e17d8cf325b7212f58cba5975b53

        SHA256

        9dd9fba7c78050b841643e8d12e58ba9cca9084c98039f1ebff13245655652e1

        SHA512

        736933316ee05520e7839db46da466ef94e5624ba61b414452b818b47d18dcd80d3404b750269da04912dde8f23118f6dfc9752c7bdf1afc5e07016d9c055fdb

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
        Filesize

        280B

        MD5

        8ab53d01911721910d1f4010776341ab

        SHA1

        e546db9b1fd58c10130476dd15017a8b55be463d

        SHA256

        a4043a4960b27b4440bcbd7c18b440064492999e49c8a94beb5b1deeec33a76c

        SHA512

        5f2c9b9818859de390cb6751db3be438f4e62fa7917f5870eef9ca8adafc8c71233aee407d4947e696a57e837c5e613658ad9c95e06617f1cf6ad83c8e8bda49

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
        Filesize

        144B

        MD5

        8b7333896bf66b0b068ccc522c0f2473

        SHA1

        c43cfe5f6e85a2bf361e04b46111ac804ddc8316

        SHA256

        fe3e4429bdc3ff10a31956bdeaaf1c1ad470d7bbc4fe91397ce01e7b31f28868

        SHA512

        da1ccb0c7e6fd5bc7fe6baa67d388c3ebcf84ff2609293e80451784a75c36879ccbf44fd54132b623c64edb01a40953124abcbe70396729c351c26c34e524734

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a731e.TMP
        Filesize

        48B

        MD5

        b2080c9a500f0dc88119ff44fcd14e4f

        SHA1

        1d43996c189a730806214359efe5e0e50b26283d

        SHA256

        570e96863c254c5ff52e32bc37207aab8aa087ba5268b5ac1125a86cf89109d7

        SHA512

        14e27a88b223dbe25c9771f818340df1e50b4241f8bf91120efa7bff1984ff66000de70149c75b18c5788d7ec3fc7dde39d1f1b0cf00cba3fe9cc53494a55647

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\CURRENT
        Filesize

        16B

        MD5

        46295cac801e5d4857d09837238a6394

        SHA1

        44e0fa1b517dbf802b18faf0785eeea6ac51594b

        SHA256

        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

        SHA512

        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
        Filesize

        41B

        MD5

        5af87dfd673ba2115e2fcf5cfdb727ab

        SHA1

        d5b5bbf396dc291274584ef71f444f420b6056f1

        SHA256

        f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

        SHA512

        de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
        Filesize

        1KB

        MD5

        72e0853eedc1b6fb720bd872e23a1382

        SHA1

        cda53a55eb47bb3be9dff6a32bc9d1de4d0f3855

        SHA256

        1223e95ce8ba74aea6cc97e448ec0b159c1617cd80a6d208e23119d1cedd08bc

        SHA512

        24c86e907d8cbe11898c3f4fa8481a2b58f27a1b60f29a42a4d9017a3acb550505e943d032de9fa26bc857105cbec74f04d36ccddfe01cac8ec8b01fdc977ff6

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe5b20b3.TMP
        Filesize

        59B

        MD5

        2800881c775077e1c4b6e06bf4676de4

        SHA1

        2873631068c8b3b9495638c865915be822442c8b

        SHA256

        226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

        SHA512

        e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
        Filesize

        2B

        MD5

        d751713988987e9331980363e24189ce

        SHA1

        97d170e1550eee4afc0af065b78cda302a97674c

        SHA256

        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

        SHA512

        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\c2e4a506-c2d1-4ee5-ac30-8a412772b98b.tmp
        Filesize

        6KB

        MD5

        364a3b8065538281bdd25f395317cfd9

        SHA1

        d4be11ffaa61d96a6e5ea13bcb8f3a55730de07b

        SHA256

        fcd92137032327c2c35f4a4a3c6b4935e127727e0d74adf0b8b556cbb85c6f4b

        SHA512

        340d0b293f49a0e7b1b7a936cca784c7d5577a4def6fa8562a3ba4d718d77889094198ad93dc2107389b6ee12bf3113da33b537fa163c7c0ba71998d262cce68

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_0
        Filesize

        8KB

        MD5

        cf89d16bb9107c631daabf0c0ee58efb

        SHA1

        3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

        SHA256

        d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

        SHA512

        8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_1
        Filesize

        264KB

        MD5

        d0d388f3865d0523e451d6ba0be34cc4

        SHA1

        8571c6a52aacc2747c048e3419e5657b74612995

        SHA256

        902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

        SHA512

        376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_2
        Filesize

        8KB

        MD5

        0962291d6d367570bee5454721c17e11

        SHA1

        59d10a893ef321a706a9255176761366115bedcb

        SHA256

        ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

        SHA512

        f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_3
        Filesize

        8KB

        MD5

        41876349cb12d6db992f1309f22df3f0

        SHA1

        5cf26b3420fc0302cd0a71e8d029739b8765be27

        SHA256

        e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

        SHA512

        e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
        Filesize

        1KB

        MD5

        2eb3cc6b5a2ce0779d343208c6aee23c

        SHA1

        d5d03563e2d9b3b37e8fe094e8ef7cc318acd156

        SHA256

        c02919c86cf8229b324e5742eb7a7fe82a8a5e70bb9e0b54a9d31312f571bea5

        SHA512

        d0d0afbbf7956be0217f66bce26186f0c5596ca30e5a661e5ab8904171d4a890eb05a4aea2142a9de25e77e1f826a31fe9ccd187fd8b3d1e257048448ddd6d9e

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
        Filesize

        2KB

        MD5

        5d9b3c6dec0252e6ba06ed4420189df1

        SHA1

        a61a76d86959eea2035abf2a9dda46287fdf42cf

        SHA256

        56cd0e8580f1f2280bbf3aed21bec5465ede6287387294e70375d360f420c9f2

        SHA512

        dbaca6d2d967ca878ca0bf8ebb3ec11ccc5ca27ea374b909bf61269cab2c4c75dc1382efe5ae86bbe11b98c3dc48296cf377f568303d43b2ac62352a7e21303d

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
        Filesize

        16KB

        MD5

        cbdf11ef88bb3bfbb1459a45b04ad113

        SHA1

        3a8b7f055eb841097c2fa4ca5a71eea0aa8f844b

        SHA256

        aa7c477844851e8cb4f62878b593574c2383926d4b7f9b78a4503cf9f83a44a2

        SHA512

        d5c59760de9c5094993f87a8de694e24d8425b1f91ca6cedda41da5f739204ce4e4cc7078668ea48d4e1a7611849c4fccabc0300d695c0ac87213531c1fd8b32

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
        Filesize

        3KB

        MD5

        bda5387d1c2f43fa676472e3af3fbe18

        SHA1

        22b62434944e3bebf8217f4120d261dc3a86a396

        SHA256

        07bb541f438c1acb4efa85bf0701c3fa7258e74f35c44d686d71989e9c2d27b8

        SHA512

        ab7a487e1c7c53b7600ebd3dd8c5c9567a614bfb0b8aa1139f941b79eaaa2f0b9fd2285d786b65e38c94831693fb34d7e04a514fe7b83fde89889eb8c05714f9

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe5a0c07.TMP
        Filesize

        1KB

        MD5

        c17a9936f86c4f28667005c87679f311

        SHA1

        7c65f0d08d3e3e43ba57a8e26b02c8f6f85b5a26

        SHA256

        eaf26c3682b68b254e07cb90b90fb3b08ee3f1bc553374872abc0a5950f6fe85

        SHA512

        92f80bade1afde3d0e387dac9bf8ca5e08bd91f9cd0b719bf9e379ea44941b9ac4d2d4051b7a9dcc69d9212fcbc71d54f97329f5f41cf7354528e84f8d3b9694

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\PKIMetadata\14.0.0.1\crs.pb
        Filesize

        289KB

        MD5

        5533fc3f4c1820b787df3ec6fdc2ef1a

        SHA1

        f39ff89fcc1af711e8127c52ba55c8ad347e84a2

        SHA256

        56711adeba4ecafe298eab09cf0ef2f1d7f3260a2aa4366b927029781d270938

        SHA512

        5194c0562b8cb8e23fde7b561b00dd6bed93782f2e9253324a8e8ef05b69b66a549f2061ff3a9010a73a1412cc64889bc93931d0f212b8a68e39838dabd8e811

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\PKIMetadata\14.0.0.1\ct_config.pb
        Filesize

        10KB

        MD5

        f9d04f6b65d1a463f1a01ec39b77622c

        SHA1

        8f13311afc943d362dbb332b1c0fb289a722547f

        SHA256

        b42a2649782caefe33aa7f546a02b69bb292a0d4c8ca48602bd9c8dc623b3588

        SHA512

        16b6419a5d1848abbc668fff08b767af3e01abd71a94341baad7344c0dafa5951ba8e3bbe8561d79fecab03b720e0293e22b49659961d82587d3c7956addd71a

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\PKIMetadata\14.0.0.1\kp_pinslist.pb
        Filesize

        11KB

        MD5

        fb4c5e847d5f30be002702ffab8e928a

        SHA1

        30adae5ee6799e233e29cb6825bde492ae6dea98

        SHA256

        2fa10f05494714d062dbac514989f544036509e4181af8352bf7f8c3b7ff2fe0

        SHA512

        6c0792c37f44835a10e412dc889e64bfb740337c0a94ae360149c7987216cee168f4b70a428fa9a63a99fa0d35640727450e1fcde735b42c6108ee3f9457f72f

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.57\Filtering Rules
        Filesize

        1.8MB

        MD5

        d7c9c6d2e1d9ae242d68a8316f41198c

        SHA1

        8d2ddccc88a10468e5bffad1bd377be82d053357

        SHA256

        f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

        SHA512

        7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.57\LICENSE
        Filesize

        24KB

        MD5

        aad9405766b20014ab3beb08b99536de

        SHA1

        486a379bdfeecdc99ed3f4617f35ae65babe9d47

        SHA256

        ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

        SHA512

        bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

        Download Submit

      • C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\TrustTokenKeyCommitments\2024.10.11.1\keys.json
        Filesize

        6KB

        MD5

        052b398cc49648660aaff778d897c6de

        SHA1

        d4fdd81f2ee4c8a4572affbfd1830a0c574a8715

        SHA256

        47ec07ddf9bbd0082b3a2dfea39491090e73a09106945982e395a9f3cb6d88ae

        SHA512

        ed53d0804a2ef1bc779af76aa39f5eb8ce2edc7f301f365eeaa0cf5a9ab49f2a21a24f52dd0eb07c480078ce2dd03c7fbb088082aea9b7cdd88a6482ae072037

        Download Submit

      • C:\Windows\Installer\e5830cf.msi
        Filesize

        5.0MB

        MD5

        9a5e4420fd429b7444e7f02b2b52d0bc

        SHA1

        056e5ac7ef1334698f4337435985a2d6a52ae059

        SHA256

        44ef9c095fdc078cad8648bc9ec75f744d2c72229ee427eac65fbc1859e57172

        SHA512

        7728f89d67bf145106d7c86dd7a1ad27aac74898210bd86d944d7a9111c41fb3df1ab2acab5a4d5bd9cf1a6dd66d9b460368c7994bfbe8807e4c21ae142f8f5e

        Download Submit

      • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        Filesize

        24.1MB

        MD5

        1b142acf846c78f8bf4c277c59bb00b8

        SHA1

        e89af60364f61c04a6c8930c02ff202a8554e5e7

        SHA256

        a1cdf6dab236727f627d3614ce1670afe22b18a4455a3a3abfd5d8acd25035ff

        SHA512

        07cc3a8d53022bed5c2ad3d715ad0c15c7ff98448ce9b2e7172c2cc72a89368e88361d786389f9c706cfc396ece4b852772fb13975418013d5502307a5510651

        Download Submit

      • \??\Volume{48d314f9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f09dc8f8-ff32-4f3e-b48d-299979ec9a4e}_OnDiskSnapshotProp
        Filesize

        6KB

        MD5

        fbcb1fe929ac2566990bfa9c86961704

        SHA1

        c632cd16c897b6355f8d6dd5963fde76f723be0f

        SHA256

        dff9884fa134ae35e71542f273977fd9b629d5a98f71585adf2eb4fc95d246ff

        SHA512

        344e8136537237baf7ade21d509abd454be9fc8658249834dbe0d120e29ef10b1add3c42ebae49572548eadbda3520380300626336246cd3cf53ed7440cfc096

        Download Submit

      • memory/940-562-0x0000023A096D0000-0x0000023A097FA000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/940-545-0x0000023A096D0000-0x0000023A097FA000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/940-374-0x00007FFA424B0000-0x00007FFA424B1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/968-67-0x0000019530A10000-0x0000019530A32000-memory.dmp

        Filesize

        136KB

        Download

      • memory/2744-1492-0x0000020163C00000-0x0000020163E49000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2744-1491-0x00000201638A0000-0x00000201638A8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2744-1490-0x0000020163870000-0x000002016387A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2744-1489-0x0000020149350000-0x000002014935E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/3632-384-0x00007FFA428F0000-0x00007FFA428F1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3632-385-0x00007FFA40F00000-0x00007FFA40F01000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4600-546-0x000002DCDD2D0000-0x000002DCDD3FA000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/4600-386-0x00007FFA424B0000-0x00007FFA424B1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4704-265-0x0000000000550000-0x0000000000585000-memory.dmp

        Filesize

        212KB

        Download

      • memory/4704-276-0x0000000073DF0000-0x0000000074016000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/4704-331-0x0000000000550000-0x0000000000585000-memory.dmp

        Filesize

        212KB

        Download

      • memory/4704-266-0x0000000073DF0000-0x0000000074016000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/4932-1092-0x000001A61A460000-0x000001A61A461000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4932-1086-0x000001A61A460000-0x000001A61A461000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4932-1087-0x000001A61A460000-0x000001A61A461000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4932-1088-0x000001A61A460000-0x000001A61A461000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4932-1095-0x000001A61A460000-0x000001A61A461000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4932-1094-0x000001A61A460000-0x000001A61A461000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4932-1093-0x000001A61A460000-0x000001A61A461000-memory.dmp

        Filesize

        4KB

        Download