f1db224af0f14b971ba8be3e33482322b2f821695a4bbe2782b956217da383ad

Resubmissions

30-11-2024 05:05

241130-fq1p3ayken 8

15-11-2024 21:39

241115-1hzs1ssgnf 8

Analysis

max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JJSploit_8.10.10_x64_en-US.msi
Size

5.0MB
MD5

8cb1e85b5723e3d186cc1742b6c71122
SHA1

f4638a9849b2bea46c8120930c7727cfae70b4d2
SHA256

f1db224af0f14b971ba8be3e33482322b2f821695a4bbe2782b956217da383ad
SHA512

b447f7b4e6590120ed50eaad798b271e7ebbe52ad61dbe5e621e0c99a6314fbcfd10ce8e6f837a7ca76e1084651c65dcb0eafcdac6cce6eebe2d1729249add5b
SSDEEP

98304:6jmBVvK7NEfE6nal/6r5mzaB325gGiU9fh8ztt8xuvuUnm18uHwCEtFW+VAv8m:srNEfulImzfh8IquKq8uA

Score

8^/10

discovery evasion execution persistence phishing privilege_escalation trojan

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
38	4688	powershell.exe
41	4688	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4688	powershell.exe
4688	powershell.exe

A potential corporate email address has been identified in the URL: httpswww.youtube.com@Omnidevcbrd1
phishing
A potential corporate email address has been identified in the URL: httpswww.youtube.com@WeAreDevsExploitscbrd1
phishing
Downloads MZ/PE file

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A031A55-AE5F-4108-9BE1-F4D7F670FD40}\MicrosoftEdge_X64_131.0.2903.70.exe	MicrosoftEdge_X64_131.0.2903.70.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_en-GB.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\ms.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Locales\hr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\edge_game_assist\VERSION	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_ar.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\msedge.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\VisualElements\LogoCanary.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_mi.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\msedge.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Trust Protection Lists\Mu\Entities	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Locales\af.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Locales\az.pak	setup.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_es.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_iw.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A031A55-AE5F-4108-9BE1-F4D7F670FD40}\EDGEMITMP_DFB8A.tmp\setup.exe	MicrosoftEdge_X64_131.0.2903.70.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Locales\ca-Es-VALENCIA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Locales\nl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\identity_proxy\win11\identity_helper.Sparse.Internal.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\gu.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\MicrosoftEdgeUpdateOnDemand.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_bg.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\prefs_enclave_x64.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Locales\sr-Cyrl-BA.pak	setup.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\ka.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\v8_context_snapshot.bin	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\identity_proxy\win10\identity_helper.Sparse.Canary.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Locales\bg.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_sk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\wns_push_client.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Locales\fr-CA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\vcruntime140_1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\ru.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\ug.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\BHO\ie_to_edge_bho.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedge.dll.sig	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_eu.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_ne.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\resources.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Trust Protection Lists\Sigma\Content	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\VisualElements\SmallLogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\ja.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\kok.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Locales\gu.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\psuser.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\hu.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\pl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\identity_proxy\resources.pri	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Locales\bs.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_sv.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\identity_proxy\win10\identity_helper.Sparse.Internal.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\identity_proxy\beta.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\pt-PT.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\qu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\sv.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\vi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_gl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_sq.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\ml.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\microsoft_shell_integration.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Trust Protection Lists\Sigma\Advertising	setup.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{FFBDBA95-DF8A-4611-9643-F1D13013482B}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{FFBDBA95-DF8A-4611-9643-F1D13013482B}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e57fb79.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57fb77.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FFBDBA95-DF8A-4611-9643-F1D13013482B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC32.tmp	msiexec.exe
File created	C:\Windows\Installer\e57fb77.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 22 IoCs

pid	Process
1000	MicrosoftEdgeWebview2Setup.exe
2944	MicrosoftEdgeUpdate.exe
4412	MicrosoftEdgeUpdate.exe
4432	MicrosoftEdgeUpdate.exe
1056	MicrosoftEdgeUpdateComRegisterShell64.exe
3684	MicrosoftEdgeUpdateComRegisterShell64.exe
3288	MicrosoftEdgeUpdateComRegisterShell64.exe
3968	MicrosoftEdgeUpdate.exe
4904	MicrosoftEdgeUpdate.exe
4728	MicrosoftEdgeUpdate.exe
4764	MicrosoftEdgeUpdate.exe
4616	MicrosoftEdge_X64_131.0.2903.70.exe
3956	setup.exe
2616	setup.exe
4936	MicrosoftEdgeUpdate.exe
4704	JJSploit.exe
4736	msedgewebview2.exe
4972	msedgewebview2.exe
5052	msedgewebview2.exe
1512	msedgewebview2.exe
4680	msedgewebview2.exe
2908	msedgewebview2.exe

Loads dropped DLL 38 IoCs

pid	Process
4708	MsiExec.exe
2944	MicrosoftEdgeUpdate.exe
4412	MicrosoftEdgeUpdate.exe
4432	MicrosoftEdgeUpdate.exe
1056	MicrosoftEdgeUpdateComRegisterShell64.exe
4432	MicrosoftEdgeUpdate.exe
3684	MicrosoftEdgeUpdateComRegisterShell64.exe
4432	MicrosoftEdgeUpdate.exe
3288	MicrosoftEdgeUpdateComRegisterShell64.exe
4432	MicrosoftEdgeUpdate.exe
3968	MicrosoftEdgeUpdate.exe
4904	MicrosoftEdgeUpdate.exe
4728	MicrosoftEdgeUpdate.exe
4728	MicrosoftEdgeUpdate.exe
4904	MicrosoftEdgeUpdate.exe
4764	MicrosoftEdgeUpdate.exe
4936	MicrosoftEdgeUpdate.exe
4708	MsiExec.exe
4704	JJSploit.exe
4736	msedgewebview2.exe
4972	msedgewebview2.exe
4736	msedgewebview2.exe
4736	msedgewebview2.exe
4736	msedgewebview2.exe
5052	msedgewebview2.exe
5052	msedgewebview2.exe
1512	msedgewebview2.exe
4680	msedgewebview2.exe
1512	msedgewebview2.exe
4680	msedgewebview2.exe
5052	msedgewebview2.exe
5052	msedgewebview2.exe
5052	msedgewebview2.exe
5052	msedgewebview2.exe
2908	msedgewebview2.exe
2908	msedgewebview2.exe
2908	msedgewebview2.exe
4736	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	JJSploit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3148	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3968	MicrosoftEdgeUpdate.exe
4764	MicrosoftEdgeUpdate.exe
4936	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f914d34881601a250000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f914d3480000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f914d348000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df914d348000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f914d34800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133774168623835361"	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\PROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\59ABDBFFA8FD116469341F1D033184B2\PackageCode = "0711D38297FB7E44E90A08D139DB3056"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\PROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ServiceParameters = "/comsvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebSvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\CLSID\ = "{08D832B9-D2FD-481F-98CF-904D00DF63CC}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{42580F9E-2678-4BB9-A2BC-F22A1D432A1A}\InprocHandler32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42580F9E-2678-4BB9-A2BC-F22A1D432A1A}\InprocHandler32	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3120	msiexec.exe
3120	msiexec.exe
4688	powershell.exe
4688	powershell.exe
4688	powershell.exe
2944	MicrosoftEdgeUpdate.exe
2944	MicrosoftEdgeUpdate.exe
2944	MicrosoftEdgeUpdate.exe
2944	MicrosoftEdgeUpdate.exe
2944	MicrosoftEdgeUpdate.exe
2944	MicrosoftEdgeUpdate.exe
4512	msedge.exe
4512	msedge.exe
3508	msedge.exe
3508	msedge.exe
4872	msedge.exe
4872	msedge.exe
5208	identity_helper.exe
5208	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4736	msedgewebview2.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3148	msiexec.exe
Token: SeSecurityPrivilege	3120	msiexec.exe
Token: SeCreateTokenPrivilege	3148	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3148	msiexec.exe
Token: SeLockMemoryPrivilege	3148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3148	msiexec.exe
Token: SeMachineAccountPrivilege	3148	msiexec.exe
Token: SeTcbPrivilege	3148	msiexec.exe
Token: SeSecurityPrivilege	3148	msiexec.exe
Token: SeTakeOwnershipPrivilege	3148	msiexec.exe
Token: SeLoadDriverPrivilege	3148	msiexec.exe
Token: SeSystemProfilePrivilege	3148	msiexec.exe
Token: SeSystemtimePrivilege	3148	msiexec.exe
Token: SeProfSingleProcessPrivilege	3148	msiexec.exe
Token: SeIncBasePriorityPrivilege	3148	msiexec.exe
Token: SeCreatePagefilePrivilege	3148	msiexec.exe
Token: SeCreatePermanentPrivilege	3148	msiexec.exe
Token: SeBackupPrivilege	3148	msiexec.exe
Token: SeRestorePrivilege	3148	msiexec.exe
Token: SeShutdownPrivilege	3148	msiexec.exe
Token: SeDebugPrivilege	3148	msiexec.exe
Token: SeAuditPrivilege	3148	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3148	msiexec.exe
Token: SeChangeNotifyPrivilege	3148	msiexec.exe
Token: SeRemoteShutdownPrivilege	3148	msiexec.exe
Token: SeUndockPrivilege	3148	msiexec.exe
Token: SeSyncAgentPrivilege	3148	msiexec.exe
Token: SeEnableDelegationPrivilege	3148	msiexec.exe
Token: SeManageVolumePrivilege	3148	msiexec.exe
Token: SeImpersonatePrivilege	3148	msiexec.exe
Token: SeCreateGlobalPrivilege	3148	msiexec.exe
Token: SeCreateTokenPrivilege	3148	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3148	msiexec.exe
Token: SeLockMemoryPrivilege	3148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3148	msiexec.exe
Token: SeMachineAccountPrivilege	3148	msiexec.exe
Token: SeTcbPrivilege	3148	msiexec.exe
Token: SeSecurityPrivilege	3148	msiexec.exe
Token: SeTakeOwnershipPrivilege	3148	msiexec.exe
Token: SeLoadDriverPrivilege	3148	msiexec.exe
Token: SeSystemProfilePrivilege	3148	msiexec.exe
Token: SeSystemtimePrivilege	3148	msiexec.exe
Token: SeProfSingleProcessPrivilege	3148	msiexec.exe
Token: SeIncBasePriorityPrivilege	3148	msiexec.exe
Token: SeCreatePagefilePrivilege	3148	msiexec.exe
Token: SeCreatePermanentPrivilege	3148	msiexec.exe
Token: SeBackupPrivilege	3148	msiexec.exe
Token: SeRestorePrivilege	3148	msiexec.exe
Token: SeShutdownPrivilege	3148	msiexec.exe
Token: SeDebugPrivilege	3148	msiexec.exe
Token: SeAuditPrivilege	3148	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3148	msiexec.exe
Token: SeChangeNotifyPrivilege	3148	msiexec.exe
Token: SeRemoteShutdownPrivilege	3148	msiexec.exe
Token: SeUndockPrivilege	3148	msiexec.exe
Token: SeSyncAgentPrivilege	3148	msiexec.exe
Token: SeEnableDelegationPrivilege	3148	msiexec.exe
Token: SeManageVolumePrivilege	3148	msiexec.exe
Token: SeImpersonatePrivilege	3148	msiexec.exe
Token: SeCreateGlobalPrivilege	3148	msiexec.exe
Token: SeCreateTokenPrivilege	3148	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3148	msiexec.exe
Token: SeLockMemoryPrivilege	3148	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3148	msiexec.exe
4704	JJSploit.exe
3148	msiexec.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 4708	3120	msiexec.exe	92
PID 3120 wrote to memory of 4708	3120	msiexec.exe	92
PID 3120 wrote to memory of 4708	3120	msiexec.exe	92
PID 3120 wrote to memory of 2012	3120	msiexec.exe	106
PID 3120 wrote to memory of 2012	3120	msiexec.exe	106
PID 3120 wrote to memory of 4688	3120	msiexec.exe	108
PID 3120 wrote to memory of 4688	3120	msiexec.exe	108
PID 4688 wrote to memory of 1000	4688	powershell.exe	113
PID 4688 wrote to memory of 1000	4688	powershell.exe	113
PID 4688 wrote to memory of 1000	4688	powershell.exe	113
PID 1000 wrote to memory of 2944	1000	MicrosoftEdgeWebview2Setup.exe	114
PID 1000 wrote to memory of 2944	1000	MicrosoftEdgeWebview2Setup.exe	114
PID 1000 wrote to memory of 2944	1000	MicrosoftEdgeWebview2Setup.exe	114
PID 2944 wrote to memory of 4412	2944	MicrosoftEdgeUpdate.exe	115
PID 2944 wrote to memory of 4412	2944	MicrosoftEdgeUpdate.exe	115
PID 2944 wrote to memory of 4412	2944	MicrosoftEdgeUpdate.exe	115
PID 2944 wrote to memory of 4432	2944	MicrosoftEdgeUpdate.exe	116
PID 2944 wrote to memory of 4432	2944	MicrosoftEdgeUpdate.exe	116
PID 2944 wrote to memory of 4432	2944	MicrosoftEdgeUpdate.exe	116
PID 4432 wrote to memory of 1056	4432	MicrosoftEdgeUpdate.exe	117
PID 4432 wrote to memory of 1056	4432	MicrosoftEdgeUpdate.exe	117
PID 4432 wrote to memory of 3684	4432	MicrosoftEdgeUpdate.exe	118
PID 4432 wrote to memory of 3684	4432	MicrosoftEdgeUpdate.exe	118
PID 4432 wrote to memory of 3288	4432	MicrosoftEdgeUpdate.exe	119
PID 4432 wrote to memory of 3288	4432	MicrosoftEdgeUpdate.exe	119
PID 2944 wrote to memory of 3968	2944	MicrosoftEdgeUpdate.exe	120
PID 2944 wrote to memory of 3968	2944	MicrosoftEdgeUpdate.exe	120
PID 2944 wrote to memory of 3968	2944	MicrosoftEdgeUpdate.exe	120
PID 2944 wrote to memory of 4904	2944	MicrosoftEdgeUpdate.exe	122
PID 2944 wrote to memory of 4904	2944	MicrosoftEdgeUpdate.exe	122
PID 2944 wrote to memory of 4904	2944	MicrosoftEdgeUpdate.exe	122
PID 4728 wrote to memory of 4764	4728	MicrosoftEdgeUpdate.exe	124
PID 4728 wrote to memory of 4764	4728	MicrosoftEdgeUpdate.exe	124
PID 4728 wrote to memory of 4764	4728	MicrosoftEdgeUpdate.exe	124
PID 4728 wrote to memory of 4616	4728	MicrosoftEdgeUpdate.exe	130
PID 4728 wrote to memory of 4616	4728	MicrosoftEdgeUpdate.exe	130
PID 4616 wrote to memory of 3956	4616	MicrosoftEdge_X64_131.0.2903.70.exe	131
PID 4616 wrote to memory of 3956	4616	MicrosoftEdge_X64_131.0.2903.70.exe	131
PID 3956 wrote to memory of 2616	3956	setup.exe	132
PID 3956 wrote to memory of 2616	3956	setup.exe	132
PID 4728 wrote to memory of 4936	4728	MicrosoftEdgeUpdate.exe	133
PID 4728 wrote to memory of 4936	4728	MicrosoftEdgeUpdate.exe	133
PID 4728 wrote to memory of 4936	4728	MicrosoftEdgeUpdate.exe	133
PID 4708 wrote to memory of 4704	4708	MsiExec.exe	136
PID 4708 wrote to memory of 4704	4708	MsiExec.exe	136
PID 4704 wrote to memory of 4448	4704	JJSploit.exe	137
PID 4704 wrote to memory of 4448	4704	JJSploit.exe	137
PID 4704 wrote to memory of 4740	4704	JJSploit.exe	138
PID 4704 wrote to memory of 4740	4704	JJSploit.exe	138
PID 4704 wrote to memory of 4736	4704	JJSploit.exe	139
PID 4704 wrote to memory of 4736	4704	JJSploit.exe	139
PID 4736 wrote to memory of 4972	4736	msedgewebview2.exe	140
PID 4736 wrote to memory of 4972	4736	msedgewebview2.exe	140
PID 4448 wrote to memory of 4084	4448	cmd.exe	141
PID 4448 wrote to memory of 4084	4448	cmd.exe	141
PID 4740 wrote to memory of 3508	4740	cmd.exe	142
PID 4740 wrote to memory of 3508	4740	cmd.exe	142
PID 4084 wrote to memory of 1360	4084	msedge.exe	143
PID 4084 wrote to memory of 1360	4084	msedge.exe	143
PID 3508 wrote to memory of 1216	3508	msedge.exe	144
PID 3508 wrote to memory of 1216	3508	msedge.exe	144
PID 4736 wrote to memory of 5052	4736	msedgewebview2.exe	145
PID 4736 wrote to memory of 5052	4736	msedgewebview2.exe	145
PID 4736 wrote to memory of 5052	4736	msedgewebview2.exe	145

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\JJSploit_8.10.10_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3148

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A4E549688843082FC23DF8A88945C5A3 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Program Files\JJSploit\JJSploit.exe
    "C:\Program Files\JJSploit\JJSploit.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Windows\system32\cmd.exe
      "cmd" /C start https://www.youtube.com/@Omnidev_
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@Omnidev_
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4084
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa0d5746f8,0x7ffa0d574708,0x7ffa0d574718
        6⤵
        
        PID:1360
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,10696378273434022877,16379762776253199882,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        6⤵
        
        PID:2296
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,10696378273434022877,16379762776253199882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4872
  - - C:\Windows\system32\cmd.exe
      "cmd" /C start https://www.youtube.com/@WeAreDevsExploits
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@WeAreDevsExploits
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3508
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa0d5746f8,0x7ffa0d574708,0x7ffa0d574718
        6⤵
        
        PID:1216
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3254592290500244695,2695998913281141358,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        6⤵
        
        PID:1592
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,3254592290500244695,2695998913281141358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4512
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,3254592290500244695,2695998913281141358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
        6⤵
        
        PID:1280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3254592290500244695,2695998913281141358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        6⤵
        
        PID:3632
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3254592290500244695,2695998913281141358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
        6⤵
        
        PID:2736
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3254592290500244695,2695998913281141358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
        6⤵
        
        PID:5228
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3254592290500244695,2695998913281141358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
        6⤵
        
        PID:5752
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3254592290500244695,2695998913281141358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
        6⤵
        
        PID:5848
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3254592290500244695,2695998913281141358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
        6⤵
        
        PID:5556
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3254592290500244695,2695998913281141358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3254592290500244695,2695998913281141358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
        6⤵
        
        PID:5400
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3254592290500244695,2695998913281141358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
        6⤵
        
        PID:6064
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3254592290500244695,2695998913281141358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
        6⤵
        
        PID:5376
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3254592290500244695,2695998913281141358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
        6⤵
        
        PID:5372
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.10 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4704.3520.16496907508264180012
      4⤵
      Checks computer location settings
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4736
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.86 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=131.0.2903.70 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffa0e066070,0x7ffa0e06607c,0x7ffa0e066088
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4972
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1800,i,9072917859045348530,15947774991395074071,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5052
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2044,i,9072917859045348530,15947774991395074071,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1512
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1580,i,9072917859045348530,15947774991395074071,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4680
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3384,i,9072917859045348530,15947774991395074071,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2908
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2944
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4412
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4432
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1056
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3684
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3288
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDZDODY0MjgtMUE5Mi00ODFELUFFNTktQzUyNDA0QTcxQzY0fSIgdXNlcmlkPSJ7QzFGQUU1NUUtRDY4Qy00N0VGLTg2MTMtNTRFMDVDNTYyMzc5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDOTI0MUE2QS03ODlELTQ0RDgtODk4Qy05RkVFNDZCRkNFRTV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDc0MTE4Njk0IiBpbnN0YWxsX3RpbWVfbXM9IjYxMCIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3968
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{46C86428-1A92-481D-AE59-C52404A71C64}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2680

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDZDODY0MjgtMUE5Mi00ODFELUFFNTktQzUyNDA0QTcxQzY0fSIgdXNlcmlkPSJ7QzFGQUU1NUUtRDY4Qy00N0VGLTg2MTMtNTRFMDVDNTYyMzc5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OEU2RjY3QzQtNDk2Ny00MjE2LTg0RjctMkYxQUVFRTE5NzMwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O2NCWUVZWDg3MXRzR3VLSmFvNjNYalV0NXZKRTlYeENUbkU3SDBQZ1VqS0U9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1MyIgaW5zdGFsbGRhdGV0aW1lPSIxNzI4MjkzMzYxIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNzI3NjYwNzM5MTQwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA3ODE4MTMyMiIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4764
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A031A55-AE5F-4108-9BE1-F4D7F670FD40}\MicrosoftEdge_X64_131.0.2903.70.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A031A55-AE5F-4108-9BE1-F4D7F670FD40}\MicrosoftEdge_X64_131.0.2903.70.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A031A55-AE5F-4108-9BE1-F4D7F670FD40}\EDGEMITMP_DFB8A.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A031A55-AE5F-4108-9BE1-F4D7F670FD40}\EDGEMITMP_DFB8A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A031A55-AE5F-4108-9BE1-F4D7F670FD40}\MicrosoftEdge_X64_131.0.2903.70.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A031A55-AE5F-4108-9BE1-F4D7F670FD40}\EDGEMITMP_DFB8A.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A031A55-AE5F-4108-9BE1-F4D7F670FD40}\EDGEMITMP_DFB8A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.86 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A031A55-AE5F-4108-9BE1-F4D7F670FD40}\EDGEMITMP_DFB8A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.70 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff6eeb32918,0x7ff6eeb32924,0x7ff6eeb32930
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:2616
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDZDODY0MjgtMUE5Mi00ODFELUFFNTktQzUyNDA0QTcxQzY0fSIgdXNlcmlkPSJ7QzFGQUU1NUUtRDY4Qy00N0VGLTg2MTMtNTRFMDVDNTYyMzc5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDMjhCQTVDNi1GRTQzLTQ5RUItOTRFNi00QTlGNjVFQzZDNEN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuMjkwMy43MCIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA4ODk2Mjk4NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwODkxMTg3NTUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzA4OTYyNDAwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9mODEzNjkwMS1jNWYwLTQzMjYtYmYzMy00ZDczYjg3YTE5Nzk_UDE9MTczMzU0Nzk3NCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1adHB2eE5hJTJmU1NycW5WSDQ3MHpXT1R6MEtKcEkxV3NWM1BOJTJmZkVMRnVWdlZyRXhMZURNdHhQS3lZYmFWaVNyQzNwSWg3eXpFRnJ5WXJ4MVJRYkQzVkElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzY2MjIxNjAiIHRvdGFsPSIxNzY2MjIxNjAiIGRvd25sb2FkX3RpbWVfbXM9IjE1NTMyIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTMwOTExODU0NSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzMjI4Njg5MzEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU5MjMwMjUyMDIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI0NTMiIGRvd25sb2FkX3RpbWVfbXM9IjIxOTg1IiBkb3dubG9hZGVkPSIxNzY2MjIxNjAiIHRvdGFsPSIxNzY2MjIxNjAiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjYwMDE1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57fb78.rbs

Filesize
21KB

MD5
aa4319e8f8cbcc69d70557984794bfcf

SHA1
a38dc709db48f9123bd297eec7d1d6fb03b4296e

SHA256
e3955ff8adbd261421b748e21b05b252bd5c55430352c045c6d8b2a749fcfb5a

SHA512
2fb49d9cf9c2709ed46bf7bc62016238e952dc8163de359e9947b673a3d21f5b16dda4e4f3e3bbede9e5e6255ac9d41f8871a88e93f1911fa91d6f84434af52e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Installer\setup.exe

Filesize
6.6MB

MD5
8ae106f9f32723071b7d89c0dd260569

SHA1
c66b0f1b5f01b0a6a8eb0dc32842983f05c992c3

SHA256
c4b55f6e4150ef16f731a7b10012eecb83b5557ae45ac2b3d37b7865d69d1b26

SHA512
e96e3f14239b4fd1c2e6defa65e1eb9920efcf870ad98bee872b6248ab13032976d0340f99b490d6b7034f2ac099ff4d5e613d8f46a812483b1996569bc31dd1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
182KB

MD5
d6092c49adbe6e336129589db40dd865

SHA1
f2727da0cd0fff082401adaf779c4ba8c961e3c7

SHA256
6474d531f1b8788451f9a0d9e421dfa236279466c09d783c3e6bdadf7306b909

SHA512
ff2a7ab954fec2c75e5e61bf752c23e127417eda22a332a40c0e0e7a44757645308c74f7852268eb7de1307907234421e0cf684bab2fea24e1e7a653e601bf1c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
9da54f5a8726349124dbdca094448a11

SHA1
a80642cf316be9570494a4c74949024f5d59f042

SHA256
f04efee822f9b2baf2f9b4ea576b9908804b6990497b82c549a34ba54b1b4807

SHA512
d84a5ac786f8bd0eabe4b1c50c7cbac8828ed2e3eb9a064936b65f0cf07f30e7362d44bda1c95a6652708ebb94e139781acf9cf7c0bdc642620136c6d01e2d62

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
215KB

MD5
d09470f63c3b544d68480425950c6954

SHA1
413c9b4059278aef05eb124028cda19329f9d5de

SHA256
16f4836dfd0647421e492b789928b5aa116f74b85ca91b46ba5873890d008334

SHA512
d47d74e1a80efc6ee775a664269c961f5514b15670d682e1c6e50771a55643b0a2e2b4945a36793a2fcde7d488370275a58ac5552f119e273bb6c84411f46938

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
262KB

MD5
db5cf5b7795b922a9f07561e7213ba01

SHA1
152552ce0f0bb080287b8a9b830577399a6814ee

SHA256
a8ce896d4e64a0246b1cfbba3d3f39a11350c017c7dc19e5bc4dabf0109fb0ef

SHA512
2a2df6ed810ce8fe30f1c42bec81ce8237609d8a490a8bceb31af22eaa6dbe17c39083b20c5100a0ee8b206632fc77854b3ecaac2a76de6ffda2d3d94c92a3e2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
3f84ac83fa44fb5e069640648e1660e7

SHA1
d54e05bbef5f9abad7f6b506cd699a281305ee73

SHA256
17c62e9ed5bebdcce2ac0cb41a255c5f63f6544fb5ab148b6810617b854f6319

SHA512
3c23d6d616249c20759ea3cdf8221dbab0684c745aa362fdf1e505547fb651b08ee33acc3471af27e32bc66e7b1397eb56cded5650b5f43da52291569d48a813

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_af.dll

Filesize
29KB

MD5
c3485f9e2bbd4462f969c1a2b1ade357

SHA1
a7884e39cb43e8272f586be7193211703ffd8a81

SHA256
6dc5593c42c16ebc1765afa6e8ef2af3fac6602a62197e0d614be330109e74cb

SHA512
0d7c1ed739e586e8a371e04117de6a5d4ee7d273ba550c13fb7b84e0500405a9fa4202bb8b96fa2a310baa639e3c4d0bc52764417bf7d75324c988b684d64628

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
908bbadc3ea726e2610ef6632b996694

SHA1
6246e19af8da064c725bcf384ececf1fe1aed43f

SHA256
fc8ef54504842074382f27576a36c7437429cfb876ad5b5332160a8e26255f1c

SHA512
60c05efc76f3bd1b4f1604d3f9c8d123752aa62726b6311ffd14cfb79d7c25023caad1932f5f146722bb0eb647e125277bec10cf1d18997c646b83f04d8e7de7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
01859e622da96bb235d0fd3a3e6b7871

SHA1
f12555f480c12c1aa10911116a5e37446524c0b0

SHA256
07718806c8a31133868cffaee5a07ca721e4f4c6ae4fd0deef67ef2a29eefae8

SHA512
72b5a421f5ff15620cd5e15fd8763b69dc1e9c84701655651992fffd9b79f3e25e11c864c955a5f9beb2f678c03cd59e5a89c10e13a68c57b406971ec6345903

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_as.dll

Filesize
29KB

MD5
96463afd6026b13c098019b02b0ad312

SHA1
96cfd64628e572db01d7fee237add6c48af43bfd

SHA256
b8a2774f687eaa0f25da96e7cf1497d5e6d84e567f7d0c89d5bd33931b2674fa

SHA512
df91cdcba5e6780fcc5ad9d24e25c3e714dd568f515a53dce3a05b9b49c3312a65860d7156fd5524c8ee907f15d3d9ad900b6ad37c0ff2a8631bc8932d397105

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
9772dfcec02c842821cfccbf066f61b9

SHA1
571326a12f51ee034ab9ce8224363c2050f3fbfc

SHA256
27035173c82bde66600ee0cea45d98f6c000575b7deb9e670346a521caababab

SHA512
d4104d310ddcf6ff7ac3a8f6df6b611848c0d0a0a716a958e2f1ce13a9096430081f99134068f0472a2a058d5e6ce2abf0f1ff9abcf4ce0bdbced07731de7f5f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
5c4c5b2c1dfe89adf51d753e5a83f6bd

SHA1
e277714e69b3628586a4f74260e9c06ab00700d8

SHA256
ac722db8cd409584c7529b4791773b56454d91c404222c7e9bc3f8a4d4aec448

SHA512
d5fdbdaa9a0296262b37af95ba9e7f0bdd4de09e9b131f29afe37677ea9c22a9db374b4d2fa903875775a66a04543aed60661eabd1ad9d61cf40892bf593b1c6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
1771018a12f869ddfee465b4294d2b14

SHA1
9d13d4fe3ef612fe1cb55237eec340374f88f6c6

SHA256
6ef242c7e8d2b1002f739cbf5485afd67c4972e36042c26b8dfd0133ae5122d5

SHA512
23edf73610839ac089283306b54dad93975d64cfd799d64f71a330f184253565d7c90d452e9fe028c4b1ec4fca9296e98c524a1ca5eaf11e97738e4fe50fe3a8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
987f13d745a887a41da69a0ce1db4c9c

SHA1
133b52d1529183e5fb90b6c8eab5115419e592c1

SHA256
08383c9fa45d4c1fe441cb259fa0722b55ec2236e8dea471e380fb4fa35977a1

SHA512
6abc8caa7da1b59014098e17a6d71d19edeb91184c41e16025d02218a7e1e6b908c27bbd342ddf2a7bf3e75ef23d086cdb7cc7b11af8e13f1ff0b7a002d34312

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_bs.dll

Filesize
29KB

MD5
1f906baf25ce4d4a48ccbe4c912931d6

SHA1
16ccdf2b6c9dcc9fd143973945c3d12c7e4fc716

SHA256
dff265bd7a3a50bd18212d9c58f1a61e32c6821e520e20e5d8a929fffd8ed65b

SHA512
e06228f79abd81c493a68c620682924b6ecaf11b7879f1bf216d6260824c4f6a3d99e3468b14e23387d14a0338868c47ae145eb3f08cfc80a7cc6add20f5d6ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
30KB

MD5
2dc7cdf70843a980a71adcc497d7f4b9

SHA1
f71d6e6ae98dd7116d6b586466bb16d8d21507d9

SHA256
20e69e1f8ddf7282d90b1c1c7593d7d3593eebb2e72b98bdd26d4c7a560cfecd

SHA512
c4be6389d67bb4b4607380c21ceddcfac20f2f747a584d64753bbdbeca03b868464cb8237ae567bffc4109e1bd17c6cda96b5936f3314fee6461cc50f16b9789

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
d8ffca3af6de1085b758e43fa27d931f

SHA1
151e778acab2149253b2de643c6f0ce1d5a7a582

SHA256
3a5464f9dcbbdaa0248906a5595b7247fb59ac3eb1f3f22b27bb095430de8843

SHA512
2d1182e5fc17e928d1eda4b1749cc1a0f214bedfb4bac844994543a8d031af01d474adce2c3bd96dc33e4d7852e69d4424c3077f82a2d661cf3b5e40ba7eae5e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
7a6d098cd7b6e8dfc510579d7c56e0e0

SHA1
da70f2875e796c4fd8c6e8bf58eb1ce232193925

SHA256
643163c67aa0f4e145c34a34e8fbf93a1a5779f8ebb30a91ac07032813695131

SHA512
6995bea3f571381ba6ad8fe0e66400fd9c98963db0ebd4f7064e575c383b0150024aa29cd56224daccad2c79354a2d662637b472b518840ed9b7210d614bd632

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
8d67274407499bf8991c444c064d8829

SHA1
d02b897a797b019a1e70383b0797c751577bd3df

SHA256
edf8f2c128e9c73553aff7b06dc0c91a05adf576d4970715dc1f168ed233c1ad

SHA512
ce401b7b069ae27cafa7aa8efb5be4d01296307699c686a62da1a5556619a6ae88ecaa2fe4a3e03a6bd9651eaa1455695e08e46ef3771b581adf9c97f6d0b2b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_da.dll

Filesize
29KB

MD5
b2ccb7c497f7f253e6c5fd07450d4b7c

SHA1
1174e4dce062ed9cefd9e4ee6205dbbda80d116d

SHA256
72538c238927c342f953beb6b7e2b7423e75d12b0ca5c33d4e1d8701e890badd

SHA512
9838658d8f7e6073827ef614ca628b1883f79e9f0a78424e3c7779b972eff5549f9c4b9869c39c686eae9695268af9eb201d4b8320e97a53f629e48d8b835c75

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_de.dll

Filesize
31KB

MD5
d727efc2844c23ada09c756629250734

SHA1
e1d383a2690ea6eaf573286f2a8fef82bc42b5db

SHA256
7e06b7c22830140dcb56c0277541e789d115743e49c9410e6055f320bb88bbbc

SHA512
b475fc13c371ee121ae8a469bffdba1c3d54166f46e328d431d1a3237e2deebf6963365026c2b2308020a09fcd16d898dfc621466364bcc2e988a4ef88289b89

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_el.dll

Filesize
31KB

MD5
70cb181cedb9e7f2b7257f8347298886

SHA1
e6c89473c4460adc4f1fedf2ae86041ba13d93f9

SHA256
a845cf8f671920b538138717f40abddc5c830da4543cd9f7261245c3e3918824

SHA512
14c6257ddee56be56e2af07d2dafa4eb0dd015c5ae066e616f91de38b45a4001c422de927c0b96ea25c16800fb0a544b11b535c0cbe42ae725d1492515bbd644

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
09f45cfda08e88e34b51a62c23e0e748

SHA1
c61fc721bb1db2a430ef76eaa95c82b513eda8d2

SHA256
56fa3d934380c73b1e1c32a2bdeed64a26fc2de92612a201ef7306d4a00be0c8

SHA512
b30b682647ce799c19a2a942d4e83d8438cf52da74f088802f9412ed4f18116736dccbcd8b230b7f3031455591e0eef7061a3ec379ef947a1ce207e6e9f08b4a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
ab3799e458126b774b1bc7a56e75fc5d

SHA1
fb929347c1f92654943a3a0b7611fcc978718ec2

SHA256
bdb3e5dbb6caa9fb77e23e1b5a363400402a6e88eed3e86e55bc9edae8b8bfad

SHA512
25cde70b3d51b1c1cfa7102a745d90ceb5d9c6324c2f9045b213dec000e79fe419744f07e6c87c77e84c0d374259d72cf52ffee26da864e0959d2f3d35f2c851

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
c94e2c9cb3f1b9ce990f131b32844db8

SHA1
98069c4e11f2ab03bce79717f208201c5549713a

SHA256
34e3bd8b21adc60adc614ce32a39dd424acc7c998f8d7901af5193348830b84f

SHA512
72f807a6786aa8c88b92a04aa19413412aff1d54218f31c942f40d42835267acb0249eb0fda0124efd0357b48a4c390cf0d7c1425b947e8f998b137e3ac03db0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_es.dll

Filesize
29KB

MD5
38559c9b8868faa3d5312aa9557ed1fc

SHA1
b430533a534625ca67a4bfdcd04c7d346feb705f

SHA256
9457f8915b6f1f644274c30f63831ebace766796cc9d570ed75575fd1dd88106

SHA512
342858b52017128d601c5d27b465b8939fcc609272c4c5ea4942b49320c2ef47932aa3ae62b17bd401925a69184e16b1d6e2febbb263d344ed2d3a33fce7b2e0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
8549f0990897525e445acb553dee4250

SHA1
f6a0549e6ce04c852a9593b430cf19556beb6277

SHA256
224aa029d124cccac05d1c38dd7db1ae46fd17fdbe29c32692cd6dd4e1666728

SHA512
729637b47d5ac009eb0cb5c12486879d4bad196ade6371f99d209fde74ec4ea5e231a4eb9f574ee7bb61605fe19fc9e035cb12cc8d93d05ec47a319c28d93085

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_eu.dll

Filesize
29KB

MD5
1f340c24a25186770479581d678a0f5f

SHA1
df7f1e6a8a5447a244a4d9fd29d7c2a3435e3cf8

SHA256
4db5fd9c0ccbbad69b90834e496a625fac6b479f561e2ecbdc2b5ee63ad35c66

SHA512
72b9067f339172b1df2795cad3505bf442dd8b2e3a05ab9a392f470dd047dabb82efc9bbabc32acdcdea326cb4f7bbafdf8c1ac1a2e375a88f7e2c6014ed930a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_fa.dll

Filesize
28KB

MD5
9c454c79124119f8b1293d0c50b1b9a6

SHA1
2b91f6dcbb7897f9b3560d806ce6c6a17a37fcfc

SHA256
fcf333ce3065f755cf0033ee385a7f752132274a8c85da12ba5445f496875aac

SHA512
d5dd9d24518a0acea4d16d79385a1a5743695f8d8bf5a9fce37b90398edba90aab0ac1e18da6f6d8b4bf1b0ce5efda394871914ab620ba0075fb4bdbe950af63

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
a72def19680fda48d3d526dcf3dee8e7

SHA1
37c9a46fc4483ee0d94ff5b92e4d9f462e5b232c

SHA256
9fabe5d1abb1baa74b18d41ff28913b3eb9c3fa985f4335b36623463c0c7c09f

SHA512
3fb8ff998053e74b9d18b29bb3626c3d10ab577227e1ec93964ad00b293ca23c92238dc5187646a3671b1fcfb4a192f5a031ef9d1796120c9e3020ab6398f196

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
489692566a15cec4eccce35afffeecb6

SHA1
ca2711d9e70f9d4c41d1d98af33993bebb48e342

SHA256
fda26d0135a07a7512811a8ad206056db70e0ea0fe9236096f2f622305e590c2

SHA512
74e5090e2c7e8af1bdce7e544b3c15edabe54b577bea9c3b152003e361152bafce2a8e0e5c2cc55c6714004bffd33f4b793d51324b12abe9dfa6713d5e1f34d9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
c52b6c282e5151fb9537d25275af31b5

SHA1
519ff118d3429cba4096a20191ef2fd0ddeb4099

SHA256
fe20198950089e92c74d42eb0353119165cc64ca4abc98446d73f0afd4757662

SHA512
298f5e6a337e73ab697542fbb8efd33231d48f7845fe6db4f42721588e5d73b12a3fc81cb3e90634b62b6edb1f803807d81eddcef7fe3f0e6491220cb90520f2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
a50e40e5fc5b4dc9d60815df15ac15f8

SHA1
410930070643657aec955f5748dd26c84682bd95

SHA256
138e5dc802fdf6072d6420521908a5951b16d62de318819a344e2bf615ba071c

SHA512
e85608d23eff9919c27ddbe957198a38637fb8d8cbe9b17790ffc6e8a5e465b40014e9fbd0a8ba573195eed7d4d050e50f176ff46d3b6f5ae4c18410e9241507

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_ga.dll

Filesize
29KB

MD5
dd73e427fd2b78ae375b2811b16cf354

SHA1
b4cc4230ab5f1d0fedabba69498b85b5e704ed8c

SHA256
e524a448471455deed6635a2163ca334898494c2c8e7dafc8f82fa64b870680e

SHA512
f7f821c3721dda4eb848d3eadf309e31879b9ff37cf0f9185789a855b835ab993dc5ef9a752d8c257b1805ff3aba27d824e3cc9c03bfaed01c47335a0f86daf4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
91d3b120ef50e80372371cc7971cb517

SHA1
2c57a4cfe6607e6e25af84236635eba74b3d8bfa

SHA256
589178a57e5b434aef8df88f846f4baeeb0e8609452daca455e6978833235000

SHA512
76cd023d9fda7208c0ce8c4d48908ff8a6e210be582ae02fdde1ac2ff1a68801bb420aec52adac4358bdb664b4e0fb510cfc2ef7974553176904b42b37380db8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_gl.dll

Filesize
29KB

MD5
f018be9cb93ea30d64c32075cbad6896

SHA1
86655e473957526e2906ae91f7d19fa44cb2ee3f

SHA256
64dd61bc661928249ca6de8074458f90ef7043c6687c223d99aaa69b41279ef0

SHA512
501bada423a815073f8a510319204234966ada88726c850c264d5cc5ca039a49f95d7d3d0711d5e7be5fa1bef5ec18f74dfd5dbad67a26070fb36321390ce686

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_gu.dll

Filesize
29KB

MD5
569a09382e5901f6d9aba5f7ee48c7f2

SHA1
ab27c3cd5ed9814f13c94c4370f992bda0298eba

SHA256
cfda4b12f03e0ca8dd1a208a3882b8c51ac1833d8f6b5677c707bb6a21a71f16

SHA512
3dd9a4f7a85509a376d28c47cb4008bb6572b347b4486cbba5e6d7d61d9419a1d49347801068d73ff3f680e0886e6b9d34201b03da5e83c398f483b8d62481bd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_hi.dll

Filesize
29KB

MD5
4b9eb0d35b4cd2f0b15db8df5f711c94

SHA1
74a4d4ea43dfc4f475d36f8d42d29d2c1765f96b

SHA256
f827ea5b8dd6a90eceb72ef944706be65196c61c8c1b611497fe323c3e6addd3

SHA512
1e7113ceb9205f0158fa5be0efc650c6f6249b681414fd2d203dd530960834de54471c430aea1ee8f51cf5d5060cac8359ffb245716889ffa0fa4b807c5a84b4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
0ec6b4c082d8ade2df7ee3444651f556

SHA1
0519287e215c7a963f9aeefb128ae798cfb62a30

SHA256
0d5168dcc701ab29bc81346a3e9dae92a0dfdf39275d46c9b9484c7654d6c38d

SHA512
02a45510b0b06a9901a9a00b81d4d0b1cb195828b581f3010cf654029c5995f8f6bb1a7631d8235f9c75468796fdf23464c2c71b60f8550fac823e8f7137a96c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
9f47ddd94ecaf45dca0cec89cfa44804

SHA1
55900ef9810fd7a248e13fca8a9f0deb85f81f08

SHA256
89fe1cb0139d4c4901ddafe903a7662fc1d6309d88bf9ea30c88da5ed393a062

SHA512
4d5e07ebe3165d42ad0fb3f8331afbd5d73f369dbd9aca6372143538773c30d5c30a5b07f455066c7c742aebd98ab123b9e1b5a3b37d2784bb4a7fa5127c69db

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_id.dll

Filesize
28KB

MD5
3fe334d051c4601788aabf3f4496bea9

SHA1
53d49e4d0ed1c0fa12ea794f1ae7aac1a00d2183

SHA256
8c679bb053da4d3eb1704526bde8e2556b7bd1accd4ef1d53453f0b62fede6d1

SHA512
421c4c35bc6cbc62860e9db074cc6f8dd47144d26202b2374850e87055a076cb1ac065a441da548d401f5b81d0eb5112dad3d1a6c74c713aab71788e920516bd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
4c24ff5b72976c7869cb5ebcf4c56d06

SHA1
99e824cfb38a4a656b876e9bf988bcb73983f3e1

SHA256
3b146d29a75d6ae40db7ea5cd78529a8a3d74e249abecd2103be306780ced845

SHA512
e985a3c9b28cb5b12d23091dfc772714566ee0a49c2726e4ea814456e9424cdeb89e02c62f35eac188246873eeca792c64bbb3e9ed6fb0a2dc032cc46957f409

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
510d0bcee90ad8da281619cc942f0a11

SHA1
61183562338c842562220194789043ce73c78eac

SHA256
41e09ecabacfe4a39e11d2ef3eeac600889b1484a57e0a56f54140c2e26c3890

SHA512
9ed9f6560b8d49079e37bf40e725c3566c01463c043421871871a9748e95e99e0ecb3f24d927e197834b02e693eae85790428bc6e5bac181817de29ab3f86e57

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
b7cb3fc2d797a0132a76d7c1ccae0d19

SHA1
68aa3aa928d40c7d8f39ce512525b9cb62f81474

SHA256
d5980a26135c5ffdb3412dee2a882b2e3e07e72fb469ee310a38afe5dbefb120

SHA512
cfe532c87d572888081d03f26e7a9408d9730579cc7a7443d97c70ef45e2acdda6e9c81fea6e29d115df0700d0d367f2578e63eafa1c81290e0befb9b0e535e2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
586db900de04ce6a1aa7b0bcc024842c

SHA1
6ecc67b860f902dee729ad18982d812e370ff375

SHA256
1229671930986a2fb8515638c38f9c9081906ac71376f1bcecf68b7c0a17e723

SHA512
9ae981a9da255b0bfc4d598fa4823a78a57fcb583c8d64bc99c037578b64e6e72e669c253e52d4c9876057cea6f3f95d294b43564672de8aba90ecf53d8c0bbd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
a5d3ad35df1ebbb13429010b8e44d6b6

SHA1
a86bc3bca8d90784406f1a52d356cea2a7b2b1a3

SHA256
c8c3763d1f84bd2455b5ea01affb34469c28bd0ef9719e3fb0cc6e3baabe63ab

SHA512
6f1ac73810b8a16ea061222d0d90050f406243b61c02111121688890370583301d57c64f27a6ac386692954c12fecc3b09ef63f66f7a741fd7ee800182d05225

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
60c04e89514e5cf972665a01fac38d5e

SHA1
4506123b76b13882e12fdff1b715bea86c1ba9f3

SHA256
2f204015f8782c5363d97d0a17b6e38691634c6b7065d4dacd72324d25728ecf

SHA512
64095f82f8f81bf230fd2aef14f963348b1c0b667a2412cfee05d315e33b762b1e25949144e9dd1c3b0e5b82d290ffa64cca2c60827142d8a33698d7dd91f2dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
14c9f1f3e2b29a58e89ffccb6537c162

SHA1
52a7bdb43cc9c4edfba1d6fde1e7e1c96fdec191

SHA256
1bc74fd1f28ecf38ce443797a532d96236bf88aaaf0550b8d5078d093fbd23c4

SHA512
cad2035fa50b0a0d1da9f0d97bfd9a019544c1a56a29ffc4bf52cbe0d4ed6b63c58a015c8a4574ed6004483f3ba47db4dc3e4826d36c58c18210252ce9aad260

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_kn.dll

Filesize
29KB

MD5
5af9e601ec6d735b1d1fcf51c55da141

SHA1
c9334407d1b4ae0246a38bd10ab469e28010cbd0

SHA256
9e46c8de6738460a3ebb6a647757265ee6874e6242fa1bb5b90a6cec2167bd50

SHA512
2fa55588132157acf3f17b47f8fccc6f44ec4512ad63f726e5b10e0a1b3db442fbbdb765d558ac2b3318a7c29dd97b9aa6b4bf2a9e186c8694189817cfcaba6d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_ko.dll

Filesize
23KB

MD5
b6179504efed1eaeb5b6850739a147fe

SHA1
0dc046131ec9cfa9a9dc7b4388e2751d44adbf27

SHA256
e4eb3462864563406c76a46a070eb6370c85aa649bb3189799c7d2dd8f268a6d

SHA512
52fb56aa0984dca45a68c86fd4c0d7c9679c37badd2c76013eb480a28443317ab7d0d68f0d5d60692bf1526a8f8ae75080ac1899602744e283eda8b06ccfac5e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_kok.dll

Filesize
28KB

MD5
ae751951cabc681ed7c5626963e5d09c

SHA1
14c9f363356afe2f3e451e52735560dbea711ac6

SHA256
6984055df00575b82f5dd24c10a185458806c0f6b96c0f495cb637297f5379bc

SHA512
174fc770367604fc132d5f7fe04991d9890565ed7a88b377c4fe457edcaa90efc92a61174c38c219c2ea557a162acb6a921efe43f2f00c50f212e4d19bc60f6a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_lb.dll

Filesize
30KB

MD5
ffcd0a3d723166848959cf63db1e4d9a

SHA1
3b70dff34251ef5f0169200cfdc15ae1f16b2f2a

SHA256
afe9863cbca93449b09bde09bee7485cf94d0c11ede7c066d8e1564296c4626e

SHA512
0d9e42d94349f5e1983d737592e756ad0ef314478dd2a0864e2f29bb128dd2063f33fbc54964c8baf6ab0fdbdfed69bf533391e31991e2e96824ce79cb04467c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_lo.dll

Filesize
27KB

MD5
38acf519fb1cf356dc4582bad85cd3e3

SHA1
b8b0e24ba2e37a9c52b9586e598092f1631e3146

SHA256
55abd80b89c901472a8eeb818172fec1e80e9c6ade6e85cea790dd4a03196588

SHA512
d8adb48b860044bef252ad32b743e2a0fe53087a6b1e56a4c0081407bbc66545e72ca911a1bac0fd7f112642fd18d729b246755c7803fd16ca43ecd55fe71b2f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_lt.dll

Filesize
28KB

MD5
26e5b799469a4696081d71e65542f39f

SHA1
1ac091579aa970d84d1c94ed66723ee5d6da1420

SHA256
2a00d6ef141c4cb765d31e1cdfc50eec63d9d50345049ff9e3de6b5cd8927547

SHA512
c40237a5eee5778bd5003a0cac29643b34b4e7be419a6ff2f05fec66827a7bbece7d328164653f53ad8dfce7cd7091bc0cd390cf52b7ae798af15c3ce9aea93d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_lv.dll

Filesize
29KB

MD5
3bcaab993c8933941cdb1ab9accac80f

SHA1
caf0a9d20d4ebac2604eeec24b86065fe871b3d2

SHA256
dceb24a733bf7854f4f0ddf072f2c498cfa1ddce5fe3bad4be409d7153633449

SHA512
a3804846ec7d4f28eb8a578f28b3a1991acf92578d99b64e426bee2200a9aed13c000afde5f5399933f0e118a2776237f1c5dc6e5c6232f1febed34b39ab5c08

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_mi.dll

Filesize
28KB

MD5
343173b521c24e8ff7ff00827ce85248

SHA1
c963765472f0634aeadeb62c8c494f2931384c94

SHA256
231e0f9d06cf19b5f5296dc5e5edb33e70d025e538d81b1868c50361e3f63b74

SHA512
6569814cf553b385864d28ee145d60c4c344ec6715f346a9067826512da38c4ff589d77921e36a8dd8b72e3c2243e97fcf9daa709c71212723458feaf92bf0ba

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU9CF.tmp\msedgeupdateres_mk.dll

Filesize
29KB

MD5
f70e2827cbf3f7f3eb0690584a0fea68

SHA1
1401aec9fddacf2603969ef1cec78678234d97c7

SHA256
f020683f38eaa25542083ffc7e39863eab09f5ac07e01a205c43aff03cd373f9

SHA512
519e4ca58960964c96e637fe6e29302656e213135b420ccd41b5295ccd46a2cb191b3aea718cf0e2ccc6bb3a97da396203adfcde636f9689cada5e1cb2fac819

Download Submit
C:\Program Files\JJSploit\JJSploit.exe

Filesize
9.7MB

MD5
8c6a8bfd1adf6ccdfe9b65b514479ec7

SHA1
08f64d25974040ade826f0c79fd638c6a67627c1

SHA256
097eb40a9a1572788272298f48748e80053c9e83f2734387728ea689afc9bfa4

SHA512
8ca0ff01add66e8a5fc7db5cbee09fdf2aeda2026c7787370d6d8831c86b504bd50c587bea8ef32fb57f44ea4d9366d456fa071c30ae85708326529cb2800791

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
0c0e229e101c969862ff6a7bb673b015

SHA1
96590b75fdca3db2c674c8157cd6faa830892743

SHA256
63623a4d12b58417683f1cf881826215debe2cc5b86c8167fbbca03393f6e81f

SHA512
750a6543f87a91cd852992ce94c1cfa43d610f783bebe8cfbc25a939a2646973c248c86a963aef4acbc6231a85b3f1bb9a809fd48a63941f8cadfaa8552890fe

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
81KB

MD5
a6685760890805d4526cef840c09ccbd

SHA1
0545de0182eaa9ac37684cf5026267e3bbf60dc3

SHA256
93a754bc485c2536122da565e28222d8578aa8c8d226b7fd6e768e3a7427b9db

SHA512
0851c8dbae7385e8c2d7729faf0715bf4c388be39e7d3bb008369ce52dc5a55f9e380b9127898a985d6d1143ae93531b23b78c75a69860eefb32412cd02e9093

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk

Filesize
1KB

MD5
cc51a0325d7fbb88de8f5a31d00005bf

SHA1
6e54082e38fbeb17c2e1062eea9d44b0776a1a78

SHA256
03027d85e11f5562326c911eba0aeebf562634477c9ce92743889fc8c97aa15f

SHA512
81ae279798b8948293352b8e28375de96e49748ed857e275be9c071638e9eae8307f842e82cdc7260fc13ede0791cdf58e0bb112dd18097372bc90cf666d581f

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk~RFe57fdb9.TMP

Filesize
1KB

MD5
7d6d31e3040f9b9f6498016927d230c5

SHA1
f7930d9bcb891f1f4be8571a460fbdb8f5254aa4

SHA256
4affa95539308be9ee66525d255931fecc5b8ff3e89f0380d864be42ac368dd8

SHA512
13c41691a87550f6beec4d0849f5beef8d5ea453d13f5112bfb3f13ccd792f7bdde406321cba637d31624c2764010478faad0964a0a77ecdd7b510ebbcdc1351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
5b529322397d11da09d4ca93701f40f8

SHA1
692cf216ae2bf2baac91ebc90c95ee0d64f55d99

SHA256
3c651a044dd5c09ad0a45344b5ba712bb03b7310e91dc2b677a18a12ef6a1b4c

SHA512
55f07d94ae065bc8ffcd733cbb7f397ae0fd2c086c6ee7468dea7fd3217063707bad32c85f4ee6e566f88a5b0eed9361caf9d7d5d66f8c6b3676924121ea4ba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f1eb73aad92f32a1f1a016142ab7b598

SHA1
ca395c2ec83b886f92051ba9e11f75ff88ce208a

SHA256
28b8ac8e609fe15225d9c431cc06da4229a34367487a9f0ef6d8f9f737d98f4a

SHA512
e53f8c60d67302463eea638d241f82c3769ca5acd51f8f794be205ed5aec2794ed9f26b0cb391efdb7c4dadaf8c633a0bedd68313c83bcc39dd9eb7269ab64b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df70b123d8b5d1f86fdaa26e60dece35

SHA1
591f4314a652a99efec808eaa2199a79e027bdba

SHA256
60378aa4458c3e67d6ee95bb2a1259b956b113c6d899fccb8ce664e756ab06e8

SHA512
3e5fd29b3814d55a2434f38bfcfb596f6415b3c3e37eea45e38374d2abd1e7217350d35365ad97c3f9a7e4b9c385919a2b426eb69cab63812ae0c37f0d5fa2d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
5a482f13a210bddd97a2d88b0ca36709

SHA1
ac5d0977cc54ebb19c378324bd83ce7e97b9e73b

SHA256
694a607ffd5b5979561a13c8e38ff5900c9185cd56a042eaaa963ac633bd2c4c

SHA512
f9698702ec008e3399d8a4ecdf507c38572c761510fad6a3272d8699ee5e5423864a1e3c6fe885c5bd6999163f97fa531c86b4dd59f2f9495f328a70d3440052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4ce235cc1c02e55c37a7ee127deb46ea

SHA1
e0a5e50a6488ab5b950077f3c8d72199648d626a

SHA256
bb9a2e9bddc69fc2466580a5cd96936ce960a5e014c0fc866547005ae5056ac8

SHA512
177fb386f68840fda3e4f1f86bf82c2f4be3d1390e557bafafdfc0b8f48b8ab0a978c46ef1149f1ead6105786f1dda5d84efa6eb51499f3d1085514e6caf3e3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB342.tmp

Filesize
132KB

MD5
cfbb8568bd3711a97e6124c56fcfa8d9

SHA1
d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57

SHA256
7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc

SHA512
860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

Filesize
1.6MB

MD5
ec5b2a3126f46e01e1fcbb215d4f9ec8

SHA1
77cfa2daad5e57e62d39c5f7323c4f68032c3152

SHA256
09c2a441a22186cbcc90e0a79556c4c696446740955c9031f8b52e84c7cd4ec1

SHA512
b0f5ec2cd2f120de85408a57070ffc078cad2eb8cc6f93874008c392a0f7629f6ecba9d74cd3462f7868f110b12664853eae11c64f3b2d237dd4f901a1f307b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eth2br0q.hf4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
c735341e278aad7fa8f3b5223ef6faec

SHA1
9e074ec1f929ce37d3582cc35337da758dbd935f

SHA256
4ce72dbf81aa99f0ae708a9120fa772897bed29ad46f4b1ab49af11d486ff9b5

SHA512
b086cc7747579e632243bb738d0214dc2b7bc77973f545b9d82e87a2e19c1c6e277c83d75077c11069dc8e9c47d429db98447982456b3e157cc8c73bf889dca9

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
2KB

MD5
eb488f7ba8dbe5cc4c959edf397bfbe6

SHA1
df5ad69bce4afff1af2cdffaede2223cf23cd4e2

SHA256
0ca29ec8b7a6f5587759ee944dc19a1ed5fbaacd59d63048b2ce1a451948efcb

SHA512
6f281aa3c1da16b45ad001323a0f6ff1e57c9f978e23f713e743c2107d813a834977d38827def757c73b19bef8e081f411299f6d25b8f143b1c67b8fd945b5f4

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
3KB

MD5
04c38f6c43b76d468101e4e146020e39

SHA1
ea57b1a7af6b197050e00fe6017159d7f38c5d03

SHA256
d3123949836b4c8bd9757cbdd294b8dca03bab02005011ce158ed014ce991f85

SHA512
76226ec316b3643e6b32c8214f113b0c78abb25e331246d1806221ea32bc54c76917a5cdd31ab756365675e40fc414177edcd58d3faf34a3a532ca46402b9c60

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
16KB

MD5
e8e4b1eaba4f62c7c613538ebe3d8d1b

SHA1
98be6046fcbb875761cf75bd6417746ae4ffa300

SHA256
b544b80d005b9da81c474561d7ebc340bbad17fbea789ec3ad0d16486a839522

SHA512
10489dfaa283dc65797b9cf05dc5878b7caadfd8253407b67da15eb35c9a91a5e9c27aa36caadf82aa18ac10f952a581459f3ea9f6df21a7c784169ab682d7df

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
1KB

MD5
99345e9a92f6b9d517e281fbe1ae8851

SHA1
e1c4e4622c69f57821567e5e1f86e894b9b52759

SHA256
73c7f0a6207b299f4cc36e0abfc2e3824e4e29b18959fa7b9fe10294fb9c6466

SHA512
f34088e6aaf4c62ace93da159f1fd29db726b5ede51a3427541b745ac498a89388f8d4308e3584319c95b0eedf2aa0a860be844bc38aa82c48a8a2ce5360a308

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe59672c.TMP

Filesize
1KB

MD5
3e24321dfcff3c3877354631849ab501

SHA1
b4a59be3a8d7dda88d1855bb1322aa0a69021570

SHA256
4a10d67ad892f14d735d520c4622f3ae78412d3f401762e4393c1f3915232d73

SHA512
8866e94b65d08c7163dd8f0a51d64fc007248a86adfea444cc92bb46e2a643925317dacf29b14ea882eeb81aa17f15a7d31dc1305aaabb00b4cf5b8585045387

Download Submit
C:\Windows\Installer\e57fb77.msi

Filesize
5.0MB

MD5
8cb1e85b5723e3d186cc1742b6c71122

SHA1
f4638a9849b2bea46c8120930c7727cfae70b4d2

SHA256
f1db224af0f14b971ba8be3e33482322b2f821695a4bbe2782b956217da383ad

SHA512
b447f7b4e6590120ed50eaad798b271e7ebbe52ad61dbe5e621e0c99a6314fbcfd10ce8e6f837a7ca76e1084651c65dcb0eafcdac6cce6eebe2d1729249add5b

Download Submit
memory/2908-428-0x00007FFA2CED0000-0x00007FFA2CED1000-memory.dmp

Filesize
4KB

Download
memory/2944-327-0x0000000000850000-0x0000000000885000-memory.dmp

Filesize
212KB

Download
memory/2944-309-0x0000000074680000-0x00000000748A6000-memory.dmp

Filesize
2.1MB

Download
memory/2944-266-0x0000000074680000-0x00000000748A6000-memory.dmp

Filesize
2.1MB

Download
memory/2944-265-0x0000000000850000-0x0000000000885000-memory.dmp

Filesize
212KB

Download
memory/4680-421-0x00007FFA2D360000-0x00007FFA2D361000-memory.dmp

Filesize
4KB

Download
memory/4680-422-0x00007FFA2D090000-0x00007FFA2D091000-memory.dmp

Filesize
4KB

Download
memory/4688-61-0x000001A654080000-0x000001A6540A2000-memory.dmp

Filesize
136KB

Download
memory/5052-383-0x00007FFA2CED0000-0x00007FFA2CED1000-memory.dmp

Filesize
4KB

Download