Overview

overview

8

Static

static

3

DLL Inject...US.msi

windows11-21h2-x64

7

DLL Inject...US.msi

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    600s
  • max time network
    588s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 22:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DLL Injector_2.3.1_x86_en-US.msi
  • Size 3.7MB
  • Sample260809-19wwfazwas
  • SHA256 c1c7c5d3eaf119905dd0c57cc4b67418a07a1bc8fd156429aff5e92a254ee5f2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 23 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks system information in the registry 2 TTPs 16 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 6 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\DLL Injector_2.3.1_x86_en-US.msi"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5796
    • C:\Program Files (x86)\DLL Injector\DLL Injector.exe
      "C:\Program Files (x86)\DLL Injector\DLL Injector.exe"
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4652
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4652.3312.2086889725900929084 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
        3⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView /prefetch:4 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9a4045fd8,0x7ff9a4045fe4,0x7ff9a4045ff0
          4⤵
            PID:5268
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1580 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
            4⤵
              PID:5604
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1988 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
              4⤵
                PID:4932
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2260 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
                4⤵
                  PID:1168
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3268 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3 /prefetch:1
                  4⤵
                    PID:572
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2196 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
                    4⤵
                      PID:4612
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4408 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
                      4⤵
                        PID:6492
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4404 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
                        4⤵
                          PID:7092
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4412 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
                          4⤵
                            PID:2328
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4456 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
                            4⤵
                              PID:4884
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4580 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
                              4⤵
                                PID:1924
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2092 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
                                4⤵
                                  PID:6128
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4512 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
                                  4⤵
                                    PID:4744
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4624 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
                                    4⤵
                                      PID:1308
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4624 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
                                      4⤵
                                        PID:4920
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView" --webview-exe-name="DLL Injector.exe" --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4532 --field-trial-handle=1736,i,4558625724552965716,11688984271523301557,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b1c589f381b9e2d69f1f5673d1877491b317dbb3
                                        4⤵
                                          PID:6816
                                  • C:\Windows\system32\msiexec.exe
                                    C:\Windows\system32\msiexec.exe /V
                                    1⤵
                                    • Enumerates connected drives
                                    • Drops file in Windows directory
                                    • Modifies data under HKEY_USERS
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:1268
                                    • C:\Windows\syswow64\MsiExec.exe
                                      C:\Windows\syswow64\MsiExec.exe -Embedding 7CD075354E49C864E82D615AF9876FA9 C
                                      2⤵
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1648
                                    • C:\Windows\system32\srtasks.exe
                                      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                      2⤵
                                        PID:3308
                                    • C:\Windows\system32\vssvc.exe
                                      C:\Windows\system32\vssvc.exe
                                      1⤵
                                      • Checks SCSI registry key(s)
                                      PID:3192
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                      1⤵
                                      • Enumerates system info in registry
                                      • Modifies data under HKEY_USERS
                                      • Modifies registry class
                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of WriteProcessMemory
                                      PID:2352
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9a4fec728,0x7ff9a4fec734,0x7ff9a4fec740
                                        2⤵
                                          PID:1844
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,560704711231429550,14810293281390956923,262144 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=1816 /prefetch:2
                                          2⤵
                                            PID:4528
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,10793461281924046899,15992856954509770060,524288 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
                                            2⤵
                                            • Downloads MZ/PE file
                                            • System Time Discovery
                                            PID:1800
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,8570115872737373698,13283226807565915594,524288 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:13
                                            2⤵
                                              PID:2772
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,4127294115933191777,9807883397621633192,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
                                              2⤵
                                                PID:5628
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,1018798556619593336,17146092277454941642,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
                                                2⤵
                                                  PID:3256
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4664,i,17841902770322309136,16547920155790906705,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
                                                  2⤵
                                                    PID:3680
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,18315523098734960124,2987331982653178197,524288 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
                                                    2⤵
                                                      PID:2428
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,691043049060433547,9002396295881288843,524288 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
                                                      2⤵
                                                        PID:3732
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5492,i,7823732606411282181,15849988995474351321,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
                                                        2⤵
                                                          PID:4884
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5520,i,14772048198406244643,146622551087031288,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
                                                          2⤵
                                                            PID:4908
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5568,i,378553986407917433,17018343887617093714,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
                                                            2⤵
                                                              PID:4920
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,7552331271252353049,414406320779971649,524288 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
                                                              2⤵
                                                                PID:5852
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5668,i,4522744666198522382,6045968946951935262,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
                                                                2⤵
                                                                  PID:5368
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5816,i,4246291739421387723,16774084603269594269,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
                                                                  2⤵
                                                                    PID:2420
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5768,i,17731136827569307349,7106326569043074187,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
                                                                    2⤵
                                                                      PID:4596
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,1384409149029988062,5208291647518010143,524288 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
                                                                      2⤵
                                                                        PID:5908
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5488,i,11331050468671509570,14735519944986611478,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
                                                                        2⤵
                                                                          PID:4584
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,5260360693632511180,16268445098538055187,524288 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
                                                                          2⤵
                                                                            PID:4156
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6092,i,8458044735889727030,17636773184399481977,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
                                                                            2⤵
                                                                              PID:5372
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4704,i,2418712105451474507,7980233405332921741,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:9
                                                                              2⤵
                                                                                PID:4672
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6124,i,1173718916856677031,7256417559919475310,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
                                                                                2⤵
                                                                                  PID:4464
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,13557933287636645979,8379741227174041128,524288 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
                                                                                  2⤵
                                                                                    PID:6908
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,9478889968771573519,9967743517429602878,524288 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
                                                                                    2⤵
                                                                                      PID:6916
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,14552523065170962652,8896063598647344394,524288 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
                                                                                      2⤵
                                                                                        PID:6924
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4440,i,10442888975060320519,16155327098997382820,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
                                                                                        2⤵
                                                                                          PID:4248
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6612,i,10881379724924861928,7220585207510443957,524288 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
                                                                                          2⤵
                                                                                            PID:2748
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6004,i,1247586498585736251,3237284730590624283,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
                                                                                            2⤵
                                                                                              PID:6504
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4692,i,17069623137355104473,13274591302598122237,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
                                                                                              2⤵
                                                                                                PID:6608
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=3540,i,14127342672392854396,9127939273413622027,2097152 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:4432
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3504,i,17271906311627093408,5840610084669452862,524288 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:14
                                                                                                  2⤵
                                                                                                    PID:6960
                                                                                                  • C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe
                                                                                                    "C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe"
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:6580
                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\MicrosoftEdgeUpdate.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                                                                                                      3⤵
                                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      • Checks system information in the registry
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:6876
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Modifies registry class
                                                                                                        PID:6952
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Modifies registry class
                                                                                                        PID:7084
                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                          5⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Modifies registry class
                                                                                                          PID:7108
                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                          5⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Modifies registry class
                                                                                                          PID:7128
                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                          5⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Modifies registry class
                                                                                                          PID:5992
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuMjMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNTEuMjMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NEQ0MEEwNkMtQTU5Qy00RTU3LUIzNUEtNzEwQjQyRDI5MzNDfSIgdXNlcmlkPSJ7QUJBRkYzN0EtMzI1Ny00QTRBLTg1MEYtOTVFMEEyMjgzNDU0fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezZBMkZFODc1LTQ1NkItNDRBNS04NkZELTQ2M0VGODI2NDUxMX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSIxNiIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjI2MTAwLjE3NDIiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxOTEiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7WExBRis0L2gxaHJudDZ2NzJrcUsxMnBTaE9LMlJsbjJ6OXRVWjh3S2F3cz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS42NSIgbmV4dHZlcnNpb249IjEuMy4yNTEuMjMiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc4ODcwMTY1MDEiIGluc3RhbGxfdGltZV9tcz0iOTY5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • Checks system information in the registry
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                        PID:840
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{4D40A06C-A59C-4E57-B35A-710B42D2933C}"
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3504
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5696,i,8502719330186266483,15351670454969996285,262144 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:10
                                                                                                    2⤵
                                                                                                      PID:2076
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3560,i,4535013399044691936,17608474753198278350,524288 --field-trial-handle=1820,i,3709360038351564141,12930684408202801635,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:14
                                                                                                      2⤵
                                                                                                        PID:5956
                                                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                      1⤵
                                                                                                        PID:3412
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                        1⤵
                                                                                                          PID:4200
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                          1⤵
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:5844
                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Checks system information in the registry
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:4276
                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuMjMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNTEuMjMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NEQ0MEEwNkMtQTU5Qy00RTU3LUIzNUEtNzEwQjQyRDI5MzNDfSIgdXNlcmlkPSJ7QUJBRkYzN0EtMzI1Ny00QTRBLTg1MEYtOTVFMEEyMjgzNDU0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDUxM0M0OUItNDhCMi00QkQ5LTkwOEItREUwRjI1MjY4QTJFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjE5MSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtKbkJBVXlNTHhNMmtEdlBMcnVPYVNtWUZRbGdsa1E3TEFjZkEvNitUQWFjPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxNDAuMC43MzM5LjgxIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzMSIgaW5zdGFsbGRhdGV0aW1lPSIxNzgzNjA4MDYzIiBvb2JlX2luc3RhbGxfdGltZT0iMTM0MjgwODAyMzUzNzYwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iODYwNjU5NDMiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc4OTQyMzYwMTIiLz48L2FwcD48L3JlcXVlc3Q-
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Checks system information in the registry
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:6184
                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B86120AE-566F-4F30-83A8-FE2C4098C665}\MicrosoftEdge_X64_151.0.4129.72.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B86120AE-566F-4F30-83A8-FE2C4098C665}\MicrosoftEdge_X64_151.0.4129.72.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:3624
                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B86120AE-566F-4F30-83A8-FE2C4098C665}\EDGEMITMP_44B20.tmp\setup.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B86120AE-566F-4F30-83A8-FE2C4098C665}\EDGEMITMP_44B20.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B86120AE-566F-4F30-83A8-FE2C4098C665}\MicrosoftEdge_X64_151.0.4129.72.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in Program Files directory
                                                                                                              PID:6820
                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\151.0.4129.72\Installer\setup.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\151.0.4129.72\Installer\setup.exe" --msedgewebview --delete-old-versions --system-level --verbose-logging
                                                                                                                4⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                PID:7052
                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuMjMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNTEuMjMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NEQ0MEEwNkMtQTU5Qy00RTU3LUIzNUEtNzEwQjQyRDI5MzNDfSIgdXNlcmlkPSJ7QUJBRkYzN0EtMzI1Ny00QTRBLTg1MEYtOTVFMEEyMjgzNDU0fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezUxN0E3NDk5LURFNEMtNEJFNi04NDAwLUY1OTYzOTU0MDdDNH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSIxNiIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjI2MTAwLjE3NDIiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxOTEiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7SGh2SElXcFVOWlRNblYyVlQxbGUzZjVZSlE5T1NvVEQ2TXhIRGxBODlQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTUxLjAuNDEyOS43MiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjMxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTM0MzA3ODc3NDgwNjgyMDMwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc5MDY4MjQwNTciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3OTA2OTQ5MjgyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODEwNDEzNDI4MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNzIxMDgxZTgtYmRjOS00M2IwLWIzODYtNGE1ZWQ4YjZhNTI0P1AxPTE3ODY5MTkxMzQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9UGNhNkFMM2FjNjBwR1FsY29nQW52SXN2bm9lZiUyYjlMWlJhQkxBNG5qYWJjemlWJTJmSHVIdCUyZkliYmRjY0JzRThlRlJJd3NCejhSN0g0WHl2MnY1SWhiZ3clM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIyMDM1NTQ2NDAiIHRvdGFsPSIyMDM1NTQ2NDAiIGRvd25sb2FkX3RpbWVfbXM9IjE2MjYwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODEwNDQwMjIyMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgxMjI3OTAzODQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg0ODA2MjIzNzQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI2ODUiIGRvd25sb2FkX3RpbWVfbXM9IjE5NzE2IiBkb3dubG9hZGVkPSIyMDM1NTQ2NDAiIHRvdGFsPSIyMDM1NTQ2NDAiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjM1Nzc0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Checks system information in the registry
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                            PID:5560
                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • System policy modification
                                                                                                          PID:3968
                                                                                                          • C:\Windows\SysWOW64\wermgr.exe
                                                                                                            "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3968" "880" "836" "832" "0" "0" "0" "0" "0" "0" "0" "0"
                                                                                                            2⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:6176
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                          1⤵
                                                                                                            PID:6940
                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Checks system information in the registry
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5404
                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Checks system information in the registry
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:6384
                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3E90776C-2876-441A-9762-5A733C852BA4}\MicrosoftEdge_X64_151.0.4129.72.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3E90776C-2876-441A-9762-5A733C852BA4}\MicrosoftEdge_X64_151.0.4129.72.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:4420
                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3E90776C-2876-441A-9762-5A733C852BA4}\EDGEMITMP_01FEA.tmp\setup.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3E90776C-2876-441A-9762-5A733C852BA4}\EDGEMITMP_01FEA.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3E90776C-2876-441A-9762-5A733C852BA4}\MicrosoftEdge_X64_151.0.4129.72.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                                                                                3⤵
                                                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                                                • Executes dropped EXE
                                                                                                                • Installs/modifies Browser Helper Object
                                                                                                                • Drops file in Program Files directory
                                                                                                                • Modifies Internet Explorer settings
                                                                                                                • Modifies registry class
                                                                                                                • System policy modification
                                                                                                                PID:6344
                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3E90776C-2876-441A-9762-5A733C852BA4}\EDGEMITMP_01FEA.tmp\setup.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3E90776C-2876-441A-9762-5A733C852BA4}\EDGEMITMP_01FEA.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Drops file in Windows directory
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  PID:6868
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\151.0.4129.72\Installer\setup.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\151.0.4129.72\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in Windows directory
                                                                                                                  PID:3192
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\151.0.4129.72\Installer\setup.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\151.0.4129.72\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:5572
                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuMjMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNTEuMjMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTJGMkFEOEMtNjQ2RC00NTVBLTk2MUYtM0JCNkRFREMzNzI2fSIgdXNlcmlkPSJ7QUJBRkYzN0EtMzI1Ny00QTRBLTg1MEYtOTVFMEEyMjgzNDU0fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins4MkMyRjM1OS0yNTYxLTQ2RkEtQkRBOC00RkQ5ODA1ODhEREN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTkxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O0puQkFVeU1MeE0ya0R2UExydU9hU21ZRlFsZ2xrUTdMQWNmQS82K1RBYWM9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4yNTEuMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzMSIgY29ob3J0PSJycmZAMC4xMiI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSItMSIgcmQ9Ii0xIi8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjEzOS4wLjM0MDUuMTI1IiBuZXh0dmVyc2lvbj0iMTUxLjAuNDEyOS43MiIgYXA9InN0YWJsZS1hcmNoX3g2NCIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIzMSIgb29iZV9pbnN0YWxsX3RpbWU9IjE4NDQ2NzQ0MDczNzA5NTUxNjA2IiB1cGRhdGVfY291bnQ9IjEiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzQyODA4NTk5NjI0MDkzNzAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMTcyNjg1MzQzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMTcyNzg1ODU3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMjA1OTk2MzQwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMjIxNjE5MzcwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTQ1MzAzMzExNyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM3OCIgZG93bmxvYWRlZD0iMjAzNTU0NjQwIiB0b3RhbD0iMjAzNTU0NjQwIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMiIgaW5zdGFsbF90aW1lX21zPSIyMzEzNyIvPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ii0xIiBhZD0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9IntCQjhEQzBFQi04QjQ1LTQ3QUMtQjAzNy0zMTM1MTc5OTA1MjF9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjE1MS4wLjQxMjkuNzIiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMzEiIGNvaG9ydD0icnJmQDAuNjQiIHVwZGF0ZV9jb3VudD0iMSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzNDMwNzg3NzQ4MDY4MjAzMCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjAiIHI9Ii0xIiByZD0iLTEiIHBpbmdfZnJlc2huZXNzPSJ7Q0Q3Mzk3MEYtNUE0OC00NEY3LTg4RDktOUQ5NjE1MEY1M0Y5fSIvPjwvYXBwPjwvcmVxdWVzdD4
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              • Checks system information in the registry
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                              PID:4900
                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                            C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
                                                                                                            1⤵
                                                                                                              PID:6160

                                                                                                            Network

                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                  Reconnaissance

                                                                                                                  Resource Development

                                                                                                                  Initial Access

                                                                                                                  Execution

                                                                                                                  Persistence

                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                  1
                                                                                                                  T1547

                                                                                                                  Active Setup

                                                                                                                  1
                                                                                                                  T1547.014

                                                                                                                  Browser Extensions

                                                                                                                  1
                                                                                                                  T1176

                                                                                                                  Event Triggered Execution

                                                                                                                  2
                                                                                                                  T1546

                                                                                                                  Component Object Model Hijacking

                                                                                                                  1
                                                                                                                  T1546.015

                                                                                                                  Image File Execution Options Injection

                                                                                                                  1
                                                                                                                  T1546.012

                                                                                                                  Privilege Escalation

                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                  1
                                                                                                                  T1547

                                                                                                                  Active Setup

                                                                                                                  1
                                                                                                                  T1547.014

                                                                                                                  Event Triggered Execution

                                                                                                                  2
                                                                                                                  T1546

                                                                                                                  Component Object Model Hijacking

                                                                                                                  1
                                                                                                                  T1546.015

                                                                                                                  Image File Execution Options Injection

                                                                                                                  1
                                                                                                                  T1546.012

                                                                                                                  Defense Evasion

                                                                                                                  Modify Registry

                                                                                                                  4
                                                                                                                  T1112

                                                                                                                  Credential Access

                                                                                                                  Discovery

                                                                                                                  Browser Information Discovery

                                                                                                                  1
                                                                                                                  T1217

                                                                                                                  Network Share Discovery

                                                                                                                  1
                                                                                                                  T1135

                                                                                                                  Peripheral Device Discovery

                                                                                                                  2
                                                                                                                  T1120

                                                                                                                  Query Registry

                                                                                                                  6
                                                                                                                  T1012

                                                                                                                  System Information Discovery

                                                                                                                  6
                                                                                                                  T1082

                                                                                                                  System Location Discovery

                                                                                                                  1
                                                                                                                  T1614

                                                                                                                  System Language Discovery

                                                                                                                  1
                                                                                                                  T1614.001

                                                                                                                  System Network Configuration Discovery

                                                                                                                  1
                                                                                                                  T1016

                                                                                                                  Internet Connection Discovery

                                                                                                                  1
                                                                                                                  T1016.001

                                                                                                                  System Time Discovery

                                                                                                                  1
                                                                                                                  T1124

                                                                                                                  Lateral Movement

                                                                                                                  Collection

                                                                                                                  Command and Control

                                                                                                                  Exfiltration

                                                                                                                  Impact

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  e59a213.rbs
                                                                                                                  • Path C:\Config.Msi\e59a213.rbs
                                                                                                                  • Size 10KB
                                                                                                                  • SHA256 8cd34a978a35dcf381b013cdfdd9d89f1462850447ed7eeec137d306a2a6c173
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  DLL Injector.exe
                                                                                                                  • Path C:\Program Files (x86)\DLL Injector\DLL Injector.exe
                                                                                                                  • Size 9.5MB
                                                                                                                  • SHA256 8b789c9b9f1635340698a1609a206cf04b46dfd95dda5ce883135496f4204f51
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  SETUP.EX_
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3E90776C-2876-441A-9762-5A733C852BA4}\EDGEMITMP_01FEA.tmp\SETUP.EX_
                                                                                                                  • Size 2.3MB
                                                                                                                  • SHA256 75339443929185681e7c17fcb03335bcc3f4aa94cbf899ebfde571928fa50f84
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  setup.exe
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3E90776C-2876-441A-9762-5A733C852BA4}\EDGEMITMP_01FEA.tmp\setup.exe
                                                                                                                  • Size 5.2MB
                                                                                                                  • SHA256 ab7cdab9b7b7f9f2b205b0015a2cce435a3c3741505491b769bce8f321756404
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  msedge_7z.data
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\151.0.4129.72\Installer\msedge_7z.data
                                                                                                                  • Size 5KB
                                                                                                                  • SHA256 eeb4153598e650bcb462e850cd2252d003f9fb0e5772550cf76f3027154ffc90
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  CopilotUpdate.exe
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\CopilotUpdate.exe
                                                                                                                  • Size 22KB
                                                                                                                  • SHA256 7ee38e82a14914db6bfa8fd879366cc4eda36ab87c748d61949fc287397ecbb9
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  EdgeUpdate.dat
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\EdgeUpdate.dat
                                                                                                                  • Size 12KB
                                                                                                                  • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  MicrosoftEdgeComRegisterShellARM64.exe
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\MicrosoftEdgeComRegisterShellARM64.exe
                                                                                                                  • Size 194KB
                                                                                                                  • SHA256 35ec821fadfa8209de2886509ae03a1aa6fb7920add0bee5220476bfde0b0f64
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  MicrosoftEdgeUpdate.exe
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\MicrosoftEdgeUpdate.exe
                                                                                                                  • Size 202KB
                                                                                                                  • SHA256 66a9c98a32f8fd576a346863a450f247318250cac103a8e4f04ec2d1cd5eee4a
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                                  • Size 227KB
                                                                                                                  • SHA256 26141f72749fafe473f67bb250b1483900c19b8845e74b69ba46e6c3e443a377
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  MicrosoftEdgeUpdateCore.exe
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\MicrosoftEdgeUpdateCore.exe
                                                                                                                  • Size 274KB
                                                                                                                  • SHA256 78b6ec0464be3aba9513e6d1244d42a0f8ea6d1ddfaf3a24e74ba87576851d33
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  NOTICE.TXT
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\NOTICE.TXT
                                                                                                                  • Size 4KB
                                                                                                                  • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  msedgeupdate.dll
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\msedgeupdate.dll
                                                                                                                  • Size 2.3MB
                                                                                                                  • SHA256 767d381c7aa5a39191e5c9dcb5e590d56c9741ea80ce2fe11ad85e5e9b2fee5f
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  msedgeupdateres_af.dll
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\msedgeupdateres_af.dll
                                                                                                                  • Size 29KB
                                                                                                                  • SHA256 4ed7a33fc981a85697d84033539c75733e5fa1a17c96f16216e446bb8118244b
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  msedgeupdateres_am.dll
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\msedgeupdateres_am.dll
                                                                                                                  • Size 24KB
                                                                                                                  • SHA256 3c6224236a9b6dfffc0829c229392acc51d1dff8a86ca37a45249db739e4b780
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  msedgeupdateres_ar.dll
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\msedgeupdateres_ar.dll
                                                                                                                  • Size 26KB
                                                                                                                  • SHA256 818e439014cca00a9054db87e131e6f4a6bd2a1018806995d7109fe1453972d3
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  msedgeupdateres_as.dll
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\msedgeupdateres_as.dll
                                                                                                                  • Size 28KB
                                                                                                                  • SHA256 ab552f9f4e58f5b4c2d9160dff7aa98ad544f52f428ee039970061d38e088e74
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  msedgeupdateres_en.dll
                                                                                                                  • Path C:\Program Files (x86)\Microsoft\Temp\EU84E7.tmp\msedgeupdateres_en.dll
                                                                                                                  • Size 27KB
                                                                                                                  • SHA256 f95a7d7cd5c3257d694cc5ceb105348aa75522dd1a9b479338721f0cad44cd77
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  MicrosoftEdgeUpdate.log
                                                                                                                  • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                                                                                                  • Size 193KB
                                                                                                                  • SHA256 0b9c3f2d8749f545817c8968c597e5413591b10a748669228c61fe61241a566b
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  DLL Injector.lnk
                                                                                                                  • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DLL Injector\DLL Injector.lnk
                                                                                                                  • Size 2KB
                                                                                                                  • SHA256 d614a5b38129045a0ee98569392cf72ed08bbd161ed0fad21de5ff61106b5582
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  DLL Injector.lnk~RFe59a8d9.TMP
                                                                                                                  • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DLL Injector\DLL Injector.lnk~RFe59a8d9.TMP
                                                                                                                  • Size 1KB
                                                                                                                  • SHA256 77a567bf108ddd88e279e8137ede6938599bb793aabfb20bef81a13bc423cf72
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  BookmarkMergedSurfaceOrdering
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                  • Size 6B
                                                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  f_000014
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
                                                                                                                  • Size 331KB
                                                                                                                  • SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  the-real-index
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                  • Size 1KB
                                                                                                                  • SHA256 032cafc632d6ddd08130a3729e879037e82960a49ec5513cc973c0df06feaefb
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  messages.json
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                                                                  • Size 593B
                                                                                                                  • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  craw_background.js
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                                                                  • Size 531KB
                                                                                                                  • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Network Persistent State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                  • Size 7KB
                                                                                                                  • SHA256 44560d1409f31ba0f331819180e46d17fac34f6fa6c885ed35a924d9f7508b9b
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Network Persistent State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                  • Size 5KB
                                                                                                                  • SHA256 a0d895d724061065e809dcfff2aa0e1e5fb0f3072d5070da23e146e8d831e1f5
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Network Persistent State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                  • Size 7KB
                                                                                                                  • SHA256 8282ea475737369ea15397d90a0e7dd63364ae82b0231a0ed0dde893204e86a1
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Network Persistent State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                  • Size 8KB
                                                                                                                  • SHA256 5899ca24d1d476750d8968622fefa5ea3a2808ad250ddf3a764cc792e5fc4634
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                  • Size 13KB
                                                                                                                  • SHA256 ecffeb531d634cc188b252e61573af73d8408e98e43428ce789b7327613f7d86
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                  • Size 11KB
                                                                                                                  • SHA256 9668c0bc4ce85dda01688483ca89168cc1296fe23bc5d4f19f1e8a7f1b41edc5
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                  • Size 13KB
                                                                                                                  • SHA256 fe6c3e49581c8f28758d2065c5b16d0ac2cda5ec02b58f9d3b19422ad5765fc7
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                  • Size 12KB
                                                                                                                  • SHA256 2db9af40d7079f5ea8a6d3b6b0eae72eb53465b98ffe9f0b19d40cd6a992ef32
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                  • Size 12KB
                                                                                                                  • SHA256 fdfaaf1a553e852ff5278bc7933935abc3acabf30c07f04170e40a5d76c659f9
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                  • Size 11KB
                                                                                                                  • SHA256 57b7f3063864971464c2327d48a8ab68144181cc91219c9cd6302ab647b3530d
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                  • Size 12KB
                                                                                                                  • SHA256 33686cac48f79c5a45cb319ad06f4dbb526bb65f01cfe96fc05be7a0eae01ded
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Secure Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                  • Size 13KB
                                                                                                                  • SHA256 74ed09653dae5ff3f2b436f6ee7ac96e94f2f2ef5a83ca49b55fda10c0129c14
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  the-real-index
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                  • Size 120B
                                                                                                                  • SHA256 d3771a4115ce4031fef98b359b2471516a72440dd457412a8d9645155affe03d
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  the-real-index
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                                                                  • Size 72B
                                                                                                                  • SHA256 01525b0a8dbb8ea41831873621202ccf88cdad46b6ee61e2a346f686bf9cd2ee
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  the-real-index~RFe5b631b.TMP
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5b631b.TMP
                                                                                                                  • Size 48B
                                                                                                                  • SHA256 a8e1a5244f212e535867b89174d68b6a472c86acd210429e940f64c5c28be426
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  index
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index
                                                                                                                  • Size 24B
                                                                                                                  • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                  • Size 125KB
                                                                                                                  • SHA256 f4c00455e8e34a768c6b6f391e03934e3df58b78c133a86d04f76c7d7d53e566
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                  • Size 125KB
                                                                                                                  • SHA256 f08954e0a69c50b664e81807f708cdcecba2a3fe1ad825fbf27acebadc487905
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                  • Size 124KB
                                                                                                                  • SHA256 219e87f82073ab5b20ca44990a69c92e52d797a31fe0e0eca54e82298b18b9d2
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                  • Size 4KB
                                                                                                                  • SHA256 9a66d76f34e8f60900052fe0730211713cb88f168bc4cabfac133b6e02b76cab
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                  • Size 124KB
                                                                                                                  • SHA256 71fe4c9124b7a5a6690c4bc2b57776378dae8a3fd57ba3ac51cf35c75b52cb2b
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                  • Size 125KB
                                                                                                                  • SHA256 2712bb1f25abd033c319bf87cbb2fe4b663b7fb1fa12ec72f54ba75bdd61acec
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  MSI5460.tmp
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\MSI5460.tmp
                                                                                                                  • Size 132KB
                                                                                                                  • SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  messages.json
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2352_1202691345\CRX_INSTALL\_locales\en\messages.json
                                                                                                                  • Size 450B
                                                                                                                  • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  settings.dat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Crashpad\settings.dat
                                                                                                                  • Size 280B
                                                                                                                  • SHA256 962ec80c364210be1e004c037157632c262f496f6e0f1375046f5e28757d80ba
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  settings.dat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Crashpad\settings.dat
                                                                                                                  • Size 280B
                                                                                                                  • SHA256 a2a78360c6fb620bbf574f81f0054e01d24505b144d296690c7f422675bf0e84
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  throttle_store.dat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Crashpad\throttle_store.dat
                                                                                                                  • Size 20B
                                                                                                                  • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  8605b0d1-b633-4e96-9330-045984db2e09.tmp
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Default\8605b0d1-b633-4e96-9330-045984db2e09.tmp
                                                                                                                  • Size 6KB
                                                                                                                  • SHA256 edbbc88d1709c99b308959eaa5dd451941d3d147202d60a3df5f00f1f7665b0e
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  the-real-index
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                  • Size 72B
                                                                                                                  • SHA256 b42b45ab112e2653e7acd4bcecbf33b1ca339341b0bdf97574deddab7aa0f1c5
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  the-real-index~RFe5a154e.TMP
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a154e.TMP
                                                                                                                  • Size 48B
                                                                                                                  • SHA256 c01a59be17264bd9bba5f8cf90bc56e1810cd5ad4e7d52426b7749a91230a654
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  MANIFEST-000001
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Default\Extension Scripts\MANIFEST-000001
                                                                                                                  • Size 41B
                                                                                                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  data_1
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Default\GPUCache\data_1
                                                                                                                  • Size 264KB
                                                                                                                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                  Submit Download

                                                                                                                  0d8da0d0-1f98-4632-8f79-e608025373af.tmp
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Default\Network\0d8da0d0-1f98-4632-8f79-e608025373af.tmp
                                                                                                                  • Size 2B
                                                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  Network Persistent State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Default\Network\Network Persistent State
                                                                                                                  • Size 111B
                                                                                                                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  Network Persistent State~RFe5aeb1d.TMP
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Default\Network\Network Persistent State~RFe5aeb1d.TMP
                                                                                                                  • Size 59B
                                                                                                                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Default\Preferences
                                                                                                                  • Size 6KB
                                                                                                                  • SHA256 2b9e9a20e38f9723143ca46badef4e163bea9dea7cfe21f2066c9aeb02414b98
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  CURRENT
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Default\Site Characteristics Database\CURRENT
                                                                                                                  • Size 16B
                                                                                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  data_0
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\GraphiteDawnCache\data_0
                                                                                                                  • Size 8KB
                                                                                                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                  Submit Download

                                                                                                                  data_2
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\GraphiteDawnCache\data_2
                                                                                                                  • Size 8KB
                                                                                                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                  Submit Download

                                                                                                                  data_3
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\GraphiteDawnCache\data_3
                                                                                                                  • Size 8KB
                                                                                                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Local State
                                                                                                                  • Size 2KB
                                                                                                                  • SHA256 dcb6fec061a5035447e40c0213882ff2299a779598e0281c25885b3eca7f72cc
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Local State
                                                                                                                  • Size 3KB
                                                                                                                  • SHA256 d9ed07a7eaf1bf1e0b425753e4d0970965046fe0fb57ecbfe18005b7b9f1685b
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Local State
                                                                                                                  • Size 15KB
                                                                                                                  • SHA256 4004b48aebdfe898ac6d80a6c282dc76199e89ce3c1032f7a7e50af7917d07e0
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Local State
                                                                                                                  • Size 17KB
                                                                                                                  • SHA256 4c18f7ab371a3f6f6c0997ed651e6f1fa4a098229576fee45d705032613e694b
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State~RFe59c431.TMP
                                                                                                                  • Path C:\Users\Admin\AppData\Local\dllinjector.wearedevs.net\EBWebView\Local State~RFe59c431.TMP
                                                                                                                  • Size 1KB
                                                                                                                  • SHA256 ef3b1bbbc05eb5ce1059173ce2f89c9a77dbe72284bb0a29a513dccdf2951db3
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  MicrosoftEdgeWebview2Setup.exe.crdownload
                                                                                                                  • Path C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe.crdownload
                                                                                                                  • Size 1.6MB
                                                                                                                  • SHA256 8c4a80540b6bbcbef30a4e8c7d1ac504b6fc09db922b4acdfd85c9d5f6f1050e
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  e59a212.msi
                                                                                                                  • Path C:\Windows\Installer\e59a212.msi
                                                                                                                  • Size 3.7MB
                                                                                                                  • SHA256 c1c7c5d3eaf119905dd0c57cc4b67418a07a1bc8fd156429aff5e92a254ee5f2
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Staging
                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1354174326\Mu\Staging
                                                                                                                  • Size 36B
                                                                                                                  • SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  hyph-bn.hyb
                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_290289631\hyph-bn.hyb
                                                                                                                  • Size 703B
                                                                                                                  • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  hyph-mr.hyb
                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_290289631\hyph-mr.hyb
                                                                                                                  • Size 687B
                                                                                                                  • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  hyph-nn.hyb
                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_290289631\hyph-nn.hyb
                                                                                                                  • Size 141KB
                                                                                                                  • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  metadata-2
                                                                                                                  • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                                                                  • Size 26.1MB
                                                                                                                  • SHA256 6e2df9e8765a04e6ef142f4b79d077daf6e23562b15b9d2b945737d7286bbf12
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  {ee79eaa5-198b-47e2-9511-6fff4cf66781}_OnDiskSnapshotProp
                                                                                                                  • Path \??\Volume{c576ab2f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{ee79eaa5-198b-47e2-9511-6fff4cf66781}_OnDiskSnapshotProp
                                                                                                                  • Size 6KB
                                                                                                                  • SHA256 8c6364e04629c7a4a4ee5869ec055574c2879800a685170074f0c18bd7f09065
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  memory/572-246-0x0000029E08560000-0x0000029E08612000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/572-1409-0x0000029E08560000-0x0000029E08612000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/572-88-0x00007FF9C7C60000-0x00007FF9C7C61000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1308-1821-0x0000022F47E70000-0x0000022F47E9F000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1924-1589-0x0000025F82ED0000-0x0000025F82EFF000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2328-901-0x000001B5A4FA0000-0x000001B5A4FA1000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2328-902-0x000001B5A4FA0000-0x000001B5A4FA1000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2328-891-0x000001B5A4FA0000-0x000001B5A4FA1000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2328-900-0x000001B5A4FA0000-0x000001B5A4FA1000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2328-893-0x000001B5A4FA0000-0x000001B5A4FA1000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2328-898-0x000001B5A4FA0000-0x000001B5A4FA1000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2328-897-0x000001B5A4FA0000-0x000001B5A4FA1000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2328-899-0x000001B5A4FA0000-0x000001B5A4FA1000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4612-299-0x00007FF9C6DC0000-0x00007FF9C6DC1000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4612-313-0x0000027B62230000-0x0000027B6225F000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4612-298-0x00007FF9C6FD0000-0x00007FF9C6FD1000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4744-1714-0x000001D0ADD80000-0x000001D0ADDAF000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4884-1142-0x000001FB4C360000-0x000001FB4C38F000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4920-1891-0x000001C154FB0000-0x000001C154FDF000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5604-1025-0x000001469E000000-0x000001469E0B2000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5604-245-0x000001469E000000-0x000001469E0B2000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5604-68-0x00007FF9C7C60000-0x00007FF9C7C61000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/6128-1662-0x000001E082ED0000-0x000001E082EFF000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/6492-769-0x000001EEEDDD0000-0x000001EEEDDFF000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/6816-1969-0x000002C6D4FB0000-0x000002C6D4FDF000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/6876-1646-0x0000000000E50000-0x0000000000E85000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/6876-1626-0x0000000073AC0000-0x0000000073D07000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/6876-1411-0x0000000073AC0000-0x0000000073D07000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/6876-1410-0x0000000000E50000-0x0000000000E85000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/7092-866-0x000001A1B4FC0000-0x000001A1B4FEF000-memory.dmp
                                                                                                                  Download