24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 74:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T423,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 18e7d5b61dd3… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 18e7d5b61dd3…. Threat score 85/100. 0/26 AV engines flagged this file. 4 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de"],"about":{"@type":"SoftwareApplication","name":"Jutsu-Setup.exe","applicationCategory":["compressed","7zip"],"identifier":"18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","additionalType":"Malicious sample"},"threatScore":85,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4a8,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Jutsu-Setup.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")26:Tfde,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Jutsu-Setup.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "Jutsu-Setup.exe") Found reference to API "[DO][WaitForSingleObject failed][Last error: %d]" (Indicator: "WaitForSingleObject"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[DO][WaitForSingleObject failed][Result: %#x]" (Indicator: "WaitForSingleObject"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[WaitForSingleObject failed][%d]" (Indicator: "WaitForSingleObject"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[LaunchCopilotRepair][WaitForSingleObject failed][%u][%u]" (Indicator: "WaitForSingleObject"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")27:T7d2,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "Jutsu-Setup.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "Jutsu-Setup.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")28:T58a,"MicrosoftEdgeUpdate.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}\PROGID") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}\PROGID") "MicrosoftEdgeUpdate.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}\PROGID") "MicrosoftEdgeUpdate.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}\PROGID") "MicrosoftEdgeUpdate.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTS\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTS\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "MicrosoftEdgeUpdate.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "MicrosoftEdgeUpdate.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM")29:Taf3,"Jutsu-Setup.exe" queried SystemProcessInformation at 00000000-00006316-00000C15-1041571085 [PID: 6316] "Jutsu-Setup.exe" queried SystemProcessInformation at 00000000-00006316-00000C15-1041579565 [PID: 6316] "Jutsu-Setup.exe" queried SystemProcessInformation at 00000000-00006316-00000C15-1041750869 [PID: 6316] "Jutsu-Setup.exe" queried SystemProcessInformation at 00000000-00006316-00000C15-1041760250 [PID: 6316] "Jutsu-Setup.exe" queried SystemProcessInformation at 00000000-00006316-00000C15-1041925453 [PID: 6316] "Jutsu-Setup.exe" queried SystemProcessInformation at 00000000-00006316-00000C15-1041933767 [PID: 6316] "MicrosoftEdgeWebview2Setup.exe" queried SystemProcessInformation at 00000000-00005020-00000C15-1187380450 [PID: 5020] "MicrosoftEdgeWebview2Setup.exe" queried SystemProcessInformation at 00000000-00005020-00000C15-1187389061 [PID: 5020] "MicrosoftEdgeWebview2Setup.exe" queried SystemProcessInformation at 00000000-00005020-00000C15-1187532855 [PID: 5020] "MicrosoftEdgeWebview2Setup.exe" queried SystemProcessInformation at 00000000-00005020-00000C15-1187541552 [PID: 5020] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00004016-00000C15-1188740721 [PID: 4016] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00004016-00000C15-1188750458 [PID: 4016] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00004016-00000C15-1188891290 [PID: 4016] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00004016-00000C15-1188899282 [PID: 4016] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00004016-00000C15-1188991807 [PID: 4016] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00004016-00000C15-1188999563 [PID: 4016] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00004016-00000C15-1189166512 [PID: 4016] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00004016-00000C15-1189175472 [PID: 4016] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00004016-00000C15-1189308204 [PID: 4016] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00004016-00000C15-1189316324 [PID: 4016] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00004016-00000C15-1189642649 [PID: 4016] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00004016-00000C15-1189651918 [PID: 4016] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00004016-00000C15-1189988870 [PID: 4016] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00004016-00000C15-1189997250 [PID: 4016] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00007356-00000C15-1190912825 [PID: 7356]2a:T1403,"MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdate.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdate.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\CopilotUpdate.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\CopilotUpdate.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdate.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateCore.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateCore.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateComRegisterShell64.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeComRegisterShellARM64.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeComRegisterShellARM64.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\NOTICE.TXT" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\NOTICE.TXT" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\EdgeUpdate.dat" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\EdgeUpdate.dat" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_af.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_af.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_am.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_am.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ar.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_ar.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_as.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_as.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_az.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_az.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bg.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_bg.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bn.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_bn.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bn-IN.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_bn-IN.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bs.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_bs.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ca.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_ca.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ca-Es-VALENCIA.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_ca-Es-VALENCIA.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_cs.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_cs.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_cy.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_cy.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_da.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_da.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_de.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_de.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_el.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_el.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_en.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_en.dll"2b:T438,Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found api reference "CertCompareCertificate" (Indicator: "CertCompareCertificate"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00003524.00000000.141300.10B80000.00000004.mdmp")2c:T13e4,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-41-013DEA7A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-41-013DEA7A Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00005020-42227-89-013E88FD Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00005020-42227-89-013E88FD Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00005020-42227-89-013E88FD Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00005020-42227-89-013E88FD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-108-013DFCDB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-108-013DFCDB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-111-013DF949 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-111-013DF949 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-158-013E0D19 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-158-013E0D19 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005020-42227-274-013D50C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005020-42227-274-013D50C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-284-013D40F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-284-013D40F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-289-013D29E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-289-013D29E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-442-013D15DC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-442-013D15DC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-467-013D4418 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-467-013D4418 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-472-013D187B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-472-013D187B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-473-013D1938 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-473-013D1938 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005020-42227-475-013D1A73 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005020-42227-475-013D1A73 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-476-013D1DA2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-476-013D1DA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-478-013D4873 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-478-013D4873 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-481-013D1E84 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-481-013D1E84 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-482-013D2DE7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-482-013D2DE7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-484-013D3E90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-484-013D3E90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-486-013D28E4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-486-013D28E4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-489-013D498A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-489-013D498A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-497-013D2833 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-497-013D2833 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-498-013D27AB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-498-013D27AB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-513-013D26D3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-513-013D26D3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-514-013D2505 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-514-013D2505 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005020-42227-515-013D2329 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005020-42227-515-013D23292d:T95ac,Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 717908; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1138505; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3285304; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3449639; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3556511; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3637657; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3752348; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3795485; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3898591; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3974052; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4065101; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4135615; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4135956; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4200600; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4208542; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4308752; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4362508; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4422541; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4500556; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4508211; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4517789; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4528436; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4556909; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4585893; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4640459; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4727431; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4751852; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4963656; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 5059333; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 5107076; code bytes = 30d0 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 2522906; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3471145; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3501567; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3616246; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3645312; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3735599; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3805847; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4003902; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4128007; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4143843; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4233630; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4273869; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4341964; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4378030; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4509667; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4522444; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4578026; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4587739; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4709628; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4781702; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4867093; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4876942; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4902628; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4934339; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4956953; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4989606; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 5054919; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 5066478; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 5070875; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 5224995; code bytes = 33c1 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 86015; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 444705; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 486900; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 562947; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 679211; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 812282; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 889477; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1069401; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1326655; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1485410; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1543015; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1556458; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1568044; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1620838; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1634505; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1714290; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1741527; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1746697; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1747737; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1752097; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1756307; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1779167; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1779297; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1779547; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1779807; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1794977; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1795787; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1833117; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1850017; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 1850757; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3285692; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3478013; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3478741; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3551198; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3677862; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3795985; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3897461; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 3941175; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4194644; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4558405; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4577154; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4689761; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4718399; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4928651; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4930553; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4959122; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 4988088; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 5055701; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 5165687; code bytes = 8030 Found XOR loop in file "BouncyCastle.Cryptography.dll" at offset 5240213; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 71666; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 338683; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 610191; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 610878; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 610955; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 1192672; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 1569100; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2080300; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2240335; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2462015; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2462867; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2477835; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2483739; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2500399; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2502027; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2504855; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2507067; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2509123; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2511179; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2512739; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2514831; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2515319; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2517939; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2522166; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 125344; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 381572; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 399059; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 441339; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 441491; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 560561; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1171086; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1181889; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1182032; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1182101; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1182167; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1288814; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1381379; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2191099; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2261855; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2269165; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2400202; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2439275; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2440497; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2442971; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2454763; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2457757; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2465311; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2468521; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2470437; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2479997; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2484773; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2494335; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2496055; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2496567; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 508074; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 589755; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1572365; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1573255; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1614972; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1627322; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1855336; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1856676; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1856680; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1926735; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2182337; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2205309; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2261113; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2265559; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2384666; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2451486; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2452258; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2453774; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2462010; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2463834; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2465128; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2483736; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2490594; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2492816; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2500380; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2504816; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2507028; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2509084; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2511140; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2512720; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2513424; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2514312; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2514820; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2515290; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2517900; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2519794; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2524771; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 175974; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 189926; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 211076; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 236539; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 326555; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 435596; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 577091; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 624557; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 659692; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 954483; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 971663; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1053531; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1066180; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1219876; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1233921; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1444417; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1445096; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1447429; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1485449; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1515393; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1714978; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1742646; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1744194; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1836623; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1841718; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 31396; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 36126; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 186375; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 255638; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 303037; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 488803; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 526866; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 625093; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 672819; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 818221; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 874405; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 923528; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 928653; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 996389; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1093219; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1133790; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1159967; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1198448; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1236588; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1241989; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1248922; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1469362; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1601236; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1631241; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1644688; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1834159; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 51183; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 190286; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 205559; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 240627; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 266778; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 275321; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 400224; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 498519; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 538094; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 668766; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 675130; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 774164; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 803821; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 816814; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 849477; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 986127; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1028322; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1095947; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1135770; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1148205; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1158621; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1187098; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1291902; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1336527; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1351952; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1386725; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1429491; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1463110; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1508530; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1550558; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1600193; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1601184; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1693625; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1731433; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1764401; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1838254; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1839346; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1844557; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1846242; code bytes = 8030 Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 187575; code bytes = 30d0 Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 152459; code bytes = 8030 Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 597694; code bytes = 8030 Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 599379; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 425208; code bytes = 30d0 Found XOR loop in file "psmachine_64.dll" at offset 510518; code bytes = 30d0 Found XOR loop in file "psmachine_64.dll" at offset 64421; code bytes = 33c1 Found XOR loop in file "psmachine_64.dll" at offset 159432; code bytes = 33c1 Found XOR loop in file "psmachine_64.dll" at offset 320915; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 508146; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 513123; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 425208; code bytes = 30d0 Found XOR loop in file "psuser_64.dll" at offset 438664; code bytes = 30d0 Found XOR loop in file "psuser_64.dll" at offset 510518; code bytes = 30d0 Found XOR loop in file "psuser_64.dll" at offset 64421; code bytes = 33c1 Found XOR loop in file "psuser_64.dll" at offset 159432; code bytes = 33c1 Found XOR loop in file "psuser_64.dll" at offset 320915; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 508146; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 513123; code bytes = 8030 Found XOR loop in file "psmachine_arm64.dll" at offset 487478; code bytes = 30d0 Found XOR loop in file "psmachine_arm64.dll" at offset 6944; code bytes = 33c1 Found XOR loop in file "psmachine_arm64.dll" at offset 29284; code bytes = 33c1 Found XOR loop in file "psmachine_arm64.dll" at offset 30244; code bytes = 33c1 Found XOR loop in file "psmachine_arm64.dll" at offset 69236; code bytes = 33c1 Found XOR loop in file "psmachine_arm64.dll" at offset 205876; code bytes = 33c1 Found XOR loop in file "psmachine_arm64.dll" at offset 206072; code bytes = 33c1 Found XOR loop in file "psmachine_arm64.dll" at offset 485106; code bytes = 8030 Found XOR loop in file "psmachine_arm64.dll" at offset 490083; code bytes = 8030 Found XOR loop in file "psuser_arm64.dll" at offset 487478; code bytes = 30d0 Found XOR loop in file "psuser_arm64.dll" at offset 6944; code bytes = 33c1 Found XOR loop in file "psuser_arm64.dll" at offset 29284; code bytes = 33c1 Found XOR loop in file "psuser_arm64.dll" at offset 30244; code bytes = 33c1 Found XOR loop in file "psuser_arm64.dll" at offset 69236; code bytes = 33c1 Found XOR loop in file "psuser_arm64.dll" at offset 205876; code bytes = 33c1 Found XOR loop in file "psuser_arm64.dll" at offset 206072; code bytes = 33c1 Found XOR loop in file "psuser_arm64.dll" at offset 485106; code bytes = 8030 Found XOR loop in file "psuser_arm64.dll" at offset 490081; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 69159; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 391549; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 395771; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 397657; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 400931; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 404534; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 111198; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 121443; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 386669; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 393105; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 411251; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 239772; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 252122; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 393886; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 395752; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 400896; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 402162; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 407139; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 69159; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 391549; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 395771; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 397657; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 400931; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 404534; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 111198; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 121443; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 386669; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 393105; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 239772; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 252122; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 393886; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 395752; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 400896; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 402162; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 405454; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 407139; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 324441; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 336950; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 90803; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 95534; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 323697; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 326495; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 215388; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 227738; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 330508; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 334578; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 339555; code bytes = 8030 Found XOR loop in file "Jutsu.exe" at offset 44911; code bytes = 30d0 Found XOR loop in file "Jutsu.exe" at offset 193548; code bytes = 30d0 Found XOR loop in file "Jutsu.exe" at offset 25548; code bytes = 33c1 Found XOR loop in file "Jutsu.exe" at offset 72033; code bytes = 33c1 Found XOR loop in file "Jutsu.exe" at offset 174113; code bytes = 33c1 Found XOR loop in file "Jutsu.exe" at offset 220670; code bytes = 33c1 Found XOR loop in file "Jutsu.exe" at offset 125329; code bytes = 8030 Found XOR loop in file "Jutsu.exe" at offset 150870; code bytes = 8030 Found XOR loop in file "Jutsu.exe" at offset 273982; code bytes = 8030 Found XOR loop in file "Jutsu.exe" at offset 299523; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 96873; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 107680; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 214448; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 226870; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 23528; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 120499; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 128312; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 134256; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 224498; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 227790; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 229475; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 193351; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 194297; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 201270; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 45308; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 193332; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 194278; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 198898; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 203875; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 193078; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 190706; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 195683; code bytes = 8030 Found XOR loop in file "WebView2Loader.dll" at offset 17068; code bytes = 33c1 Found XOR loop in file "WebView2Loader.dll" at offset 159949; code bytes = 8030 Found XOR loop in file "WebView2Loader.dll" at offset 161634; code bytes = 8030 Found XOR loop in file "WebView2Loader.dll" at offset 133837; code bytes = 8030 Found XOR loop in file "WebView2Loader.dll" at offset 135522; code bytes = 8030 Found XOR loop in file "WebView2Loader.dll" at offset 14440; code bytes = 33c1 Found XOR loop in file "WebView2Loader.dll" at offset 16675; code bytes = 33c1 Found XOR loop in file "WebView2Loader.dll" at offset 110270; code bytes = 8030 Found XOR loop in file "WebView2Loader.dll" at offset 111955; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 87805; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 93750; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 2925; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 91378; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 96355; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 87805; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 93750; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 2925; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 91378; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 94670; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 96355; code bytes = 8030 Found XOR loop in file "Microsoft.Web.WebView2.WinForms.dll" at offset 34146; code bytes = 8030 Found XOR loop in file "msedgeupdateres_el.dll" at offset 24630; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_el.dll" at offset 22258; code bytes = 8030 Found XOR loop in file "msedgeupdateres_el.dll" at offset 27235; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ml.dll" at offset 24630; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_ml.dll" at offset 22258; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ml.dll" at offset 27235; code bytes = 8030 Found XOR loop in file "msedgeupdateres_de.dll" at offset 24630; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_de.dll" at offset 22258; code bytes = 8030 Found XOR loop in file "msedgeupdateres_de.dll" at offset 25550; code bytes = 8030 Found XOR loop in file "msedgeupdateres_de.dll" at offset 27235; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ca.dll" at offset 24118; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_ca.dll" at offset 21746; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ca.dll" at offset 26723; code bytes = 80302e:T799,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "Jutsu-Setup.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeUpdateComRegisterShell64.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeUpdate.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeComRegisterShellARM64.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "WebView2Loader.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeUpdateOnDemand.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeUpdateBroker.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "CopilotUpdate.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "nsExec.dll") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")2f:T468,file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "psmachine_arm64.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "psuser_arm64.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "MicrosoftEdgeUpdateCore.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004016-00000C2C-1189821766") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004016-00000C2C-1189822161") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004016-00000C2C-1189822621") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp")30:T4ab,Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "Jutsu-Setup.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "Jutsu-Setup.exe") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "Jutsu-Setup.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")31:T5b9,Found system information discovery API: "ExpandEnvironmentStringsW" in file "Jutsu-Setup.exe" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsForUserW" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00004016.00000000.140745.01359000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004016.00000000.140745.01359000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005020.00000000.140656.013EC000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005020.00000000.140656.013EC000.00000002.mdmp"32:T4bf,Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "Jutsu-Setup.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "Jutsu-Setup.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "Jutsu-Setup.exe") file/memory contains long string with (Indicator: "findwindow"; File: "Jutsu.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "nsDialogs.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "nsExec.dll") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp")33:T6f6,"Jutsu-Setup.exe" called "GetWindowTextW" with parameter "260023044104420430043d043e043204380442044c04" - (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetWindowTextW" with parameter "1e0442043c0435043d043004" - (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetWindowTextW" with parameter "12043004410420003f044004380432043504420441044204320443043504420420003c0430044104420435044004200043044104420430043d043e0432043a0438042000140436044304420441044304" - (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetWindowTextW" with parameter "2d044204300420003f0440043e043304400430043c043c043004200043044104420430043d043e04320438044204200014043604430442044104430420003d043004200032043004480420003a043e043c043f044c044e044204350440042e000d000a000d000a001f04350440043504340420003d043004470430043b043e043c04200043044104420430043d043e0432043a0438042000400435043a043e043c0435043d04340443043504420441044f042000370430043a0440044b0442044c04200032044104350420004004300431043e04420430044e0449043804350420003f04400438043b043e04360435043d0438044f042e0020002d0442043e0420003f043e04370432043e043b043804420420003f0440043e043304400430043c043c043504200043044104420430043d043e0432043a04380420003e0431043d043e043204380442044c042000410438044104420435043c043d044b04350420004404300439043b044b04200031043504370420003f043504400435043704300433044004430437043a04380420003a043e043c043f044c044e0442043504400430042e000d000a000d000a001d04300436043c0438044204350420003a043d043e043f043a0443042000220023044104420430043d043e043204380442044c0422002c002000470442043e0431044b04200043044104420430043d043e043204380442044c0420003f0440043e043304400430043c043c0443042e00" - (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetWindowTextW" with parameter "2600140430043b043504350420003e00" - (UID: 00000000-00006316)34:T2f6c,"Jutsu-Setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006316) "Jutsu-Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000506a0a77cc97c0fbe0fb0301506a0a778c92c0fbfefffffff0fb0301ad61067734fc0301000000009b6206776498d18d34fc030108b221035cfc03010000000008b221030000000000000000000000000100000000000000ee130700a8fb0301ee130777a8fc0301506a0a776c93c0fbfeffffffdc000a77055d0677940000000300000014fc0301040000000000000000000000ffffffff0100000060fc0301b5560b775cfc0301d0560b770000000034fc030100000000030000002834210300000000000000000000000000000000000000000000000002000000a8fc0301700a0a77ec020a77603b09772c9fd18df0fc03010000037700c0c500 (UID: 00000000-00006316) "Jutsu-Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006316) "Jutsu-Setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000030116e1e87550f3030148f3030154f303010300000080f6ed7460f30301aaece8750300000000000000e4473373b6ece87587adb52198f303017de0e87564e0e8757fadb521e447337305000000f09d33730000000075e2337386e2337318f40301802beb7587184355feffffffa4f30301e0dfe87520023573b4f3030149d93473c064377320023573c0f3030163d9347320023573e4f30301fa9d3373010000000100000037060677010000000b2ee97506000000dad8347328f40301eecf3473c4dc3473e2cf3473f0665b250100000001000000000000004090d18d1800000024f4030132ba0877a068377300000000000000000000000038f40301 (UID: 00000000-00006316) "Jutsu-Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000008d1030138cf07778c36210374d1030101000000403621038c36210340362103040000000400000000e0f8740010000074d103010100000040362103cd9707779c97077700b0d18db50fef744036210300000777000000008411f5730000000080eef574010000003000fe7ff8e2f8740000000004000000000000004840f774f8e2f87478d1030180e80a76e89b210380e80a7674d103010000000080e80a7638512103c4be350278d30301ced25dc3000000005495c00140362103c4d60301000000001c001c00ac4dbb0080fb030100000000104d21030000000000000000ffffffff000000000000000000000000de902303f4902303 (UID: 00000000-00006316) "Jutsu-Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000008d1030138cf07778c36210374d1030101000000403621038c36210340362103040000000400000000e0f8740010000074d103010100000040362103cd9707779c97077700b0d18db50fef744036210300000777000000008411f5730000000080eef574010000003000fe7ff8e2f8740000000004000000000000004840f774f8e2f87478d1030180e80a76e89b210380e80a7674d103010000000080e80a7638512103c4be350278d30301ced25dc3000000005495c00140362103c4d60301000000001c001c00ac4dbb0080fb030100000000104d21030000000000000000ffffffff0000000000000000000000002ed4230346d42303 (UID: 00000000-00006316) "Jutsu-Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000008d1030138cf07778c36210374d1030101000000403621038c36210340362103040000000400000000e0f8740010000074d103010100000040362103cd9707779c97077700b0d18db50fef744036210300000777000000008411f5730000000080eef574010000003000fe7ff8e2f8740000000004000000000000004840f774f8e2f87478d1030180e80a76e89b210380e80a7674d103010000000080e80a7638512103c4be350278d30301ced25dc3000000005495c00140362103c4d60301000000001c001c00ac4dbb0080fb030100000000104d21030000000000000000ffffffff0000000000000000000000009ef32303b2f32303 (UID: 00000000-00006316) "Jutsu-Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000008d1030138cf07778c36210374d1030101000000403621038c36210340362103040000000400000000e0f8740010000074d103010100000040362103cd9707779c97077700b0d18db50fef744036210300000777000000008411f5730000000080eef574010000003000fe7ff8e2f8740000000004000000000000004840f774f8e2f87478d1030180e80a76e89b210380e80a7674d103010000000080e80a7638512103c4be350278d30301ced25dc3000000005495c00140362103c4d60301000000001c001c00ac4dbb0080fb030100000000104d21030000000000000000ffffffff000000000000000000000000a6902303be902303 (UID: 00000000-00006316) "Jutsu-Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000008d1030138cf07778c36210374d1030101000000403621038c36210340362103040000000400000000e0f8740010000074d103010100000040362103cd9707779c97077700b0d18db50fef744036210300000777000000008411f5730000000080eef574010000003000fe7ff8e2f8740000000004000000000000004840f774f8e2f87478d1030180e80a76e89b210380e80a7674d103010000000080e80a7638512103c4be350278d30301ced25dc3000000005495c00140362103c4d60301000000001c001c00ac4dbb0080fb030100000000104d21030000000000000000ffffffff00000000000000000000000086f723039cf72303 (UID: 00000000-00006316) "Jutsu-Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000008d1030138cf07778c36210374d1030101000000403621038c36210340362103040000000400000000e0f8740010000074d103010100000040362103cd9707779c97077700b0d18db50fef744036210300000777000000008411f5730000000080eef574010000003000fe7ff8e2f8740000000004000000000000004840f774f8e2f87478d1030180e80a76e89b210380e80a7674d103010000000080e80a7638512103c4be350278d30301ced25dc3000000005495c00140362103c4d60301000000001c001c00ac4dbb0080fb030100000000104d21030000000000000000ffffffff000000000000000000000000a6fb2303befb2303 (UID: 00000000-00006316) "Jutsu-Setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000301d0bb7703c0007703c06f1c73d8bb770338f2030120f20301d06f1c73f4bb7703a74d1c7300000000d8bb7703b74d1c733ae9bb254ebc1f7300000000e8e1230374f2030154f20301c06f1c73d8bb77038cf203010000000000000000f4bb7703a74d1c73000000008c58cc76000000007ae9bb25e0f203011491d18dd0bb770302400080c0f20301506a0a77f496c0fbfeffffffd0f203010016dc7678b4220354b02b7323870777e18607774491d18d000000008c58cc76d0bb77030000000078b42203040000000016dc7698f20301d0bb7703b04dd7768cdd5b7600000000e8e12303d0bb770313e61e73000016732c532b73c4f2030180eef574 (UID: 00000000-00006316) "Jutsu-Setup.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006316) "MicrosoftEdgeWebview2Setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005020) "MicrosoftEdgeUpdate.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000060000000001000c0038ddf50006000000080000006002d6004851d60007000000a0dc000000006973100000000000d60018f29d00feffffffb8f19d00b71607772800000030000000d007c5001800000098f29d00090000000000c500c0f19d0042000877307b1477030000002030d700788ed6000200000000000000200000000000c500c401c5009408c500000000009008c5000100000010f29d00591607771000000000000c0098f29d000000d60034f29d0018000000000000000000000003000000020000000000d6001000000000000c000100000034f29d00ee13077700000000ee13077700000c000000000000000000000000004ce90977 (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02cb373ccf09d00226e00750000e804000000002d6e00754c2cc60e2d000000ecb7a97350f19d00b1ce98008876d700688fd6000d0000008000000090f09d000000c50014f19d0070c8017578ad5d7bfeffffff2d000000d0ccb87327000000e4f09d00856a02751c23077524f19d00f85f027508000000bb690175b2690175a42dc60e2d000000ecb7a97327000000d0ccb873f8f09d002d000000d0ccb8732700000028f19d00856a02751c23077570f19d007e8ab773ee8cb773738ab773af7920072d000000ecb7a97327000000d0ccb8732c11e804c010e804af79200738f19d00fc52f57324f29d00e084b773e7794e74feffffff738ab773 (UID: 00000000-00004016)35:T49a,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "Jutsu-Setup.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "Jutsu-Setup.exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")36:T72a,"MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00004016-00000C17-1189836201 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3" at 00000000-00004016-00000C17-1213892807 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\Program Files (x86)\Microsoft\EdgeUpdate\Offline" at 00000000-00004016-00000C17-1214003349 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00007356-00000C17-1191981891 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00002712-00000C17-1197090994 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00002712-00000C17-1202487126 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00002712-00000C17-1208015733 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00002712-00000C17-1213479466 "MicrosoftEdgeUpdateComRegisterShell64.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00003524-00000C17-1197653744 "MicrosoftEdgeUpdateComRegisterShell64.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00005124-00000C17-1202973559 "MicrosoftEdgeUpdateComRegisterShell64.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00006228-00000C17-120867973037:T538,"Jutsu-Setup.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00006316) "Jutsu-Setup.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00006316) "Jutsu-Setup.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00006316) "Jutsu-Setup.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00006316) "Jutsu-Setup.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00006316) "Jutsu-Setup.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00006316) "Jutsu-Setup.exe" called "CreateDirectoryW" with parameter %TEMP%\nsl4021.tmp (UID: 00000000-00006316) "Jutsu-Setup.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs (UID: 00000000-00006316) "Jutsu-Setup.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\Jutsu (UID: 00000000-00006316) "Jutsu-Setup.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\Jutsu\runtimes (UID: 00000000-00006316) "Jutsu-Setup.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\Jutsu\runtimes\win-x64 (UID: 00000000-00006316) "Jutsu-Setup.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\Jutsu\runtimes\win-x64\native (UID: 00000000-00006316)38:T5cd,"Jutsu-Setup.exe" called "CreateProcessW" with parameter "taskkill /IM "Jutsu.exe" /F" - (UID: 00000000-00006316) "Jutsu-Setup.exe" called "CreateProcessW" with parameter ""%TEMP%\nsl4021.tmp\MicrosoftEdgeWebview2Setup.exe" /silent /install" - (UID: 00000000-00006316) "MicrosoftEdgeWebview2Setup.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3" - (UID: 00000000-00005020), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc" - (UID: 00000000-00004016), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver" - (UID: 00000000-00004016), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cm" - (UID: 00000000-00004016), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&app" - (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateComRegisterShell64.exe"" - (UID: 00000000-00002712)39:T370c,"Jutsu-Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsl4021.tmp\nsDialogs.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsl4021.tmp\System.dll (UID: 00000000-00006316) "Jutsu-Setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsl4021.tmp\nsExec.dll (UID: 00000000-00006316) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005020) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdate.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_en.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntdll.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wldp.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdateres_en.dll (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\psmachine.dll (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002712) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\psmachine_64.dll (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\psmachine_64.dll (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006228) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005076)3a:T11c85,"Jutsu-Setup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter Create (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter SetRTL (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter CreateControl (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter Show (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter Exec (UID: 00000000-00006316) "Jutsu-Setup.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00006316) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter StrCmpIW (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter SHCreateStreamOnFileEx (UID: 00000000-00005020) "MicrosoftEdgeWebview2Setup.exe" called "GetProcAddress" with a parameter PathQuoteSpacesW (UID: 00000000-00005020) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetProcessMitigationPolicy (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathStripPathW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathRemoveExtensionW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter DllEntry (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter IsDeviceRegisteredWithManagement (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter NetGetAadJoinInformation (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter NetFreeAadJoinInformation (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSidLengthRequired (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeSid (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AddAce (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetAclInformation (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorLength (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter MakeSelfRelativeSD (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateMutexExW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CharLowerBuffW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathCommonPrefixW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter UrlUnescapeA (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SHQueryValueExW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorOwner (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorGroup (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathFindFileNameW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathCanonicalizeW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegGetKeySecurity (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetNamedSecurityInfoW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter OOBEComplete (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegDeleteKeyW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathGetDriveNumberW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WldpQueryWindowsLockdownMode (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetForegroundWindow (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetProcessId (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WaitForInputIdle (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetProcessMitigationPolicy (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathStripPathW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathRemoveExtensionW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter DllEntry (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter IsDeviceRegisteredWithManagement (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter NetGetAadJoinInformation (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter NetFreeAadJoinInformation (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSidLengthRequired (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeSid (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AddAce (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetAclInformation (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorLength (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter MakeSelfRelativeSD (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateMutexExW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CharLowerBuffW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathCommonPrefixW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SHQueryValueExW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter ChangeServiceConfigW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter QueryServiceConfig2W (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CharLowerW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007356) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetProcessMitigationPolicy (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathStripPathW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathRemoveExtensionW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter DllEntry (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter IsDeviceRegisteredWithManagement (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter NetGetAadJoinInformation (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter NetFreeAadJoinInformation (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSidLengthRequired (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeSid (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AddAce (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetAclInformation (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorLength (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter MakeSelfRelativeSD (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateMutexExW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CharLowerBuffW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathCommonPrefixW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegOverridePredefKey (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathFileExistsW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter DllRegisterServer (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter NdrDllRegisterProxy (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CharLowerW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SHQueryValueExW (UID: 00000000-00002712) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00002712) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter IsDeviceRegisteredWithManagement (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter NetGetAadJoinInformation (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter NetFreeAadJoinInformation (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSidLengthRequired (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter InitializeSid (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter AddAce (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetAclInformation (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorLength (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter MakeSelfRelativeSD (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CreateMutexExW (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter NdrDllRegisterProxy (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00003524) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter IsDeviceRegisteredWithManagement (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter NetGetAadJoinInformation (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter NetFreeAadJoinInformation (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSidLengthRequired (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter InitializeSid (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter AddAce (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetAclInformation (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorLength (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter MakeSelfRelativeSD (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CreateMutexExW (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter NdrDllRegisterProxy (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006228) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00006228) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetProcessMitigationPolicy (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathStripPathW (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathRemoveExtensionW (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter DllEntry (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter IsDeviceRegisteredWithManagement (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter NetGetAadJoinInformation (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter NetFreeAadJoinInformation (UID: 00000000-00005384) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SetProcessMitigationPolicy (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005076) "MicrosoftEdgeUpdate.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005076)3b:T448,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "Jutsu-Setup.exe") Found reference to API "44229,1048,3143,,CreateProcessW,kernel32.dll,"00:36:42.812",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00002712.00000000.141210.03430000.00000004.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "406958,2392,3143,,CreateProcessW,kernel32.dll,"00:36:34.140",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00005020.00000000.140656.00DB0000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")3c:T738,Found reference to API "[InitializeGoopdateAndLoadResources failed][0x%08x]" (Indicator: "LoadResource"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API ",,LoadResource,kernel32.dll,"00:36:35.562",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00004016.00000000.140745.00D60000.00000004.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")3d:T53f,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "Jutsu-Setup.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")3e:T421,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Jutsu-Setup.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")3f:T2b06,"Software\Microsoft\Windows\CurrentVersion" in Source: Jutsu-Setup.exe "SOFTWARE\Microsoft\EdgeUpdate" in Source: 42227-523-013D41CD "Software\OEM\MicrosoftEdge" in Source: 42227-523-013D41CD "Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 43721-473-01349A36 "HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SOFTWARE\Microsoft\Office\OfficeHub" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "KCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\%ws\UsageStats\Daily" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKU\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp 00000000-00002712.00000001.142047.03430000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Setup\State" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "KLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp 00000000-00002712.00000001.142047.03430000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\DownloaderLockout" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\CdpNames\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\AdditionalInstallArgs\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Classes" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepository\Packages" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Google\Update" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Google\Update\Clients\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Google\Update\ClientState\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\%s" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\proxy" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCR\http\shell\open\command" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCR\Applications\chrome.exe\shell\open\command" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCR\Applications\FIREFOX.EXE\shell\open\command" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Policies\Microsoft\Edge\WebView2\DowngradeVersion" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCR\CLSID\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "\SOFTWARE\Classes" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\Software\Microsoft\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00002712.00000001.142047.03430000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002712.00000001.142047.03430000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002712.00000001.142047.03430000.00000004.mdmp "Software\Policies\Mi" in Source: 00000000-00002712.00000001.142047.03430000.00000004.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00002712.00000001.142047.03430000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00003524.00000000.141300.10B80000.00000004.mdmp "sWinPEHost: Cannot open reg key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNT. Assuming the host is NOT WinPE. RegOpenKeyExW err" in Source: 00000000-00003524.00000000.141300.10B80000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00003524.00000000.141300.10B80000.00000004.mdmp "Y\MACHINE\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00003524.00000000.141300.10B80000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00004016.00000000.140745.00D60000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004016.00000000.140745.00D60000.00000004.mdmp "HKLM\Software\Microsoft\" in Source: 00000000-00004016.00000000.140745.00D60000.00000004.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00004016.00000000.140745.00D60000.00000004.mdmp "Software\Mic" in Source: 00000000-00004016.00000000.140745.00D60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00004016.00000000.140745.00D60000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00004016.00000000.140745.00D60000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00004016.00000000.140745.01341000.00000020.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005020.00000000.140656.00DB0000.00000004.mdmp "Software\OEM\MicrosoftEdge" in Source: 00000000-00005020.00000000.140656.013EC000.00000002.mdmp "SOFTWARE\Microsoft\EdgeUpdate" in Source: 00000000-00005020.00000000.140656.013EC000.00000002.mdmp40:Ta8f,Process Jutsu-Setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6316:168:WilStaging_02" Process Jutsu-Setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6316:168:WilStaging_02" Process Jutsu-Setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6316:64:WilError_01" Process Jutsu-Setup.exe created mutex with name "Local\SM0:6316:168:WilStaging_02" Process Jutsu-Setup.exe created mutex with name "SM0:6316:64:WilError_01" Process Jutsu-Setup.exe created mutex with name "SM0:6316:168:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5072:168:WilStaging_02" Process taskkill.exe created mutex with name "SM0:5072:168:WilStaging_02" Process MicrosoftEdgeWebview2Setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5020:168:WilStaging_02" Process MicrosoftEdgeWebview2Setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5020:168:WilStaging_02" Process MicrosoftEdgeWebview2Setup.exe created mutex with name "SM0:5020:168:WilStaging_02" Process MicrosoftEdgeWebview2Setup.exe created mutex with name "Local\SM0:5020:168:WilStaging_02" Process MicrosoftEdgeUpdate.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4016:168:WilStaging_02" Process MicrosoftEdgeUpdate.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4016:168:WilStaging_02" Process MicrosoftEdgeUpdate.exe created mutex with name "\Sessions\1\BaseNamedObjects\_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log" Process MicrosoftEdgeUpdate.exe created mutex with name "\BaseNamedObjects\EdgeUpdate{F340B839-380B-4AA9-BA6F-B83F23E2DD05}" Process MicrosoftEdgeUpdate.exe created mutex with name "\BaseNamedObjects\EdgeUpdate{DDDDEAEB-04CC-4BAA-9C63-CCA5FE38F688}" Process MicrosoftEdgeUpdate.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4016:64:WilError_01" Process MicrosoftEdgeUpdate.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process MicrosoftEdgeUpdate.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4016:64:WilError_01" Process MicrosoftEdgeUpdate.exe created mutex with name "Local\SM0:4016:64:WilError_01" Process MicrosoftEdgeUpdate.exe created mutex with name "Local\SM0:4016:168:WilStaging_02" Process MicrosoftEdgeUpdate.exe created mutex with name "SM0:4016:64:WilError_01" Process MicrosoftEdgeUpdate.exe created mutex with name "_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log" Process MicrosoftEdgeUpdate.exe created mutex with name "SM0:4016:168:WilStaging_02"41:Tb39,Antivirus vendors marked dropped file "BouncyCastle.Cryptography.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "msedgeupdate.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeWebview2Setup.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "Microsoft.Web.WebView2.Core.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "psmachine_64.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "psuser_64.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "psmachine_arm64.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"), Antivirus vendors marked dropped file "psuser_arm64.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"), Antivirus vendors marked dropped file "psmachine.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "psuser.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateCore.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateComRegisterShell64.exe" as clean (type is "PE32+ executable for MS Windows 5.02 (GUI) x86-64 8 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdate.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeComRegisterShellARM64.exe" as clean (type is "PE32+ executable for MS Windows 10.00 (GUI) ARM64 7 sections"), Antivirus vendors marked dropped file "WebView2Loader.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"), Antivirus vendors marked dropped file "WebView2Loader.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) ARM64 7 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateOnDemand.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateBroker.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateSetup.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections")42:T1015,"Jutsu-Setup.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "msedgeupdate.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "MicrosoftEdgeWebview2Setup.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Microsoft.Web.WebView2.Core.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "psmachine_64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psuser_64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psmachine_arm64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psuser_arm64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psmachine.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psuser.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "MicrosoftEdgeUpdateCore.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Jutsu.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeUpdateComRegisterShell64.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeUpdate.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeComRegisterShellARM64.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "WebView2Loader.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "WebView2Loader.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "MicrosoftEdgeUpdateOnDemand.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeUpdateBroker.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Microsoft.Web.WebView2.WinForms.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "msedgeupdateres_el.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF43:T3e1a,"SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SOFTWARE\Microsoft\Office\OfficeHub" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "KCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\%ws\UsageStats\Daily" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKU\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Setup\State" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "KLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\DownloaderLockout" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\CdpNames\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\AdditionalInstallArgs\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Classes" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepository\Packages" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Google\Update" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Google\Update\Clients\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Google\Update\ClientState\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\%s" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\proxy" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCR\http\shell\open\command" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCR\Applications\chrome.exe\shell\open\command" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCR\Applications\FIREFOX.EXE\shell\open\command" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Policies\Microsoft\Edge\WebView2\DowngradeVersion" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCR\CLSID\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "\SOFTWARE\Classes" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKCU\Software\Microsoft\" in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00002712.00000001.142047.03430000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002712.00000001.142047.03430000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002712.00000001.142047.03430000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002712.00000001.142047.03430000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00002712.00000001.142047.03430000.00000004.mdmp "Software\Policies\Mi" in Source: 00000000-00002712.00000001.142047.03430000.00000004.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00002712.00000001.142047.03430000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00003524.00000000.141300.10B80000.00000004.mdmp "sWinPEHost: Cannot open reg key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNT. Assuming the host is NOT WinPE. RegOpenKeyExW err" in Source: 00000000-00003524.00000000.141300.10B80000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00003524.00000000.141300.10B80000.00000004.mdmp "Y\MACHINE\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00003524.00000000.141300.10B80000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00004016.00000000.140745.00D60000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004016.00000000.140745.00D60000.00000004.mdmp "HKLM\Software\Microsoft\" in Source: 00000000-00004016.00000000.140745.00D60000.00000004.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00004016.00000000.140745.00D60000.00000004.mdmp "Software\Mic" in Source: 00000000-00004016.00000000.140745.00D60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00004016.00000000.140745.00D60000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00004016.00000000.140745.00D60000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00004016.00000000.140745.01341000.00000020.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005020.00000000.140656.00DB0000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate" in Source: 00000000-00005020.00000000.140656.013EC000.00000002.mdmp "Software\OEM\MicrosoftEdge" in Source: 00000000-00005020.00000000.140656.013EC000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00005124.00000000.141650.46548000.00000002.mdmp "SOFTWARE\Microsoft\Office\OfficeHub" in Source: 00000000-00005124.00000000.141650.46548000.00000002.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: 00000000-00005124.00000000.141650.46548000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005124.00000000.141650.46548000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" in Source: 00000000-00005124.00000000.141650.46548000.00000002.mdmp "Software\Classes" in Source: 00000000-00005124.00000000.141650.46548000.00000002.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005124.00000000.141650.46548000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepository\Packages" in Source: 00000000-00005124.00000000.141650.46548000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" in Source: 00000000-00005124.00000000.141650.46548000.00000002.mdmp "Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005124.00000000.141650.F0D90000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00005124.00000000.141650.F0D90000.00000004.mdmp "sWinPEHost: Cannot open reg key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNT. Assuming the host is NOT WinPE. RegOpenKeyExW err" in Source: 00000000-00005124.00000000.141650.F0D90000.00000004.mdmp "HHKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005124.00000000.141650.F0D90000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005124.00000000.141650.F0D90000.00000004.mdmp "Y\MACHINE\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005124.00000000.141650.F0D90000.00000004.mdmp "35Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00006228.00000000.142009.532D0000.00000004.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00006228.00000000.142009.532D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Micr" in Source: 00000000-00006228.00000000.142009.532D0000.00000004.mdmp "HHKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00006228.00000000.142009.532D0000.00000004.mdmp "Software\AnimeApp-a5" in Source: 00000000-00006316.00000000.131319.03210000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00006316.00000000.131319.03210000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00006316.00000000.131319.03210000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00006316.00000000.131319.03210000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\AnimeApp-a5" in Source: 00000000-00006316.00000000.131319.03210000.00000004.mdmp "Software\AnimeApp-a5" in Source: 00000000-00006316.00000001.133241.03210000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00006316.00000001.133241.03210000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00006316.00000001.133241.03210000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00006316.00000001.133241.03210000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\AnimeApp-a5" in Source: 00000000-00006316.00000001.133241.03210000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00006316.00000002.135158.0040D000.00000002.mdmp "Software\AnimeApp-a5" in Source: 00000000-00006316.00000002.135158.03210000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00006316.00000002.135158.03210000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00006316.00000002.135158.03210000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00006316.00000002.135158.03210000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\AnimeApp-a5" in Source: 00000000-00006316.00000002.135158.03210000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007356.00000000.140883.00981000.00000020.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007356.00000000.140883.03150000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007356.00000000.140883.03150000.00000004.mdmp44:T1f4e,"Jutsu-Setup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73690000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73610000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 735e0000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 75a30000 "Jutsu-Setup.exe" loaded module "NTDLL.DLL" at base 77030000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73540000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 733c0000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73390000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 73a40000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 73330000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 75980000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 73300000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 732f0000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 732e0000 "Jutsu-Setup.exe" loaded module "KERNEL32.DLL" at base 76560000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 732d0000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 730e0000 "Jutsu-Setup.exe" loaded module "COMCTL32.DLL" at base 73820000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76770000 "Jutsu-Setup.exe" loaded module "%TEMP%\NSL4021.TMP\NSDIALOGS.DLL" at base 73070000 "Jutsu-Setup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 757e0000 "Jutsu-Setup.exe" loaded module "%TEMP%\NSL4021.TMP\SYSTEM.DLL" at base 72c40000 "Jutsu-Setup.exe" loaded module "%TEMP%\NSL4021.TMP\NSEXEC.DLL" at base 72c30000 "Jutsu-Setup.exe" loaded module "OLEAUT32.DLL" at base 76f70000 "Jutsu-Setup.exe" loaded module "RPCRT4.DLL" at base 76630000 "Jutsu-Setup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76930000 "Jutsu-Setup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76930000 "Jutsu-Setup.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 76cc0000 "Jutsu-Setup.exe" loaded module "COMCTL32" at base 73820000 "MicrosoftEdgeWebview2Setup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73690000 "MicrosoftEdgeWebview2Setup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74de0000 "MicrosoftEdgeWebview2Setup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74de0000 "MicrosoftEdgeWebview2Setup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74de0000 "MicrosoftEdgeWebview2Setup.exe" loaded module "KERNEL32" at base 76560000 "MicrosoftEdgeWebview2Setup.exe" loaded module "SHLWAPI.DLL" at base 76720000 "MicrosoftEdgeWebview2Setup.exe" loaded module "KERNEL32.DLL" at base 76560000 "MicrosoftEdgeWebview2Setup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73610000 "MicrosoftEdgeWebview2Setup.exe" loaded module "NTDLL.DLL" at base 77030000 "MicrosoftEdgeWebview2Setup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73540000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73690000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74de0000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74de0000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74de0000 "MicrosoftEdgeUpdate.exe" loaded module "SHELL32.DLL" at base 73a70000 "MicrosoftEdgeUpdate.exe" loaded module "KERNEL32" at base 76560000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74de0000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74de0000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74de0000 "MicrosoftEdgeUpdate.exe" loaded module "SHLWAPI.DLL" at base 76720000 "MicrosoftEdgeUpdate.exe" loaded module "KERNEL32.DLL" at base 76560000 "MicrosoftEdgeUpdate.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\TEMP\EU77CF.TMP\MSEDGEUPDATE.DLL" at base 729d0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 76560000 "MicrosoftEdgeUpdate.exe" loaded module "ADVAPI32.DLL" at base 754e0000 "MicrosoftEdgeUpdate.exe" loaded module "RPCRT4.DLL" at base 76630000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 72900000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 729b0000 "MicrosoftEdgeUpdate.exe" loaded module "NETAPI32.DLL" at base 729b0000 "MicrosoftEdgeUpdate.exe" loaded module "USER32.DLL" at base 76930000 "MicrosoftEdgeUpdate.exe" loaded module "OLE32.DLL" at base 757e0000 "MicrosoftEdgeUpdate.exe" loaded module "GDI32.DLL" at base 766f0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\MSXML6.DLL" at base 72640000 "MicrosoftEdgeUpdate.exe" loaded module "KERNELBASE.DLL" at base 74de0000 "MicrosoftEdgeUpdate.exe" loaded module "NTDLL.DLL" at base 77030000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73540000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 725b0000 "MicrosoftEdgeUpdate.exe" loaded module "OLEAUT32.DLL" at base 76f70000 "MicrosoftEdgeUpdate.exe" loaded module "SSPICLI.DLL" at base 73a50000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NTDLL.DLL" at base 77030000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WLDP.DLL" at base 72590000 "MicrosoftEdgeUpdate.exe" loaded module "COMCTL32.DLL" at base 73820000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73610000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76770000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 733c0000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76560000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 720d0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 73a70000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75f90000 "MicrosoftEdgeUpdate.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEUPDATE\1.3.275.13\MSEDGEUPDATE.DLL" at base 729d0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 72600000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 758e0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 72570000 "MicrosoftEdgeUpdate.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEUPDATE\1.3.275.13\PSMACHINE.DLL" at base 72540000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 72500000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff854510000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 7ff859520000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 7ff85a440000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "OLE32.DLL" at base 2e612bd0000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "USER32.DLL" at base 7ff865a90000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "RPCRT4.DLL" at base 7ff865290000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff862730000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "OLE32.DLL" at base 22355350000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 7209000045:Tf52,"Jutsu-Setup.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Jutsu-Setup.exe" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "msedgeupdate.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "msedgeupdate.dll" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "MicrosoftEdgeWebview2Setup.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MicrosoftEdgeWebview2Setup.exe" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "Microsoft.Web.WebView2.Core.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Microsoft.Web.WebView2.Core.dll" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "psmachine_64.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "psmachine_64.dll" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "psuser_64.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "psuser_64.dll" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "psmachine_arm64.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "psmachine_arm64.dll" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "psuser_arm64.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "psuser_arm64.dll" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "psmachine.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "psmachine.dll" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "psuser.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "psuser.dll" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "MicrosoftEdgeUpdateCore.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MicrosoftEdgeUpdateCore.exe" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "Jutsu.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Jutsu.exe" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "MicrosoftEdgeUpdateComRegisterShell64.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MicrosoftEdgeUpdateComRegisterShell64.exe" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "MicrosoftEdgeUpdate.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MicrosoftEdgeUpdate.exe" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "MicrosoftEdgeComRegisterShellARM64.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MicrosoftEdgeComRegisterShellARM64.exe" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "WebView2Loader.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "WebView2Loader.dll" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "MicrosoftEdgeUpdateOnDemand.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MicrosoftEdgeUpdateOnDemand.exe" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "MicrosoftEdgeUpdateBroker.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MicrosoftEdgeUpdateBroker.exe" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "Microsoft.Web.WebView2.WinForms.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Microsoft.Web.WebView2.WinForms.dll" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "msedgeupdateres_el.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "msedgeupdateres_el.dll" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker"46:T449,"Jutsu-Setup.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Jutsu-Setup.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "Jutsu-Setup.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "XML DOM Document 6.0" (Path: "HKCU\WOW6432NODE\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}") "MicrosoftEdgeUpdate.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "MicrosoftEdgeUpdate.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")47:T53b,"Jutsu-Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Jutsu-Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Jutsu-Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Jutsu-Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "MicrosoftEdgeWebview2Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "MicrosoftEdgeWebview2Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "MicrosoftEdgeWebview2Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "MicrosoftEdgeUpdate.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "MicrosoftEdgeUpdate.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "MicrosoftEdgeUpdate.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "MicrosoftEdgeUpdate.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "MicrosoftEdgeUpdateComRegisterShell64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "MicrosoftEdgeUpdateComRegisterShell64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")48:T81c,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00006316-00000C2B-1041879708] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00006316-00000C2B-1041892887] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00006316-00000C2B-1041914050] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00006316-00000C2B-1042036884] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00006316-00000C2B-1042054700] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00006316-00000C2B-1042069487] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00006316-00000C2B-1042080143] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00006316-00000C2B-1042095801] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00006316-00000C2B-1042108029] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00006316-00000C2B-1042123366] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00006316-00000C2B-1042135560] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00006316-00000C2B-1042149527] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00006316-00000C2B-1042408132] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00004016-00000C2B-1189528769] Observed system executable string:"%WINDIR%\system32\MDMRegistration.dll" [Source: 00000000-00004016-00000C2B-1189629483] Observed system executable string:"%WINDIR%\system32\NetApi32.dll" [Source: 00000000-00004016-00000C2B-1189747674] Observed system executable string:"%WINDIR%\system32\ntdll.dll" [Source: 00000000-00004016-00000C2B-1213852313] Observed system executable string:"%WINDIR%\system32\wldp.dll" [Source: 00000000-00004016-00000C2B-1214070629]49:T564,Spawned process "taskkill.exe" with commandline "taskkill /IM "Jutsu.exe" /F" (UID: 00000000-00005072) Spawned process "MicrosoftEdgeWebview2Setup.exe" with commandline "/silent /install" (UID: 00000000-00005020) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} ..." (UID: 00000000-00004016), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regsvc" (UID: 00000000-00007356), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regserver" (UID: 00000000-00002712), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00003524), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00005124), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00006228), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00005384), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname ..." (UID: 00000000-00005076) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/svc" (UID: 00000000-00005624) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00006296)4a:T564,Spawned process "taskkill.exe" with commandline "taskkill /IM "Jutsu.exe" /F" (UID: 00000000-00005072) Spawned process "MicrosoftEdgeWebview2Setup.exe" with commandline "/silent /install" (UID: 00000000-00005020) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} ..." (UID: 00000000-00004016), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regsvc" (UID: 00000000-00007356), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regserver" (UID: 00000000-00002712), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00003524), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00005124), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00006228), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00005384), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname ..." (UID: 00000000-00005076) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/svc" (UID: 00000000-00005624) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00006296)4b:T485,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "Jutsu-Setup.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")4c:T636f,"BouncyCastle.Cryptography.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\BouncyCastle.Cryptography.dll]- [targetUID: 00000000-00006316] "msedgeupdate.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdate.dll]- [targetUID: 00000000-00002712] "MicrosoftEdgeWebview2Setup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%TEMP%\nsl4021.tmp\MicrosoftEdgeWebview2Setup.exe]- [targetUID: 00000000-00005020] "Microsoft.Web.WebView2.Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\Microsoft.Web.WebView2.Core.dll]- [targetUID: 00000000-00006316] "psmachine_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psmachine_64.dll]- [targetUID: 00000000-00005020] "psuser_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psuser_64.dll]- [targetUID: 00000000-00005020] "psmachine_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psmachine_arm64.dll]- [targetUID: 00000000-00005020] "psuser_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psuser_arm64.dll]- [targetUID: 00000000-00005020] "psmachine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psmachine.dll]- [targetUID: 00000000-00002712] "psuser.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psuser.dll]- [targetUID: 00000000-00005020] "MicrosoftEdgeUpdateCore.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateCore.exe]- [targetUID: 00000000-00005020] "Jutsu.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\Jutsu.exe]- [targetUID: 00000000-00006316] "MicrosoftEdgeUpdateComRegisterShell64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe]- [targetUID: 00000000-00002712] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00002712] "MicrosoftEdgeComRegisterShellARM64.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) ARM64 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeComRegisterShellARM64.exe]- [targetUID: 00000000-00005020] "WebView2Loader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\runtimes\win-x64\native\WebView2Loader.dll]- [targetUID: 00000000-00006316] "WebView2Loader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 7 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\runtimes\win-arm64\native\WebView2Loader.dll]- [targetUID: 00000000-00006316] "WebView2Loader.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\runtimes\win-x86\native\WebView2Loader.dll]- [targetUID: 00000000-00006316] "MicrosoftEdgeUpdateOnDemand.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateOnDemand.exe]- [targetUID: 00000000-00005020] "MicrosoftEdgeUpdateBroker.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateBroker.exe]- [targetUID: 00000000-00005020] "Microsoft.Web.WebView2.WinForms.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\Microsoft.Web.WebView2.WinForms.dll]- [targetUID: 00000000-00006316] "msedgeupdateres_el.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_el.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ml.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ml.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_de.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_de.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ca.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ca.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_it.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_it.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_pl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_pl.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_fr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fr.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_lb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_lb.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_nl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_nl.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ca-Es-VALENCIA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ca-Es-VALENCIA.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_gd.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_gd.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_fr-CA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fr-CA.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sl.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ro.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ro.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_kn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_kn.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_or.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_or.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_hu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_hu.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_fil.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fil.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_hr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_hr.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_af.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_af.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ka.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ka.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sr-Cyrl-BA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sr-Cyrl-BA.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_mk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_mk.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_az.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_az.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_es-419.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_es-419.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sr.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_bg.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bg.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_bn-IN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bn-IN.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_mt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_mt.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_bn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bn.dll]- [targetUID: 00000000-00005020] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%TEMP%\nsl4021.tmp\System.dll]- [targetUID: 00000000-00006316] "msedgeupdateres_ne.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ne.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_pt-BR.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_pt-BR.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_as.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_as.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_pt-PT.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_pt-PT.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sv.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sr-Cyrl-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sr-Cyrl-RS.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_lv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_lv.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_te.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_te.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_eu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_eu.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ta.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ta.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sr-Latn-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sr-Latn-RS.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_hi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_hi.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_bs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bs.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_gl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_gl.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ga.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ga.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ur.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ur.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_nn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_nn.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_da.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_da.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_es.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_es.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_uk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_uk.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_gu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_gu.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_pa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_pa.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_is.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_is.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_kok.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_kok.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_tr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_tr.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_lt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_lt.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_vi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_vi.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_nb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_nb.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_kk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_kk.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_cs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_cs.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_id.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_id.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_et.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_et.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sq.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sq.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_fi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fi.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_cy.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_cy.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_tt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_tt.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_quz.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_quz.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sk.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ms.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ms.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_mi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_mi.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_mr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_mr.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ru.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ru.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_fa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fa.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_th.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_th.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_km.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_km.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_en.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_en.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_en-GB.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_en-GB.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_lo.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_lo.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ug.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ug.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ar.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ar.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_iw.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_iw.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_am.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_am.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ja.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ja.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ko.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ko.dll]- [targetUID: 00000000-00005020] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe]- [targetUID: 00000000-00005020] "msedgeupdateres_zh-TW.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_zh-TW.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_zh-CN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_zh-CN.dll]- [targetUID: 00000000-00005020] "nsDialogs.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 8 sections"- Location: [%TEMP%\nsl4021.tmp\nsDialogs.dll]- [targetUID: 00000000-00006316] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 7 sections"- Location: [%TEMP%\nsl4021.tmp\nsExec.dll]- [targetUID: 00000000-00006316] "Jutsu.exe.config" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\Jutsu\Jutsu.exe.config]- [targetUID: 00000000-00006316] "nsv4010.tmp" has type "Unknown"- Location: [%TEMP%\nsv4010.tmp]- [targetUID: 00000000-00006316] "MicrosoftEdgeUpdate.log" has type "Unknown"- Location: [%ALLUSERSPROFILE%\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log]- [targetUID: 00000000-00002712] "modern-wizard.bmp" has type "PC bitmap Windows 3.x format 164 x 314 x 4 image size 26376 resolution 2834 x 2834 px/m cbSize 26494 bits offset 118"- Location: [%TEMP%\nsl4021.tmp\modern-wizard.bmp]- [targetUID: 00000000-00006316] "7A19A3F6AFF08A3C532EF8C78F47948C" has type "Unknown"- [targetUID: N/A] "af397ef28e484961ba48646a5d38cf54.db.ses" has type "Unknown"- [targetUID: N/A] "MicrosoftEdgeUpdateSetup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateSetup.exe]- [targetUID: 00000000-00005020] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00002712] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\CopilotUpdate.exe]- [targetUID: 00000000-00005020]4d:T790,"Jutsu-Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "Jutsu-Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "Jutsu-Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "Jutsu-Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "Jutsu-Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "Jutsu-Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\TASKKILL.EXE"; Key: ""; Value: "") "Jutsu-Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86\XTAJIT"; Key: ""; Value: "") "Jutsu-Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "Jutsu-Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "Jutsu-Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\APPCERTDLLS"; Key: ""; Value: "") "Jutsu-Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Jutsu-Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Jutsu-Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")4e:T14fe,"BouncyCastle.Cryptography.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\BouncyCastle.Cryptography.dll]- [targetUID: 00000000-00006316] "msedgeupdate.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdate.dll]- [targetUID: 00000000-00002712] "Microsoft.Web.WebView2.Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\Microsoft.Web.WebView2.Core.dll]- [targetUID: 00000000-00006316] "psmachine_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psmachine_64.dll]- [targetUID: 00000000-00005020] "psuser_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psuser_64.dll]- [targetUID: 00000000-00005020] "psmachine_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psmachine_arm64.dll]- [targetUID: 00000000-00005020] "psuser_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psuser_arm64.dll]- [targetUID: 00000000-00005020] "psmachine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psmachine.dll]- [targetUID: 00000000-00002712] "psuser.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psuser.dll]- [targetUID: 00000000-00005020] "WebView2Loader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\runtimes\win-x64\native\WebView2Loader.dll]- [targetUID: 00000000-00006316] "WebView2Loader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 7 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\runtimes\win-arm64\native\WebView2Loader.dll]- [targetUID: 00000000-00006316] "WebView2Loader.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\runtimes\win-x86\native\WebView2Loader.dll]- [targetUID: 00000000-00006316] "Microsoft.Web.WebView2.WinForms.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\Microsoft.Web.WebView2.WinForms.dll]- [targetUID: 00000000-00006316] "msedgeupdateres_el.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_el.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ml.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ml.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_de.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_de.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ca.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ca.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_it.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_it.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_pl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_pl.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_fr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fr.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_lb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_lb.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_nl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_nl.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ca-Es-VALENCIA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ca-Es-VALENCIA.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_gd.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_gd.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_fr-CA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fr-CA.dll]- [targetUID: 00000000-00005020]4f:T53e,"Jutsu-Setup.exe" queries basic process information of the "C:\Jutsu-Setup.exe" (UID: 6316) "MicrosoftEdgeWebview2Setup.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdate.exe" (UID: 5020) "MicrosoftEdgeUpdate.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (UID: 4016) "MicrosoftEdgeUpdate.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdate.exe" (UID: 4016) "MicrosoftEdgeUpdate.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 2712) "MicrosoftEdgeUpdateComRegisterShell64.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 3524) "MicrosoftEdgeUpdateComRegisterShell64.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 5124) "MicrosoftEdgeUpdateComRegisterShell64.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 6228)50:Te10,"Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\TASKKILL.EXE"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")51:Tb5c,"MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdate.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\CopilotUpdate.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdate.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateBroker.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateOnDemand.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeComRegisterShellARM64.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\psmachine.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\psmachine_64.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\psmachine_arm64.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\psuser.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\psuser_64.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\psuser_arm64.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\NOTICE.TXT" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\EdgeUpdate.dat" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateCore.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_am.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ar.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bg.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bn.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ca.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_cs.dll"52:T7e2,"Jutsu-Setup.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Jutsu-Setup.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Jutsu-Setup.exe" trying to access non-existent file "C:\MSVCP140.DLL" "Jutsu-Setup.exe" trying to access non-existent file "C:\MSVCP140.dll" "Jutsu-Setup.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Jutsu-Setup.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "Jutsu-Setup.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Jutsu-Setup.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Jutsu-Setup.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "Jutsu-Setup.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "Jutsu-Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsl4021.tmp\NSDIALOGS.DLL" "Jutsu-Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsl4021.tmp\nsDialogs.dll" "Jutsu-Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsl4021.tmp\SYSTEM.DLL" "Jutsu-Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsl4021.tmp\System.dll" "Jutsu-Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsl4021.tmp\NSEXEC.DLL" "Jutsu-Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsl4021.tmp\nsExec.dll" "Jutsu-Setup.exe" trying to access non-existent file "C:\TASKKILL.EXE" "Jutsu-Setup.exe" trying to access non-existent file "C:\taskkill.exe" "Jutsu-Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\Jutsu\JUTSU.EXE" "Jutsu-Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\Jutsu\MICROSOFT.WEB.WEBVIEW2.CORE.DLL" "Jutsu-Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\Jutsu\MICROSOFT.WEB.WEBVIEW2.WINFORMS.DLL"53:Tf15,Found reference to API "UATriggeredByInternetConnectivity" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[Ping::SendString][Old UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "EcsUATriggeredByInternetConnectivityError" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity error][ResourceManager::Create][0x%08x]" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[Ping::SendString][Old UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[InstallGoopdateTaskForMode][UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[InstallGoopdateTaskForMode][UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp")54:T754,Found reference to API "UATriggeredByInternetConnectivity" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[Ping::SendString][Old UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "EcsUATriggeredByInternetConnectivityError" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity error][ResourceManager::Create][0x%08x]" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[Ping::SendString][Old UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[InstallGoopdateTaskForMode][UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[InstallGoopdateTaskForMode][UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp")55:Tf85,Found reference to API "WinHttpCheckPlatform" (Indicator: "WinHttpCheckPlatform"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpGetDefaultProxyConfiguration" (Indicator: "WinHttpGetDefaultProxyConfiguration"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpCreateUrl" (Indicator: "WinHttpCreateUrl"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpDetectAutoProxyConfigUrl" (Indicator: "WinHttpDetectAutoProxyConfigUrl"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpSetDefaultProxyConfiguration" (Indicator: "WinHttpSetDefaultProxyConfiguration"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp")56:T499,Found reference to API "[WaitForEULAAccepted][Give up: Shutdown event set]" (Indicator: " shutdown "; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[WaitForOOBEConnectivity][Give up: Shutdown event set]" (Indicator: " shutdown "; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[Failed to set shutdown event][0x%08x]" (Indicator: " shutdown "; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[Failed to create shutdown event][0x%08x]" (Indicator: " shutdown "; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[Another core instance is already running at log on. Sending shutdown event.]" (Indicator: " shutdown "; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[Other Omaha Update instances failed to shutdown in time][%u]" (Indicator: " shutdown "; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") file/memory contains long string with (Indicator: " connect "; Source: "00000000-00004016.00000000.140745.04AA0000.00000002.mdmp")57:Tca8,Heuristic match: "^hw.kn" Heuristic match: "vke.ax" Heuristic match: "wpo.an" Heuristic match: "vt.je" Heuristic match: "h$.st" Heuristic match: "pq.me" Heuristic match: "{ $[.gh" Heuristic match: "pw.ru" Pattern match: "http://nsis.sf.net/nsis_error" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0vj^s:c2" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0ea=j/iamy!x~p9" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0_gyu`=w8t&yf\v[~$anv,xmqmbvwashington1redmond1microsoft" Pattern match: "http://3rdpartysource.microsoft.com" Pattern match: "https://msedge.api.cdp.microsoft.com/api" Pattern match: "https://config.edge.skype.com/config/v1/edgeupdate" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2068169&" Pattern match: "https://to-be-replaced.invalid/cr/report" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2111568&" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2348704&" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "https://msedgesetup.microsoft.com/products" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2109631" Heuristic match: "base\logging.cc" Heuristic match: "d:\a\_work\1\omaha\src\third_party\breakpad\src\processor\minidump.cc" Heuristic match: "d:\a\_work\1\omaha\src\third_party\breakpad\src\processor\basic_code_modules.cc" Heuristic match: "d:\a\_work\1\omaha\src\third_party\breakpad\src\processor\proc_maps_linux.cc" Heuristic match: "eventinfo.name" Pattern match: "https://self.events.data.microsoft.com/onecollector/1.0/" Heuristic match: "appinfo.id" Heuristic match: "appinfo.name" Heuristic match: "deviceinfo.id" Heuristic match: "userinfo.id" Heuristic match: "aggregatedmetric.name" Heuristic match: "failure.id" Heuristic match: "pageaction.targetitemdatasource.name" Heuristic match: "sampledmetric.name" Heuristic match: "pageview.id" Heuristic match: "pageview.name" Heuristic match: "state.name" Heuristic match: "session.id" Heuristic match: "gn.cy" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0m" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "https://www.microsoft.com" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0"58:Tbb8,Found URL "http://https://%s\%shku\runas[started" - Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found URL "https://msedge.api.cdp.microsoft.com/apihttps://config.edge.skype.com/config/v1/edgeupdatehttps://go.microsoft.com/fwlink/?linkid=2068169&https://to-be-replaced.invalid/cr/reporthttps://go.microsoft.com/fwlink/?linkid=2111568&software\microsoft\edgeupdate\downloaderlockout[ismanaged][%s][%d]%d," - Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2348704&from_extra_codeextra_codeproductgethelpgethelp_windowsupdatetestsource%1%2guveratl:%p%s" - Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0m" - Source: "00000000-00004016.00000000.140745.00D60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0_gyu" - Source: "00000000-00004016.00000000.140745.04AA0000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004016.00000000.140745.04AA0000.00000002.mdmp") Found URL "https://www.microsoft.com" - Source: "00000000-00004016.00000000.140745.04AA0000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004016.00000000.140745.04AA0000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00004016.00000000.140745.04AA0000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004016.00000000.140745.04AA0000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005020.00000000.140656.01060000.00000004.mdmp") Found URL "https://jut-su.net/appinstalllocationuninstallstringuninstall.exe" - Source: "00000000-00006316.00000000.131319.03210000.00000004.mdmp") Found URL "https://jut-su.net/appinstalllocationuninstallstringuninstall.exe" - Source: "00000000-00006316.00000001.133241.03210000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00006316.00000002.135158.0040D000.00000002.mdmp") Found URL "https://jut-su.net/appinstalllocationuninstallstringuninstall.exe" - Source: "00000000-00006316.00000002.135158.03210000.00000004.mdmp")59:Tb03,Found registry query API: "RegEnumKeyW" in file "Jutsu-Setup.exe" Found registry query API: "RegEnumValueW" in file "Jutsu-Setup.exe" Found registry query API: "RegOpenKeyExW" in file "Jutsu-Setup.exe" Found registry query API: "RegQueryValueExW" in file "Jutsu-Setup.exe" Found registry query API: "[FindPackageInRepositoryKey][RegQueryInfoKey failed][%d]" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "[IsPackageRegisteredForActiveUser][RegOpenCurrentUser failed][%d]" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "[IsM365AadNotSignedIn][RegOpenCurrentUser failed][%d]" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "[GetPackagedAppState][RegOpenCurrentUser failed][%d]" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "RegOpenKeyTransactedW" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "SHQueryValueExW" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "RegNotifyChangeKeyValue" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "RegOpenCurrentUser" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "RegGetValueA" in "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp" Found registry query API: "sWinPEHost: Cannot open reg key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNT. Assuming the host is NOT WinPE. RegOpenKeyExW err" in "00000000-00003524.00000000.141300.10B80000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004016.00000000.140745.01341000.00000020.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004016.00000000.140745.01341000.00000020.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00005020.00000000.140656.013EC000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00005020.00000000.140656.013EC000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005020.00000000.140656.013EC000.00000002.mdmp"5a:T4d7,Found reference to API "[GetLogonTime WTSQuerySessionInformation failed][0x%x]" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "NetGetJoinInformation" (Indicator: "NetGetJoinInformation"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp")5b:Tad1,"Jutsu-Setup.exe" called "FindFirstFileW" with parameter %TEMP%\nsl4021.tmp (UID: 00000000-00006316) "MicrosoftEdgeUpdate.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\*.* (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter 1.3.221.3 (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.221.3\* (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter CopilotUpdate.exe (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter EdgeUpdate.dat (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter MicrosoftEdgeComRegisterShellARM64.exe (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter MicrosoftEdgeUpdate.exe (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter MicrosoftEdgeUpdateBroker.exe (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter MicrosoftEdgeUpdateComRegisterShell64.exe (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter MicrosoftEdgeUpdateCore.exe (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter MicrosoftEdgeUpdateOnDemand.exe (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter MicrosoftEdgeUpdateSetup.exe (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter msedgeupdate.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter msedgeupdateres_af.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter msedgeupdateres_am.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter msedgeupdateres_ar.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter msedgeupdateres_as.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter msedgeupdateres_az.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter msedgeupdateres_bg.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter msedgeupdateres_bn-IN.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter msedgeupdateres_bn.dll (UID: 00000000-00004016) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter msedgeupdateres_bs.dll (UID: 00000000-00004016)5c:T57e,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "Jutsu-Setup.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "Jutsu-Setup.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")5d:Teda,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "Jutsu-Setup.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Jutsu-Setup.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "Jutsu-Setup.exe") Found reference to API "[EnumProcesses failed][%u]" (Indicator: "EnumProcesses"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "K32EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")5e:T492,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Jutsu-Setup.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "Jutsu-Setup.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")5f:Tec3,Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "Jutsu-Setup.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "Jutsu-Setup.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "Jutsu-Setup.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "Jutsu-Setup.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "Jutsu-Setup.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "Jutsu-Setup.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "Jutsu-Setup.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "Jutsu-Setup.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "Jutsu-Setup.exe") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "00000000-00005020.00000000.140656.013D1000.00000020.mdmp") Found reference to API "LOG_SYSTEM: ERROR - [::GetFileInformationByHandle failed][%d]" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp")60:T46e,Found string "ping" (Indicator: "ping"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found string "[VerifyServerCertWithMuca][Empty hostname - fail closed]" (Indicator: "hostname"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found string "[Copilot policy ping failed][0x%08x]" (Indicator: "ping"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found string "[Copilot pin migration ping failed][0x%08x]" (Indicator: "ping"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found string "[bundle_creator][Copilot package gate ping failed][0x%08x]" (Indicator: "ping"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found string "[Copilot pin migration ping queued][0x%08x]" (Indicator: "ping"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found string "[Ping::Send did not send since ping is deferred]" (Indicator: "ping"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found string "Ping" (Indicator: "ping"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp")61:T574,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002712.00000000.141210.03430000.00000004.mdmp, 00000000-00002712.00000001.142047.03430000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateComRegisterShell64.exe" (Indicator: "\Device\"; Source: "00000000-00003524.00000000.141300.10B80000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003524.00000000.141300.10B80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdate.exe" (Indicator: "\Device\"; Source: "00000000-00004016.00000000.140745.00D60000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004016.00000000.140745.00D60000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005020.00000000.140656.00DB0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00005020.00000000.140656.00DB0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\nsl4021.tmp\MicrosoftEdgeWebview2Setup.exe" (Indicator: "\Device\"; Source: "00000000-00005020.00000000.140656.00DB0000.00000004.mdmp")62:T42a,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "Jutsu-Setup.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "Jutsu-Setup.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "Jutsu-Setup.exe") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "SeDebugPrivilege|" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004016.00000000.140745.00D60000.00000004.mdmp")63:Te6b,Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp")64:T769,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "Jutsu-Setup.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00005020.00000000.140656.013D1000.00000020.mdmp") Found reference to API "[::TerminateProcess failed][%u][%u]" (Indicator: "TerminateProcess"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "[::TerminateProcess succeeded][%u]" (Indicator: "TerminateProcess"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004016.00000000.140745.01341000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004016.00000000.140745.01359000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005020.00000000.140656.013EC000.00000002.mdmp")65:T9bd,"Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\TASKKILL.EXE"; Value: "") "Jutsu-Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\NSL4021.TMP\MICROSOFTEDGEWEBVIEW2SETUP.EXE"; Value: "") "MicrosoftEdgeWebview2Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SANDBOXFILTER"; Key: "SUPPORTEDFEATURES"; Value: "") "MicrosoftEdgeWebview2Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "MicrosoftEdgeWebview2Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "MicrosoftEdgeWebview2Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "MicrosoftEdgeWebview2Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\TEMP\EU77CF.TMP\MICROSOFTEDGEUPDATE.EXE"; Value: ""), "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: ""), "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: ""), "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: ""), "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: ""), "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\MICROSOFTEDGEUPDATE.EXE"; Value: ""), "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.275.13\MICROSOFTEDGEUPDATECOMREGISTERSHELL64.EXE"; Value: "")66:T15280,"MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "%TEMP%\CopilotUpdate.exe.old{B610E95B-4A58-46A0-8A6A-B0CF39F03157}") "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "PATH"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "COPILOTUPDATEPATH"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "UNINSTALLCMDLINE"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTS\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}"; Key: "PV"; Value: "1.3.275.13"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTS\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}"; Key: "NAME"; Value: "Microsoft Edge Update"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}"; Key: "PV"; Value: "1.3.275.13"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MICROSOFTEDGEUPDATE.EXE"; Key: "DISABLEEXCEPTIONCHAINVALIDATION"; Value: "0000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "LASTOSVERSION"; Value: "1C0100000A00000000000000AB3F00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001010000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "LASTOSVERSIONPATCHNUMBER"; Value: "F800000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "VERSION"; Value: "1.3.275.13"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MICROSOFT EDGE UPDATE"; Key: "DISPLAYVERSION"; Value: "1.3.275.13"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MICROSOFT EDGE UPDATE"; Key: "VERSION"; Value: "1.3.275.13"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}"; Key: "INSTALLSOURCE"; Value: "otherinstallcmd"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\PERSISTEDPINGS\{8F552C63-7D12-4716-B235-AF1BE710357E}"; Key: "PERSISTEDPINGSTRING"; Value: ""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\PERSISTEDPINGS\{8F552C63-7D12-4716-B235-AF1BE710357E}"; Key: "PERSISTEDPINGTIME"; Value: "134357861555129208"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "(DEFAULT)"; Value: "ServiceModule"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\MICROSOFTEDGEUPDATE.EXE"; Key: "APPID"; Value: "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "LOCALSERVICE"; Value: "edgeupdate"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "SERVICEPARAMETERS"; Value: "/comsvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\EDGEUPDATE"; Key: "EVENTMESSAGEFILE"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE.1.0"; Key: "(DEFAULT)"; Value: "Update3COMClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE"; Key: "(DEFAULT)"; Value: "Update3COMClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE\CLSID"; Key: "(DEFAULT)"; Value: "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3COMClassService.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "(DEFAULT)"; Value: "Update3COMClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3COMClassService.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3COMClassService"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "APPID"; Value: "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "(DEFAULT)"; Value: "ServiceModule"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\MICROSOFTEDGEUPDATE.EXE"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "LOCALSERVICE"; Value: "edgeupdatem"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "SERVICEPARAMETERS"; Value: "/comsvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\EDGEUPDATEM"; Key: "EVENTMESSAGEFILE"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC\CLSID"; Key: "(DEFAULT)"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassSvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC\CLSID"; Key: "(DEFAULT)"; Value: "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebSvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC.1.0"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC\CLSID"; Key: "(DEFAULT)"; Value: "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusSvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS.1"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS.1\CLSID"; Key: "(DEFAULT)"; Value: "{8F09CD6C-5964-4573-82E3-EBFF7702865B}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS\CLSID"; Key: "(DEFAULT)"; Value: "{8F09CD6C-5964-4573-82E3-EBFF7702865B}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreClass.1"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreClass.1"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\psmachine.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\psmachine.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{DA6570DE-122B-4A09-B42B-37603CABA4FC}\INPROCHANDLER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\psmachine.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{DA6570DE-122B-4A09-B42B-37603CABA4FC}\INPROCHANDLER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59A5853A-2739-421B-999B-91F186558B08}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\psmachine.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59A5853A-2739-421B-999B-91F186558B08}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59A5853A-2739-421B-999B-91F186558B08}"; Key: "(DEFAULT)"; Value: "PSFactoryBuffer"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}"; Key: "(DEFAULT)"; Value: "IPolicyStatus5"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003700000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}"; Key: "(DEFAULT)"; Value: "IAppSideBySide"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}"; Key: "(DEFAULT)"; Value: "IPackage"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}"; Key: "(DEFAULT)"; Value: "IPolicyStatus3"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}"; Key: "(DEFAULT)"; Value: "IPolicyStatusValue"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003200000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}"; Key: "(DEFAULT)"; Value: "IPolicyStatus6"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003800000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}"; Key: "(DEFAULT)"; Value: "IApp2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003300000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}"; Key: "(DEFAULT)"; Value: "IProcessLauncher"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3600000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}"; Key: "(DEFAULT)"; Value: "IAppCommand2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003200000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}"; Key: "(DEFAULT)"; Value: "IPolicyStatus7"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003900000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}"; Key: "(DEFAULT)"; Value: "IAppVersion"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}"; Key: "(DEFAULT)"; Value: "IBrowserHttpRequest2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}"; Key: "(DEFAULT)"; Value: "IGoogleUpdateCore"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}"; Key: "(DEFAULT)"; Value: "ICoCreateAsyncStatus"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}"; Key: "(DEFAULT)"; Value: "IAppBundle"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}"; Key: "(DEFAULT)"; Value: "IAppWeb"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003700000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}"; Key: "(DEFAULT)"; Value: "IJobObserver2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}"; Key: "(DEFAULT)"; Value: "ICurrentState"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}"; Key: "(DEFAULT)"; Value: "ICredentialDialog"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}"; Key: "(DEFAULT)"; Value: "IPolicyStatus4"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003600000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}"; Key: "(DEFAULT)"; Value: "IPolicyStatus"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003600000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}"; Key: "(DEFAULT)"; Value: "IJobObserver"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003300000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}"; Key: "(DEFAULT)"; Value: "IApp"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}"; Key: "(DEFAULT)"; Value: "ICoCreateAsync"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}"; Key: "(DEFAULT)"; Value: "IAppCommand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}"; Key: "(DEFAULT)"; Value: "IRegistrationUpdateHook"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3800000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}"; Key: "(DEFAULT)"; Value: "IAppCommandWeb"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}"; Key: "(DEFAULT)"; Value: "IAppBundleWeb"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}"; Key: "(DEFAULT)"; Value: "IAppUnified"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3WebSecurity"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}"; Key: "(DEFAULT)"; Value: "IProgressWndEvents"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3900000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}"; Key: "(DEFAULT)"; Value: "IPolicyStatus2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003300000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3800000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}"; Key: "(DEFAULT)"; Value: "IProcessLauncher2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3700000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}"; Key: "(DEFAULT)"; Value: "IAppVersionWeb"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE\CLSID"; Key: "(DEFAULT)"; Value: "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachine"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateBroker.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE\CLSID"; Key: "(DEFAULT)"; Value: "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachine"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateBroker.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{B5977F34-9264-4AC3-9B31-1224827FF6E8}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE\CLSID"; Key: "(DEFAULT)"; Value: "{B5977F34-9264-4AC3-9B31-1224827FF6E8}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachine"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateBroker.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Process Launcher Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{08D832B9-D2FD-481F-98CF-904D00DF63CC}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Process Launcher Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER\CLSID"; Key: "(DEFAULT)"; Value: "{08D832B9-D2FD-481F-98CF-904D00DF63CC}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.ProcessLauncher.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Process Launcher Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.ProcessLauncher.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.ProcessLauncher"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS.1"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS.1\CLSID"; Key: "(DEFAULT)"; Value: "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS\CLSID"; Key: "(DEFAULT)"; Value: "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreMachineClass.1"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreMachineClass.1"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreMachineClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK\CLSID"; Key: "(DEFAULT)"; Value: "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK\CLSID"; Key: "(DEFAULT)"; Value: "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachineFallback"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK.1.0"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{77857D02-7A25-4B67-9266-3E122A8F39E4}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK\CLSID"; Key: "(DEFAULT)"; Value: "{77857D02-7A25-4B67-9266-3E122A8F39E4}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachineFallback"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update CredentialDialog"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update CredentialDialog"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE\CLSID"; Key: "(DEFAULT)"; Value: "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CredentialDialogMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update CredentialDialog"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CredentialDialogMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CredentialDialogMachine"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\psmachine_64.dll"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\psmachine_64.dll"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DA6570DE-122B-4A09-B42B-37603CABA4FC}\INPROCHANDLER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\psmachine_64.dll"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DA6570DE-122B-4A09-B42B-37603CABA4FC}\INPROCHANDLER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{59A5853A-2739-421B-999B-91F186558B08}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.275.13\psmachine_64.dll"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{59A5853A-2739-421B-999B-91F186558B08}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{59A5853A-2739-421B-999B-91F186558B08}"; Key: "(DEFAULT)"; Value: "PSFactoryBuffer"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}"; Key: "(DEFAULT)"; Value: "IPolicyStatus5"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003700000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}"; Key: "(DEFAULT)"; Value: "IAppSideBySide"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}"; Key: "(DEFAULT)"; Value: "IPackage"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}"; Key: "(DEFAULT)"; Value: "IPolicyStatus3"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}"; Key: "(DEFAULT)"; Value: "IPolicyStatusValue"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003200000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}"; Key: "(DEFAULT)"; Value: "IPolicyStatus6"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003800000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}"; Key: "(DEFAULT)"; Value: "IApp2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003300000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}"; Key: "(DEFAULT)"; Value: "IProcessLauncher"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3600000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}"; Key: "(DEFAULT)"; Value: "IAppCommand2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003200000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}"; Key: "(DEFAULT)"; Value: "IPolicyStatus7"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003900000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}"; Key: "(DEFAULT)"; Value: "IAppVersion"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}"; Key: "(DEFAULT)"; Value: "IBrowserHttpRequest2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}"; Key: "(DEFAULT)"; Value: "IGoogleUpdateCore"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}"; Key: "(DEFAULT)"; Value: "ICoCreateAsyncStatus"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}"; Key: "(DEFAULT)"; Value: "IAppBundle"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003100000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}"; Key: "(DEFAULT)"; Value: "IAppWeb"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003700000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}"; Key: "(DEFAULT)"; Value: "IJobObserver2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}"; Key: "(DEFAULT)"; Value: "ICurrentState"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}"; Key: "(DEFAULT)"; Value: "ICredentialDialog"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}"; Key: "(DEFAULT)"; Value: "IPolicyStatus4"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003600000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}"; Key: "(DEFAULT)"; Value: "IPolicyStatus"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003600000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}"; Key: "(DEFAULT)"; Value: "IJobObserver"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003300000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}"; Key: "(DEFAULT)"; Value: "IApp"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003100000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}"; Key: "(DEFAULT)"; Value: "ICoCreateAsync"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}"; Key: "(DEFAULT)"; Value: "IAppCommand"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003100000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}"; Key: "(DEFAULT)"; Value: "IRegistrationUpdateHook"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3800000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}"; Key: "(DEFAULT)"; Value: "IAppCommandWeb"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003100000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}"; Key: "(DEFAULT)"; Value: "IAppBundleWeb"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}"; Key: "(DEFAULT)"; Value: "IAppUnified"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3WebSecurity"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}"; Key: "(DEFAULT)"; Value: "IProgressWndEvents"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3900000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}"; Key: "(DEFAULT)"; Value: "IPolicyStatus2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003300000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3Web"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3800000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}"; Key: "(DEFAULT)"; Value: "IProcessLauncher2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3700000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59A5853A-2739-421B-999B-91F186558B08}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}"; Key: "(DEFAULT)"; Value: "IAppVersionWeb"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000")67:T4a4,Dropped file: "BouncyCastle.Cryptography.dll" - Location: [%LOCALAPPDATA%\Programs\Jutsu\BouncyCastle.Cryptography.dll]- [targetUID: 00000000-00006316] Dropped file: "Microsoft.Web.WebView2.Core.dll" - Location: [%LOCALAPPDATA%\Programs\Jutsu\Microsoft.Web.WebView2.Core.dll]- [targetUID: 00000000-00006316] Dropped file: "Jutsu.exe" - Location: [%LOCALAPPDATA%\Programs\Jutsu\Jutsu.exe]- [targetUID: 00000000-00006316] Dropped file: "WebView2Loader.dll" - Location: [%LOCALAPPDATA%\Programs\Jutsu\runtimes\win-x64\native\WebView2Loader.dll]- [targetUID: 00000000-00006316] Dropped file: "WebView2Loader.dll" - Location: [%LOCALAPPDATA%\Programs\Jutsu\runtimes\win-arm64\native\WebView2Loader.dll]- [targetUID: 00000000-00006316] Dropped file: "WebView2Loader.dll" - Location: [%LOCALAPPDATA%\Programs\Jutsu\runtimes\win-x86\native\WebView2Loader.dll]- [targetUID: 00000000-00006316] Dropped file: "Microsoft.Web.WebView2.WinForms.dll" - Location: [%LOCALAPPDATA%\Programs\Jutsu\Microsoft.Web.WebView2.WinForms.dll]- [targetUID: 00000000-00006316] Dropped file: "Jutsu.exe.config" - Location: [%LOCALAPPDATA%\Programs\Jutsu\Jutsu.exe.config]- [targetUID: 00000000-00006316]68:T97d,Found string "SetDefaultDllDirectories" (Source: Jutsu-Setup.exe, API is part of module: KERNELBASE.DLL) Found string "GetDiskFreeSpaceExW" (Source: Jutsu-Setup.exe, API is part of module: KERNELBASE.DLL) Found string "GetUserDefaultUILanguage" (Source: Jutsu-Setup.exe, API is part of module: KERNELBASE.DLL) Found string "RegDeleteKeyExW" (Source: Jutsu-Setup.exe, API is part of module: ADVAPI32.DLL) Found string "InitiateShutdownW" (Source: Jutsu-Setup.exe, API is part of module: ADVAPI32.DLL) Found string "SHGetKnownFolderPath" (Source: Jutsu-Setup.exe, API is part of module: WINDOWS.STORAGE.DLL) Found string "SHAutoComplete" (Source: Jutsu-Setup.exe, API is part of module: SHLWAPI.DLL) Found string "SHGetFolderPathW" (Source: Jutsu-Setup.exe, API is part of module: SHFOLDER.DLL) Found string "GetFileVersionInfoSizeW" (Source: Jutsu-Setup.exe, API is part of module: VERSION.DLL) Found string "GetFileVersionInfoW" (Source: Jutsu-Setup.exe, API is part of module: VERSION.DLL) Found string "VerQueryValueW" (Source: Jutsu-Setup.exe, API is part of module: VERSION.DLL) Found string "AdjustTokenPrivileges" (Source: Jutsu-Setup.exe, API is part of module: ADVAPI32.DLL) Found string "LookupPrivilegeValueW" (Source: Jutsu-Setup.exe, API is part of module: ADVAPI32.DLL) Found string "OpenProcessToken" (Source: Jutsu-Setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegCloseKey" (Source: Jutsu-Setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegCreateKeyExW" (Source: Jutsu-Setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegDeleteKeyW" (Source: Jutsu-Setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegDeleteValueW" (Source: Jutsu-Setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegEnumKeyW" (Source: Jutsu-Setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegEnumValueW" (Source: Jutsu-Setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegOpenKeyExW" (Source: Jutsu-Setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegQueryValueExW" (Source: Jutsu-Setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegSetValueExW" (Source: Jutsu-Setup.exe, API is part of module: ADVAPI32.DLL) Found string "InitCommonControls" (Source: Jutsu-Setup.exe, API is part of module: COMCTL32.DLL) Found string "CreateBrushIndirect" (Source: Jutsu-Setup.exe, API is part of module: GDI32FULL.DLL)69:T410,"Jutsu-Setup.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "Jutsu-Setup.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "Jutsu-Setup.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "Jutsu-Setup.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "Jutsu-Setup.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "Jutsu-Setup.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "Jutsu-Setup.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "MicrosoftEdgeUpdate.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "MicrosoftEdgeUpdate.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "MicrosoftEdgeUpdate.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "MicrosoftEdgeUpdate.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "MicrosoftEdgeUpdate.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "MicrosoftEdgeUpdate.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "MicrosoftEdgeUpdate.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini"6a:T606c,"BouncyCastle.Cryptography.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\BouncyCastle.Cryptography.dll]- [targetUID: 00000000-00006316] "msedgeupdate.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdate.dll]- [targetUID: 00000000-00002712] "MicrosoftEdgeWebview2Setup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%TEMP%\nsl4021.tmp\MicrosoftEdgeWebview2Setup.exe]- [targetUID: 00000000-00005020] "Microsoft.Web.WebView2.Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\Microsoft.Web.WebView2.Core.dll]- [targetUID: 00000000-00006316] "psmachine_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psmachine_64.dll]- [targetUID: 00000000-00005020] "psuser_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psuser_64.dll]- [targetUID: 00000000-00005020] "psmachine_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psmachine_arm64.dll]- [targetUID: 00000000-00005020] "psuser_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psuser_arm64.dll]- [targetUID: 00000000-00005020] "psmachine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psmachine.dll]- [targetUID: 00000000-00002712] "psuser.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\psuser.dll]- [targetUID: 00000000-00005020] "MicrosoftEdgeUpdateCore.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateCore.exe]- [targetUID: 00000000-00005020] "Jutsu.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\Jutsu.exe]- [targetUID: 00000000-00006316] "MicrosoftEdgeUpdateComRegisterShell64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe]- [targetUID: 00000000-00002712] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00002712] "MicrosoftEdgeComRegisterShellARM64.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) ARM64 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeComRegisterShellARM64.exe]- [targetUID: 00000000-00005020] "WebView2Loader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\runtimes\win-x64\native\WebView2Loader.dll]- [targetUID: 00000000-00006316] "WebView2Loader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 7 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\runtimes\win-arm64\native\WebView2Loader.dll]- [targetUID: 00000000-00006316] "WebView2Loader.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\runtimes\win-x86\native\WebView2Loader.dll]- [targetUID: 00000000-00006316] "MicrosoftEdgeUpdateOnDemand.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateOnDemand.exe]- [targetUID: 00000000-00005020] "MicrosoftEdgeUpdateBroker.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateBroker.exe]- [targetUID: 00000000-00005020] "Microsoft.Web.WebView2.WinForms.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\Programs\Jutsu\Microsoft.Web.WebView2.WinForms.dll]- [targetUID: 00000000-00006316] "msedgeupdateres_el.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_el.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ml.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ml.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_de.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_de.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ca.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ca.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_it.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_it.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_pl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_pl.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_fr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fr.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_lb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_lb.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_nl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_nl.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ca-Es-VALENCIA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ca-Es-VALENCIA.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_gd.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_gd.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_fr-CA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fr-CA.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sl.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ro.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ro.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_kn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_kn.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_or.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_or.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_hu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_hu.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_fil.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fil.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_hr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_hr.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_af.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_af.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ka.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ka.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sr-Cyrl-BA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sr-Cyrl-BA.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_mk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_mk.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_az.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_az.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_es-419.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_es-419.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sr.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_bg.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bg.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_bn-IN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bn-IN.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_mt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_mt.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_bn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bn.dll]- [targetUID: 00000000-00005020] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%TEMP%\nsl4021.tmp\System.dll]- [targetUID: 00000000-00006316] "msedgeupdateres_ne.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ne.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_pt-BR.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_pt-BR.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_as.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_as.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_pt-PT.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_pt-PT.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sv.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sr-Cyrl-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sr-Cyrl-RS.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_lv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_lv.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_te.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_te.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_eu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_eu.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ta.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ta.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sr-Latn-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sr-Latn-RS.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_hi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_hi.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_bs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bs.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_gl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_gl.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ga.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ga.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ur.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ur.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_nn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_nn.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_da.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_da.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_es.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_es.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_uk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_uk.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_gu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_gu.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_pa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_pa.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_is.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_is.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_kok.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_kok.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_tr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_tr.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_lt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_lt.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_vi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_vi.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_nb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_nb.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_kk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_kk.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_cs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_cs.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_id.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_id.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_et.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_et.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sq.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sq.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_fi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fi.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_cy.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_cy.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_tt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_tt.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_quz.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_quz.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_sk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sk.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ms.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ms.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_mi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_mi.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_mr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_mr.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ru.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ru.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_fa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fa.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_th.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_th.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_km.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_km.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_en.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_en.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_en-GB.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_en-GB.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_lo.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_lo.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ug.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ug.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ar.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ar.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_iw.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_iw.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_am.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_am.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ja.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ja.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_ko.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ko.dll]- [targetUID: 00000000-00005020] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe]- [targetUID: 00000000-00005020] "msedgeupdateres_zh-TW.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_zh-TW.dll]- [targetUID: 00000000-00005020] "msedgeupdateres_zh-CN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_zh-CN.dll]- [targetUID: 00000000-00005020] "nsDialogs.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 8 sections"- Location: [%TEMP%\nsl4021.tmp\nsDialogs.dll]- [targetUID: 00000000-00006316] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 7 sections"- Location: [%TEMP%\nsl4021.tmp\nsExec.dll]- [targetUID: 00000000-00006316] "MicrosoftEdgeUpdateSetup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateSetup.exe]- [targetUID: 00000000-00005020] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00002712] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU77CF.tmp\CopilotUpdate.exe]- [targetUID: 00000000-00005020]6b:Tb812,"Jutsu-Setup.exe" wrote 14336 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsl4021.tmp\nsDialogs.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Jutsu-Setup.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsl4021.tmp\System.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Jutsu-Setup.exe" wrote 10752 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsl4021.tmp\nsExec.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Jutsu-Setup.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Jutsu\Jutsu.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Jutsu-Setup.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Jutsu\Microsoft.Web.WebView2.Core.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Jutsu-Setup.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Jutsu\Microsoft.Web.WebView2.WinForms.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Jutsu-Setup.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Jutsu\BouncyCastle.Cryptography.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Jutsu-Setup.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Jutsu\runtimes\win-x64\native\WebView2Loader.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0a00 ... "Jutsu-Setup.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Jutsu\runtimes\win-x86\native\WebView2Loader.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdate.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\CopilotUpdate.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdate.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateBroker.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateOnDemand.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeComRegisterShellARM64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\psmachine.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\psmachine_64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\psmachine_arm64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\psuser.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\psuser_64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\psuser_arm64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateCore.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_am.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ar.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bg.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bn.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ca.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_cs.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_da.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_de.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_el.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_en.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_en-GB.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_es.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_es-419.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_et.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fa.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fil.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_gu.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_hi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_hr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_hu.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_id.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_is.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_it.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_iw.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ja.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_kn.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ko.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_lt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_lv.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ml.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_mr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ms.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_nb.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_nl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_pl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_pt-BR.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_pt-PT.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ro.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ru.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sv.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ta.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_te.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_th.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_tr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_uk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ur.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_vi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_zh-CN.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_zh-TW.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_af.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_as.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_az.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bn-IN.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bs.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ca-Es-VALENCIA.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_cy.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_eu.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_fr-CA.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ga.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_gd.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_gl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ka.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_kk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_km.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_kok.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_lb.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_lo.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_mi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_mk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_mt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ne.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_nn.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_or.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_pa.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_quz.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sq.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sr-Cyrl-BA.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sr-Cyrl-RS.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_sr-Latn-RS.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_tt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ug.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeUpdate.exe" wrote 22872 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...6c:Tc2a,"Jutsu-Setup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsl3FD1.tmp" for deletion "Jutsu-Setup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsl4021.tmp" for deletion "MicrosoftEdgeWebview2Setup.exe" marked "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\CopilotUpdate.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\EdgeUpdate.dat" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeComRegisterShellARM64.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdate.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateBroker.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateComRegisterShell64.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateCore.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateOnDemand.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateSetup.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdate.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_af.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_am.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_ar.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_as.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_az.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_bg.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_bn-IN.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_bn.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_bs.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_ca-Es-VALENCIA.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_ca.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_cs.dll" for deletion6d:Tc30,"Jutsu-Setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsl3FD1.tmp" with delete access "Jutsu-Setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsl4021.tmp" with delete access "MicrosoftEdgeWebview2Setup.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdate.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\CopilotUpdate.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdate.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateCore.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeComRegisterShellARM64.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\NOTICE.TXT" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\EdgeUpdate.dat" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_af.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_am.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ar.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_as.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_az.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bg.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bn.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bn-IN.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_bs.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ca.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_ca-Es-VALENCIA.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_cs.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_cy.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\msedgeupdateres_da.dll" with delete access6e:Ta46,"MicrosoftEdgeWebview2Setup.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdate.exe" (Handle: 560) "MicrosoftEdgeWebview2Setup.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\Temp\EU77CF.tmp\MicrosoftEdgeUpdate.exe" (Handle: 560) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 856) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 856) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 864) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 864) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 764) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 764) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 1200) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 1200) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 748) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 748) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 672) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 672) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 784) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.275.13\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 784)6f:T1075,Spawned process "Jutsu-Setup.exe" (UID: 00000000-00006316) Spawned process "taskkill.exe" with commandline "taskkill /IM "Jutsu.exe" /F" (UID: 00000000-00005072) Spawned process "MicrosoftEdgeWebview2Setup.exe" with commandline "/silent /install" (UID: 00000000-00005020) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"" (UID: 00000000-00004016) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regsvc" (UID: 00000000-00007356) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regserver" (UID: 00000000-00002712) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00003524) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00005124) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00006228) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNzUuMTMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNzUuMTMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzJCMzU4NzItQUU4RC00MTIyLTlFNTQtNTkwQjcyQTFGMkZEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4RjU1MkM2My03RDEyLTQ3MTYtQjIzNS1BRjFCRTcxMDM1N0V9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE2Mjk5LjI0OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJYZzMxNnZDRCIgcHJvZHVjdF9uYW1lPSJWcWVJdzZsYmEiLz48ZXhwIGV0YWc9IiZxdW90OytaRkFqM1NPSUk1Qkp6b0d1ejhPcHIwaFo4SC9yRHpxYi9RVnIzUFloNEk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4yMjEuMyIgbmV4dHZlcnNpb249IjEuMy4yNzUuMTMiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzMTM0MTcwNTkzIiBpbnN0YWxsX3RpbWVfbXM9IjI0MTA5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg" (UID: 00000000-00005384) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{32B35872-AE8D-4122-9E54-590B72A1F2FD}" /silent" (UID: 00000000-00005076) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/svc" (UID: 00000000-00005624) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNzUuMTMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNzUuMTMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzJCMzU4NzItQUU4RC00MTIyLTlFNTQtNTkwQjcyQTFGMkZEfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NzJDRjU5MkQtREY1NS00QUEyLTgxQTYtOUUxMkEyRENFOTREfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNjI5OS4yNDgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iWGczMTZ2Q0QiIHByb2R1Y3RfbmFtZT0iVnFlSXc2bGJhIi8-PGV4cCBldGFnPSImcXVvdDtJMEVhaGI2dklQcGdHZ3NFbzUvejdDbUlsTzNxY0VWclJreTlvUDIrV09FPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxNDQuMC43NTU5LjEzMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJIS0ZMIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMjQ3IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Njk5NTM2MTMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzE2NDc0MDQ2NzQ0NzAwMDAiIGZpcnN0X2ZyZV9zZWVuX3RpbWU9IjEzMjk1NjQwODE2MjI5NjU0MCIgZmlyc3RfZnJlX3NlZW5fdmVyc2lvbj0iMTAwLjAuMTE4NS41MCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE1MTA3ODE2NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMxOTQxNzA1ODkiLz48L2FwcD48L3JlcXVlc3Q-" (UID: 00000000-00006296)70:Tf48,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAALPUlEQVR4Xr2XeVjVVRrHCYnt7hv3ApcrCFyRRRFlEZBVRJAriGIiZqSZYqmRpmaZuWGPM045aZbLqGka40gaogIKCLgiYmW5ZO4LiuSCS5nOZ869Zts0NTN/dJ7nPOd3nvv73fd7vu/7ft/32Nn9hyGTuWOdcrknv/ztDxkymRGVLEgA8PhjAchknkhkWpQSfzTOWTYWfvnOT4dc5oF1SgVTUvGt9Vn5/7JmNe4q02CSJOAtS0HnkIfSOQqZXIf1N+s7crEq5EZhxAuFMOYkdRfTA4XEDZWYLmJv76JFJv1t4L865IJ2iVxDgNNw9C6RJDrOx8M1WrhBL4wZxQk9hAE9Dq4a7JxlOEj0hKi9eEYioUgt4y9aOUU6JU8FZyBXeiOVGv43EFa6VXITji5eOEp0BDuMEafRYeciF3utoNcdL3UAMcZ4+nd4ghcyRlAWaORk9w58FeHHmR4BnOiq50zvfAaEi2+dZDamfmnn34bVsELqhVbqKwzp8ZQmEKG2MNIvm0nmkSztNpeK2BUcSN7ESUstVyyHuDOpmdWZg3hf4UCpvwervLSs9dHxgbuEzZGxzEidh52TQgAw/j4AqcyASmpG7RJBuKonUw1rKPJazQr/Uj6Lq+KB5SC3LI1cz2zkSvYBzqc3cHbGIaZEd2aEnT0j7dvxSnhHqyGK3BWU5qQyMXYkj4lYUP03AGxRbI1mqSe1wevY6tVKWedyFpg+4lTSNq6kVnMprZaLGbs4n7mHs/320Tz6C4qfm0yaMPqCj4aGeYU2ADXjBrI4zMjrfpno1YE4Oat+X0uskW2lPlh8sDN4E++7f87GwN3cSt3Ctd7VXOlTw+X0Opotu7mYuY9zA/ZzPusTjo6q462QbMoyp3Bs/lQuli7jVGUxq2e+zITUfDJ7jUSr90UqMYhM+g0QShHhj0lU9NcP4kpEBbPcyvjYr4FryVu5kLydC32qaUnfxWXLnocAshs4nXOA09mf0PrMOeom7aMw7yUyMoYRE5dNXMogwuPTyX/2VdIyRuLQTo5C8TAYpb+mKwrBgLNUTYHuDVZ4V5DjupZt5kbupFRwoGcZp3rV0NrXCmCvDcCF/g1cHfA5V0ccZ+mEZYRGptAjIpvATjG4qY1o1J74+oZhah+EwaMTEuHaR7qgkrW3pfQPxpUygUziQqrLPNa4XWeN7CRrVRcEA6c5nVTJ8sASWwxYGbhk2UVrv4OczWngw0EreXHkJDoGxdPRuwdB5gg0Gk80KlE/hJLKZDrkCh2WrOGkpI3B0VEtNMad9qpQAcDrR4VtJ5UySPMSKx3v8IX0JiyF1oFQbz7KqfQdLDfv41hiLS0ZtVzO2MvewVt5M+/PTMt8ldF9J+Dvn0xUhAWzORKlSi/+WC8MG3B10ZCQ3J+IqEQSUkfh1zERN2dfzPIeQurFO98rq51GEsAA+Rw2+xznm+Q2Hqx4wDe77lOSe4z6iGMs9LzCpi5NfG2p4Uy/vezJqeRE3zru556lfmEVgd3C6WjugU+HEFRCFeVykdIq4QZNe7Kyh4tTq/H1SWBSaDHTnNaRp5hpA/BI2u3cpKGESUazQF5Paxe4Gnmf00XnuLi+nm1pLTQmQkPMWS6LbLievp87Ivrbhh9h7/hdpPYpoEOHMDoFRuPm5if8LFyg80ahNGI0daJ32mCchYr6mRKIDZ7GUPu3CNNm2YD+UCscZTIhPgP5WH6Vb7V3uTv+PpdGXKNyWDG7h65ma9fvqAo9w6c5ZewvqGN1wUeMzX+F+PiXMXnFiRmCh4efOLUXGm1H9IYAEXQ6Ovh1IS7Bgr2dAz5BSczsVmvTCX9THHqVNTC/Z0GlFEH4uJLZlq20DoU9A1s5+sQ1zmRe4tArK6geXsmBSXcoHHWG8NA1hITlYzKlYlANR60ORilOqxDFyuDuh6dXmBA0NxEDHrZ9TGwaUqWM5IhJlEffJrpdIa6unj8vUlbkDvYqFhX+jWuHznF0/h5O5B/h1rSbfJm/k6NjP+DL4iaWvP0p/sZ30Oj7ijQLFb4OEcZFRIuGRa0xYfLuKoLQDYnQE4XSXZzQje7hCcQl9SM9cRFTgg+R7f0yj0uEJvy0QMlFakglvpQHrOFS0hb2Bi5jZ9JWzkee5FiXBi5PP8jR1BP8Y/BB5po301e6QKTSKIzKLLTyeNTKQBvt1s7J1VUUH5VBMGAFohZADPiaYkmSzmRR6hFqxh8X77cX4Aw/ZoGLQGqSB7LBp5bK4CYq/Jso8ThOXVg5Df2bOB8umIiCryfD/lhYaKimt2YgOrXIf/90OnfuSQffEHQ6o5BbN9p7d8bTaLalolrri4ujlHYyFQsLhIrOhie6j6edvQ6l4nsxshd1Pk7Tja+Ct/CuZy0rjXXsNDfRWHicZQNuUNfjPAdzz7B7xk2GdFtGZ30iLwQ9y/MpE8geMIx+mcPon5FPUnI2kT1SCO2agMHTjy6dBwnBsQaaBkepnNEZa1kfcom3fA+glon6YGt6rSwInw1xt0BUOW09SoQLylkavJqCp4rITZ3Opsi1nMwpZ9arC1B6efCUTy4787ZSOGIuf8p7l9eGzCO31xjS0oaQmp5Lz7h0unRPZFrfpQS074pc7UZHQwwTu1ex0nycTybeo3doHvaOcsGCNRaE397s8Bz/jKrkelQJRJezOn0uq9Lf4GRKCW1x1ZwZupOCyaLYmPtwO+swS55fwogJL/JxyTY+232MOTMXk255ktS0XAYOG8+iWRWsydqAp0l01Vod4dqBrAw7T9WzF2h6+R7v5FTj6Got01Y3CAY2ml8XDFRwM2ojt2LK+NTyIbfjt3MzuZqvE6pEVlRROHEqe+M3cCGvgaI3/srhz4/S1naTml2NFG/YwYKF63j6mSkML5jGe4t2YQkfio9fV7TuRmK0+RRnXmTfSy3U9G2l8cV7xHTKop3omOysfd7h4MUCQJkNQFtMKW2xog9I2EZLcgVtCTtpyi+jfMx67vZqYve4crbvruf2zTaamy9z/Pgp3l22ianT32P6rOVMnLKAV2evIq7XYAI7x+CtiWCsqoTi0HNUZjZT81QLR+ZC0YD1wg1S7AKVQVwPW8d3EZu4HSWmYOBG3EMA15J3cD2phi8HV3BiUBU3ejdQNV3Qfv40394TinmxmSNHT1BX38TsuSsYM26uYGq+APE2g4dOxss9gBDlIPLkf2dV8GnqC1rYPaWVz15/wJLhtTg4CwZStfEQ9hHfRmy0AbgVs5m2ntu4kVAhAGznakoVLX120mLtB3rXU764hsriD6jb8BGXv75OY+NhVr6/kbnzlvP8C0U8WzCd58bNISe3UHTXroT75VOaeJUjL4lq+9o9vpgGXwkGcqLG2bpmuwnGIRC+mdvhJdyNEvQLADd6bhG+38bVpHKu9NpBs+gHmgWIU/33UPH2WspE/7BA6PrS6TM4dvKSTeOnvLKAqa8t4rnxsxkzdiZPj56OSdtFdM772T/mAttGfc76pxtYNLiUnPCxOIlybesV8wzp0L3cxsCdqI+5E7OFu3EVfJtUzXe9d3E/bT/fZRzkQZ9DXBt7gto+6TQKg9sdnRn6uJPN+LgX54gMGEKf9KFEx/YjKLgnfuYo3DWBBJlixBqASmHCVdycrKe2d5L/2Ki6Cllc4TsJIsu4G1nKjehSmqM3cjjyQ3ZEvEdx9/ks7jqTWYGTye/yJFFKPV3FzchfFB2N9SrmrBUSrMdZrE6OGpycNLZnF2edMKgXbtDYVqn0ofBY68DPaoFEZqtMtplqiCdMqKKf0HeN/OHtyM5VabsZ2bkIfwnxcBD3wMcFeifrJVas1pM8mgohr9b5aG81aHu2XVp/vSv+F0UC76tomvp0AAAAAElFTkSuQmCC71:T4e8,/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNzUuMTMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNzUuMTMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzJCMzU4NzItQUU4RC00MTIyLTlFNTQtNTkwQjcyQTFGMkZEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4RjU1MkM2My03RDEyLTQ3MTYtQjIzNS1BRjFCRTcxMDM1N0V9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE2Mjk5LjI0OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJYZzMxNnZDRCIgcHJvZHVjdF9uYW1lPSJWcWVJdzZsYmEiLz48ZXhwIGV0YWc9IiZxdW90OytaRkFqM1NPSUk1Qkp6b0d1ejhPcHIwaFo4SC9yRHpxYi9RVnIzUFloNEk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4yMjEuMyIgbmV4dHZlcnNpb249IjEuMy4yNzUuMTMiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzMTM0MTcwNTkzIiBpbnN0YWxsX3RpbWVfbXM9IjI0MTA5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg72:Tf48,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAALPUlEQVR4Xr2XeVjVVRrHCYnt7hv3ApcrCFyRRRFlEZBVRJAriGIiZqSZYqmRpmaZuWGPM045aZbLqGka40gaogIKCLgiYmW5ZO4LiuSCS5nOZ869Zts0NTN/dJ7nPOd3nvv73fd7vu/7ft/32Nn9hyGTuWOdcrknv/ztDxkymRGVLEgA8PhjAchknkhkWpQSfzTOWTYWfvnOT4dc5oF1SgVTUvGt9Vn5/7JmNe4q02CSJOAtS0HnkIfSOQqZXIf1N+s7crEq5EZhxAuFMOYkdRfTA4XEDZWYLmJv76JFJv1t4L865IJ2iVxDgNNw9C6RJDrOx8M1WrhBL4wZxQk9hAE9Dq4a7JxlOEj0hKi9eEYioUgt4y9aOUU6JU8FZyBXeiOVGv43EFa6VXITji5eOEp0BDuMEafRYeciF3utoNcdL3UAMcZ4+nd4ghcyRlAWaORk9w58FeHHmR4BnOiq50zvfAaEi2+dZDamfmnn34bVsELqhVbqKwzp8ZQmEKG2MNIvm0nmkSztNpeK2BUcSN7ESUstVyyHuDOpmdWZg3hf4UCpvwervLSs9dHxgbuEzZGxzEidh52TQgAw/j4AqcyASmpG7RJBuKonUw1rKPJazQr/Uj6Lq+KB5SC3LI1cz2zkSvYBzqc3cHbGIaZEd2aEnT0j7dvxSnhHqyGK3BWU5qQyMXYkj4lYUP03AGxRbI1mqSe1wevY6tVKWedyFpg+4lTSNq6kVnMprZaLGbs4n7mHs/320Tz6C4qfm0yaMPqCj4aGeYU2ADXjBrI4zMjrfpno1YE4Oat+X0uskW2lPlh8sDN4E++7f87GwN3cSt3Ctd7VXOlTw+X0Opotu7mYuY9zA/ZzPusTjo6q462QbMoyp3Bs/lQuli7jVGUxq2e+zITUfDJ7jUSr90UqMYhM+g0QShHhj0lU9NcP4kpEBbPcyvjYr4FryVu5kLydC32qaUnfxWXLnocAshs4nXOA09mf0PrMOeom7aMw7yUyMoYRE5dNXMogwuPTyX/2VdIyRuLQTo5C8TAYpb+mKwrBgLNUTYHuDVZ4V5DjupZt5kbupFRwoGcZp3rV0NrXCmCvDcCF/g1cHfA5V0ccZ+mEZYRGptAjIpvATjG4qY1o1J74+oZhah+EwaMTEuHaR7qgkrW3pfQPxpUygUziQqrLPNa4XWeN7CRrVRcEA6c5nVTJ8sASWwxYGbhk2UVrv4OczWngw0EreXHkJDoGxdPRuwdB5gg0Gk80KlE/hJLKZDrkCh2WrOGkpI3B0VEtNMad9qpQAcDrR4VtJ5UySPMSKx3v8IX0JiyF1oFQbz7KqfQdLDfv41hiLS0ZtVzO2MvewVt5M+/PTMt8ldF9J+Dvn0xUhAWzORKlSi/+WC8MG3B10ZCQ3J+IqEQSUkfh1zERN2dfzPIeQurFO98rq51GEsAA+Rw2+xznm+Q2Hqx4wDe77lOSe4z6iGMs9LzCpi5NfG2p4Uy/vezJqeRE3zru556lfmEVgd3C6WjugU+HEFRCFeVykdIq4QZNe7Kyh4tTq/H1SWBSaDHTnNaRp5hpA/BI2u3cpKGESUazQF5Paxe4Gnmf00XnuLi+nm1pLTQmQkPMWS6LbLievp87Ivrbhh9h7/hdpPYpoEOHMDoFRuPm5if8LFyg80ahNGI0daJ32mCchYr6mRKIDZ7GUPu3CNNm2YD+UCscZTIhPgP5WH6Vb7V3uTv+PpdGXKNyWDG7h65ma9fvqAo9w6c5ZewvqGN1wUeMzX+F+PiXMXnFiRmCh4efOLUXGm1H9IYAEXQ6Ovh1IS7Bgr2dAz5BSczsVmvTCX9THHqVNTC/Z0GlFEH4uJLZlq20DoU9A1s5+sQ1zmRe4tArK6geXsmBSXcoHHWG8NA1hITlYzKlYlANR60ORilOqxDFyuDuh6dXmBA0NxEDHrZ9TGwaUqWM5IhJlEffJrpdIa6unj8vUlbkDvYqFhX+jWuHznF0/h5O5B/h1rSbfJm/k6NjP+DL4iaWvP0p/sZ30Oj7ijQLFb4OEcZFRIuGRa0xYfLuKoLQDYnQE4XSXZzQje7hCcQl9SM9cRFTgg+R7f0yj0uEJvy0QMlFakglvpQHrOFS0hb2Bi5jZ9JWzkee5FiXBi5PP8jR1BP8Y/BB5po301e6QKTSKIzKLLTyeNTKQBvt1s7J1VUUH5VBMGAFohZADPiaYkmSzmRR6hFqxh8X77cX4Aw/ZoGLQGqSB7LBp5bK4CYq/Jso8ThOXVg5Df2bOB8umIiCryfD/lhYaKimt2YgOrXIf/90OnfuSQffEHQ6o5BbN9p7d8bTaLalolrri4ujlHYyFQsLhIrOhie6j6edvQ6l4nsxshd1Pk7Tja+Ct/CuZy0rjXXsNDfRWHicZQNuUNfjPAdzz7B7xk2GdFtGZ30iLwQ9y/MpE8geMIx+mcPon5FPUnI2kT1SCO2agMHTjy6dBwnBsQaaBkepnNEZa1kfcom3fA+glon6YGt6rSwInw1xt0BUOW09SoQLylkavJqCp4rITZ3Opsi1nMwpZ9arC1B6efCUTy4787ZSOGIuf8p7l9eGzCO31xjS0oaQmp5Lz7h0unRPZFrfpQS074pc7UZHQwwTu1ex0nycTybeo3doHvaOcsGCNRaE397s8Bz/jKrkelQJRJezOn0uq9Lf4GRKCW1x1ZwZupOCyaLYmPtwO+swS55fwogJL/JxyTY+232MOTMXk255ktS0XAYOG8+iWRWsydqAp0l01Vod4dqBrAw7T9WzF2h6+R7v5FTj6Got01Y3CAY2ml8XDFRwM2ojt2LK+NTyIbfjt3MzuZqvE6pEVlRROHEqe+M3cCGvgaI3/srhz4/S1naTml2NFG/YwYKF63j6mSkML5jGe4t2YQkfio9fV7TuRmK0+RRnXmTfSy3U9G2l8cV7xHTKop3omOysfd7h4MUCQJkNQFtMKW2xog9I2EZLcgVtCTtpyi+jfMx67vZqYve4crbvruf2zTaamy9z/Pgp3l22ianT32P6rOVMnLKAV2evIq7XYAI7x+CtiWCsqoTi0HNUZjZT81QLR+ZC0YD1wg1S7AKVQVwPW8d3EZu4HSWmYOBG3EMA15J3cD2phi8HV3BiUBU3ejdQNV3Qfv40394TinmxmSNHT1BX38TsuSsYM26uYGq+APE2g4dOxss9gBDlIPLkf2dV8GnqC1rYPaWVz15/wJLhtTg4CwZStfEQ9hHfRmy0AbgVs5m2ntu4kVAhAGznakoVLX120mLtB3rXU764hsriD6jb8BGXv75OY+NhVr6/kbnzlvP8C0U8WzCd58bNISe3UHTXroT75VOaeJUjL4lq+9o9vpgGXwkGcqLG2bpmuwnGIRC+mdvhJdyNEvQLADd6bhG+38bVpHKu9NpBs+gHmgWIU/33UPH2WspE/7BA6PrS6TM4dvKSTeOnvLKAqa8t4rnxsxkzdiZPj56OSdtFdM772T/mAttGfc76pxtYNLiUnPCxOIlybesV8wzp0L3cxsCdqI+5E7OFu3EVfJtUzXe9d3E/bT/fZRzkQZ9DXBt7gto+6TQKg9sdnRn6uJPN+LgX54gMGEKf9KFEx/YjKLgnfuYo3DWBBJlixBqASmHCVdycrKe2d5L/2Ki6Cllc4TsJIsu4G1nKjehSmqM3cjjyQ3ZEvEdx9/ks7jqTWYGTye/yJFFKPV3FzchfFB2N9SrmrBUSrMdZrE6OGpycNLZnF2edMKgXbtDYVqn0ofBY68DPaoFEZqtMtplqiCdMqKKf0HeN/OHtyM5VabsZ2bkIfwnxcBD3wMcFeifrJVas1pM8mgohr9b5aG81aHu2XVp/vSv+F0UC76tomvp0AAAAAElFTkSuQmCC73:T5a6,/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNzUuMTMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNzUuMTMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzJCMzU4NzItQUU4RC00MTIyLTlFNTQtNTkwQjcyQTFGMkZEfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NzJDRjU5MkQtREY1NS00QUEyLTgxQTYtOUUxMkEyRENFOTREfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNjI5OS4yNDgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iWGczMTZ2Q0QiIHByb2R1Y3RfbmFtZT0iVnFlSXc2bGJhIi8-PGV4cCBldGFnPSImcXVvdDtJMEVhaGI2dklQcGdHZ3NFbzUvejdDbUlsTzNxY0VWclJreTlvUDIrV09FPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxNDQuMC43NTU5LjEzMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJIS0ZMIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMjQ3IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Njk5NTM2MTMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzE2NDc0MDQ2NzQ0NzAwMDAiIGZpcnN0X2ZyZV9zZWVuX3RpbWU9IjEzMjk1NjQwODE2MjI5NjU0MCIgZmlyc3RfZnJlX3NlZW5fdmVyc2lvbj0iMTAwLjAuMTE4NS41MCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE1MTA3ODE2NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMxOTQxNzA1ODkiLz48L2FwcD48L3JlcXVlc3Q-1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1791312689478,"unified_at":"2026-10-06T18:51:29.478Z","metadata":{"hashes":{"sha256":"18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","sha1":"21d052105c9042d2224aeb1d2b799bf1cee5b3fa","md5":"2ec1ac0fd2dda77760b91cb5875da970","sha512":"acc0fa0cac30a6051f36255bdc6e1d234583999d44f5ac6759c9420cce73580f50e492d4481c7e36611da5a5ba087f0a270bf7bbe17f123305c13be393746597","ssdeep":"98304:oELWXBhRUlGdqHsVf7bUkF8RxoMH2R770ORs4kOvkGAbBKcUrHwXDgcFzSo:osWxvdysVf85a71UOcGIBrQwTThSo","ssdeep_chunks":["98304:oELWXBh","98304:ELWXBhR","98304:LWXBhRU","98304:WXBhRUl","98304:XBhRUlG","98304:BhRUlGd","98304:hRUlGdq","98304:RUlGdqH","98304:UlGdqHs","98304:lGdqHsV","98304:GdqHsVf","98304:dqHsVf7","98304:qHsVf7b","98304:HsVf7bU","98304:sVf7bUk","98304:Vf7bUkF","98304:f7bUkF8","98304:7bUkF8R","98304:bUkF8Rx","98304:UkF8Rxo","98304:kF8RxoM","98304:F8RxoMH","98304:8RxoMH2","98304:RxoMH2R","98304:xoMH2R7","98304:oMH2R77","98304:MH2R770","98304:H2R770O","98304:2R770OR","98304:R770ORs","98304:770ORs4","98304:70ORs4k","98304:0ORs4kO","98304:ORs4kOv","98304:Rs4kOvk","98304:s4kOvkG","98304:4kOvkGA","98304:kOvkGAb","98304:OvkGAbB","98304:vkGAbBK","98304:kGAbBKc","98304:GAbBKcU","98304:AbBKcUr","98304:bBKcUrH","98304:BKcUrHw","98304:KcUrHwX","98304:cUrHwXD","98304:UrHwXDg","98304:rHwXDgc","98304:HwXDgcF","98304:wXDgcFz","98304:XDgcFzS","98304:DgcFzSo","196608:oELWXBh","196608:ELWXBhR","196608:LWXBhRU","196608:WXBhRUl","196608:XBhRUlG","196608:BhRUlGd","196608:hRUlGdq","196608:RUlGdqH","196608:UlGdqHs","196608:lGdqHsV","196608:GdqHsVf","196608:dqHsVf7","196608:qHsVf7b","196608:HsVf7bU","196608:sVf7bUk","196608:Vf7bUkF","196608:f7bUkF8","196608:7bUkF8R","196608:bUkF8Rx","196608:UkF8Rxo","196608:kF8RxoM","196608:F8RxoMH","196608:8RxoMH2","196608:RxoMH2R","196608:xoMH2R7","196608:oMH2R77","196608:MH2R770","196608:H2R770O","196608:2R770OR","196608:R770ORs","196608:770ORs4","196608:70ORs4k","196608:0ORs4kO","196608:ORs4kOv","196608:Rs4kOvk","196608:s4kOvkG","196608:4kOvkGA","196608:kOvkGAb","196608:OvkGAbB","196608:vkGAbBK","196608:kGAbBKc","196608:GAbBKcU","196608:AbBKcUr","196608:bBKcUrH","196608:BKcUrHw","196608:KcUrHwX","196608:cUrHwXD","196608:UrHwXDg","196608:rHwXDgc","196608:HwXDgcF","196608:wXDgcFz","196608:XDgcFzS","196608:DgcFzSo","98304:osWxvdy","98304:sWxvdys","98304:WxvdysV","98304:xvdysVf","98304:vdysVf8","98304:dysVf85","98304:ysVf85a","98304:sVf85a7","98304:Vf85a71","98304:f85a71U","98304:85a71UO","98304:5a71UOc","98304:a71UOcG","98304:71UOcGI","98304:1UOcGIB","98304:UOcGIBr","98304:OcGIBrQ","98304:cGIBrQw","98304:GIBrQwT","98304:IBrQwTT","98304:BrQwTTh","98304:rQwTThS","98304:QwTThSo"],"imphash":"6f9fd465750a0db68adce98869da7d3c","pehash":"725d742c86a806797e04388e3ad273c2fb013f87"},"file_info":{"file_name":"Jutsu-Setup.exe","file_type":["compressed","7zip"],"file_type_id":"7zip nsis","file_size":6625885,"entropy":8,"compile_timestamp":"2024-02-05T10:18:05","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791312360000,"last_seen":1791312360000,"last_multi_scan":1791312360000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":7,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":43516,"raw_size":43520},{"name":".data","virtual_address":"0xc000","virtual_size":224,"raw_size":512},{"name":".rdata","virtual_address":"0xd000","virtual_size":42932,"raw_size":43008},{"name":".bss","virtual_address":"0x18000","virtual_size":128544},{"name":".idata","virtual_address":"0x38000","virtual_size":5084,"raw_size":5120},{"name":".ndata","virtual_address":"0x3a000","virtual_size":143360,"raw_size":512},{"name":".rsrc","virtual_address":"0x5d000","virtual_size":151472,"raw_size":151552}],"section_names":[".text",".data",".rdata",".bss",".idata",".ndata",".rsrc"],"imported_dlls":null,"imported_functions":null},"additional_metadata":[{"name":"package_manager","type":"str","values":["nsis"]}]},"detections":{"summary":{"verdict":"malicious","score":85,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":84},"sandbox_signatures":{"informative_count":236,"suspicious_count":20,"malicious_count":4,"total":260},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"suspicious","value":"Drops a file with double extension"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Contains ability to to enumerates the credentials (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"suspicious","value":"Attempts to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Identified known pipe name"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Copy files into temp folder"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Able to download remote files using web shell script"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"suspicious","value":"Spawned process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"suspicious","value":"Command line contains long Base64-encoded string"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Terminates other processes using tskill/taskkill"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Writes multiple files with double extensions (often indicator of ransomware infection)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"MicrosoftEdgeWebview2Setup.exe\" called \"FindResourceW\" with parameter \"102\" - (UID: 00000000-00005020)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"188\" - (UID: 00000000-00004016)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"190\" - (UID: 00000000-00004016)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"189\" - (UID: 00000000-00004016)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"188\" - (UID: 00000000-00007356)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"189\" - (UID: 00000000-00007356)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"2009\" - (UID: 00000000-00007356)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"2008\" - (UID: 00000000-00007356)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"MicrosoftEdgeWebview2Setup.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '20944096'}\" (UID: 00000000-00005020)\n \"MicrosoftEdgeUpdate.exe\" called \"LoadResource with parameter {'hModule': '78249985', 'hResInfo': '78253720'}\" (UID: 00000000-00004016)\n \"MicrosoftEdgeUpdate.exe\" called \"LoadResource with parameter {'hModule': '78249985', 'hResInfo': '78253752'}\" (UID: 00000000-00004016)\n \"MicrosoftEdgeUpdate.exe\" called \"LoadResource with parameter {'hModule': '78249985', 'hResInfo': '78253784'}\" (UID: 00000000-00004016)\n \"MicrosoftEdgeUpdate.exe\" called \"LoadResource with parameter {'hModule': '78249985', 'hResInfo': '78253736'}\" (UID: 00000000-00004016)\n \"MicrosoftEdgeUpdate.exe\" called \"LoadResource with parameter {'hModule': '83558401', 'hResInfo': '83562136'}\" (UID: 00000000-00007356)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"MicrosoftEdgeUpdate.exe\" called \"RemoveDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.221.3 (UID: 00000000-00004016)\n \"MicrosoftEdgeUpdate.exe\" called \"RemoveDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\Offline (UID: 00000000-00004016)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"RegSetKeySecurity\" (Indicator: \"RegSetKeySecurity\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"RegOverridePredefKey\" (Indicator: \"RegOverridePredefKey\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"Jutsu-Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"ertificateUtil::FindAllCertificatesByOidValue: 0 total certificate(s) found.\" (Indicator: \"Oid\"; Source: \"00000000-00002712.00000000.141210.03430000.00000004.mdmp, 00000000-00002712.00000001.142047.03430000.00000004.mdmp\")\n Found reference to \"ertificateUtil::FindAllCertificatesByOidValue: Will try to find the OID: '1.2.840.113556.1.5.284.7'\" (Indicator: \"Oid\"; Source: \"00000000-00002712.00000000.141210.03430000.00000004.mdmp, 00000000-00002712.00000001.142047.03430000.00000004.mdmp\")\n Found reference to \"ertificateUtil::FindAllCertificatesByOidValue: Will try to find the OID: '1.2.840.113556.1.5.284.7'\" (Indicator: \"Oid\"; Source: \"00000000-00004016.00000000.140745.00D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004016.00000000.140745.04AA0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006316.00000002.135158.00418000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - ^\\d+\\.\\d+$; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 72A20000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"Jutsu-Setup.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Jutsu-Setup.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"taskkill.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"MicrosoftEdgeWebview2Setup.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"MicrosoftEdgeWebview2Setup.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"MicrosoftEdgeUpdate.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"MicrosoftEdgeUpdate.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2a","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"MicrosoftEdgeWebview2Setup.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Jutsu-Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005020-42227-41-013DEA7A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005020-42227-43-013D8C13\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005020-42227-50-013D877F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005020-42227-241-013D8912\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004016-43721-67-0134DD28\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004016-43721-69-0134B466\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004016-43721-202-0134BF68\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004016-43721-208-0134BDD5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"Jutsu.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002712.00000000.141210.03430000.00000004.mdmp, 00000000-00002712.00000001.142047.03430000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003524.00000000.141300.10B80000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004016.00000000.140745.00D60000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005020.00000000.140656.00DB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99873","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Command line contains long Base64-encoded string\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"KLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Microsoft Edge Update\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found string \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found string \"KCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Microsoft Edge\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Jutsu-Setup.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006316)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Jutsu-Setup.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00006316)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Jutsu-Setup.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006316)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"MicrosoftEdgeUpdate.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004016)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$33","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Jutsu-Setup.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006316)\n \"MicrosoftEdgeWebview2Setup.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005020)\n \"MicrosoftEdgeUpdate.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004016)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"Jutsu-Setup.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000300a1803ba76b73870f10301591607770100000008000000010000000000210300000000100000000000000000000000020000000200000000002103010000000800000006ec7c7390f10301ee13077701000000ee1307770800000000000000080000005e14344ac8f30301ad9c1473000021030800000001000000 (UID: 00000000-00006316)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.DLL at 00000000-00005020-42227-515-013D2329\n FindFirstFileW@KERNEL32.DLL at 00000000-00005020-42227-516-013D2088\n FindFirstFileExW@KERNEL32.DLL at 00000000-00005020-42227-635-013DF1E6\n FindFirstFileExW@KERNEL32.DLL at 00000000-00004016-43721-229-013503D4\n FindNextFileW@KERNEL32.DLL at 00000000-00004016-43721-442-0134C75C\n FindFirstFileExW@KERNEL32.DLL at 00000000-00004016-43721-444-0134C79D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005020-42227-515-013D2329\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005020-42227-516-013D2088\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005020-42227-583-013D865B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004016-43721-530-0134BCB3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005020-42227-515-013D2329\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005020-42227-516-013D2088\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005020-42227-583-013D865B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004016-43721-530-0134BCB3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00005020-42227-525-013D1F61","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Jutsu-Setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Jutsu-Setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"MicrosoftEdgeWebview2Setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"MicrosoftEdgeWebview2Setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004016.00000000.140745.01359000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00005020-42227-741-013EB9B9\n GetSystemInfo@KERNEL32.DLL at 00000000-00004016-43721-499-0134B031","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver Windows 2000 Service Pack 4 eller nyere.\" (Indicator: \"ver \") in Source: 00000000-00005020.00000000.140656.013F8000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00005020-42227-306-013D132B\n GetProcessHeap@KERNEL32.DLL at 00000000-00004016-43721-55-013520B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %PROGRAMFILES%\\(X86)\\MICROSOFT\\EDGEUPDATE\\1.3.275.13\\MSEDGEUPDATE.DLL\n %TEMP%\\NSL4021.TMP\\NSDIALOGS.DLL\n %PROGRAMFILES%\\(X86)\\MICROSOFT\\TEMP\\EU77CF.TMP\\MSEDGEUPDATE.DLL\n %TEMP%\\NSL4021.TMP\\NSEXEC.DLL\n %TEMP%\\NSL4021.TMP\\SYSTEM.DLL\n %PROGRAMFILES%\\(X86)\\MICROSOFT\\EDGEUPDATE\\1.3.275.13\\PSMACHINE.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Jutsu-Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\MICROSOFT EDGE UPDATE\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MICROSOFTEDGEUPDATE.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"Jutsu-Setup.exe\"\n Found registry modification API: \"RegCreateKeyTransactedW\" in \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"file/memory contains long string(File: \"Jutsu.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"Jutsu-Setup.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"Jutsu-Setup.exe\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"psmachine_arm64.dll\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"psuser_arm64.dll\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"MicrosoftEdgeUpdateComRegisterShell64.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdate.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeComRegisterShellARM64.exe\")\n file/memory contains long string(File: \"WebView2Loader.dll\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdateOnDemand.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdateBroker.exe\")\n file/memory contains long string(File: \"CopilotUpdate.exe\")\n file/memory contains long string(File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004016.00000000.140745.01359000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"MicrosoftEdgeWebview2Setup.exe\" called \"CopyFileW\" to copy %TEMP%\\nsl4021.tmp\\MicrosoftEdgeWebview2Setup.exe to new location %PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\MicrosoftEdgeUpdateSetup.exe (UID: 00000000-00005020)\n \"MicrosoftEdgeUpdate.exe\" called \"CopyFileW\" to copy %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.275.13\\MicrosoftEdgeUpdate.exe to new location %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe (UID: 00000000-00004016)\n \"MicrosoftEdgeUpdate.exe\" called \"CopyFileW\" to copy %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.275.13\\CopilotUpdate.exe to new location %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\CopilotUpdate.exe (UID: 00000000-00004016)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$37","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Jutsu-Setup.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00006316)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"MicrosoftEdgeUpdate_unsigned.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004016.00000000.140745.01359000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"[File::OpenShareMode - CreateFile failed][%s][%d][%d][0x%x]\" (Indicator: \"CreateFile\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004016.00000000.140745.01359000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005020-42227-309-013E969E\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005020-42227-478-013D4873\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005020-42227-540-013D42F8\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005020-42227-561-013D4350","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004016.00000000.140745.01341000.00000020.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00005020-42227-513-013D26D3\n LoadLibraryExA@KERNEL32.DLL at 00000000-00005020-42227-751-013EBB73\n LoadLibraryExW@KERNEL32.DLL at 00000000-00004016-43721-482-013497EA\n LoadLibraryExA@KERNEL32.DLL at 00000000-00004016-43721-509-0134B1EB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"[Failed to ::ShellExecuteEx][%s][%s][0x%08x]\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004016.00000000.140745.01359000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004016.00000000.140745.01359000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"[StartService]\" (Indicator: \"StartService\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"Jutsu-Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Copy files into temp folder","description":"\"MicrosoftEdgeWebview2Setup.exe\" copies %TEMP%\\nsl4021.tmp\\MicrosoftEdgeWebview2Setup.exe to temp folder %PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\MicrosoftEdgeUpdateSetup.exe (UID: 00000000-00005020)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-268","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$40","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$41","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$42","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\MicrosoftCrashServices","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$44","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"Jutsu-Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 730E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Jutsu-Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75710000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75710000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72970000\n \"MicrosoftEdgeWebview2Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75710000\n \"MicrosoftEdgeUpdate.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75710000\n \"MicrosoftEdgeUpdate.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72960000\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 63190000\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 62220000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Jutsu-Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76630000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76630000\n \"MicrosoftEdgeWebview2Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76630000\n \"MicrosoftEdgeUpdate.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76630000\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 65290000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$45","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$46","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\taskkill.exe\" [Source: 00000000-00006316-00000BC0-1185253216]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"taskkill.exe\" (UID: 00000000-00005072) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"taskkill.exe\" (UID: 00000000-00005072) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$47","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Jutsu-Setup.exe\" searching for class \"#32770\"\n \"Jutsu-Setup.exe\" searching for class \"SysListView32\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$49","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$4a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Jutsu-Setup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"msedgeupdate.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MicrosoftEdgeWebview2Setup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"psmachine.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"psuser.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MicrosoftEdgeUpdateCore.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MicrosoftEdgeUpdate.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"WebView2Loader.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MicrosoftEdgeUpdateOnDemand.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MicrosoftEdgeUpdateBroker.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"msedgeupdateres_el.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Jutsu-Setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsv4010.tmp\"\n \"Jutsu-Setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl4021.tmp\\modern-wizard.bmp\"\n \"Jutsu-Setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl4021.tmp\\nsDialogs.dll\"\n \"Jutsu-Setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl4021.tmp\\System.dll\"\n \"Jutsu-Setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl4021.tmp\\nsExec.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"taskkill.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"MicrosoftEdgeWebview2Setup.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"MicrosoftEdgeUpdate.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4c","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"nsv4010.tmp\" has type \"Unknown\" - Location: [%TEMP%\\nsv4010.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$4e","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$4f","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$50","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Jutsu-Setup.exe\" reads file \"c:\\jutsu-setup.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to query volume size","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Jutsu-Setup.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"Jutsu-Setup.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"Jutsu-Setup.exe\" trying to touch file \"C:\\JUTSU-SETUP.EXE.LOCAL\"\n \"Jutsu-Setup.exe\" trying to touch file \"C:\\Jutsu-Setup.exe.Local\\\"\n \"Jutsu-Setup.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\\comctl32.dll\"\n \"Jutsu-Setup.exe\" trying to touch file \"C:\\WINDOWS\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\\COMCTL32.DLL\"\n \"Jutsu-Setup.exe\" trying to touch file \"\\Device\\CNG\"\n \"Jutsu-Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"Jutsu-Setup.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\IMM32.DLL\"\n \"Jutsu-Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"Jutsu-Setup.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\kernelbase.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Jutsu-Setup.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Jutsu-Setup.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"MicrosoftEdgeUpdate.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"MicrosoftEdgeUpdate.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"Jutsu-Setup.exe\" trying to access non-existent file \"C:\\JUTSU-SETUP.EXE.LOCAL\"\n \"Jutsu-Setup.exe\" trying to access non-existent file \"C:\\Jutsu-Setup.exe.Local\\\"\n \"Jutsu-Setup.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl4021.tmp\\MODERN-WIZARD.BMP\"\n \"Jutsu-Setup.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl4021.tmp\\modern-wizard.bmp\"\n \"Jutsu-Setup.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\Jutsu\\JUTSU.EXE.CONFIG\"\n \"Jutsu-Setup.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\UXTHEME.DLL.CONFIG\"\n \"MicrosoftEdgeUpdate.exe\" trying to access non-existent file \"C:\\MICROSOFTEDGEUPDATE.INI\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Jutsu-Setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsv4010.tmp\"\n \"Jutsu-Setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsl4021.tmp\\modern-wizard.bmp\"\n \"Jutsu-Setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsl4021.tmp\\nsdialogs.dll\"\n \"Jutsu-Setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsl4021.tmp\\system.dll\"\n \"Jutsu-Setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsl4021.tmp\\nsexec.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"MicrosoftEdgeWebview2Setup.exe\" writes a file \"C:\\Program Files (x86)\\Microsoft\\Temp\\EU77CF.tmp\\EdgeUpdate.dat\"\n \"MicrosoftEdgeWebview2Setup.exe\" writes a file \"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\EdgeUpdate.dat\"\n \"MicrosoftEdgeUpdate.exe\" writes a file \"C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files using web shell script","description":"file/memory contains long string with (Indicator: \"HttpWebRequest\"; File: \"Jutsu.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-798","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.3.99.0\"\n \"0.0.0.0\"\n Potential IP \"3.4.254.1\" found in string \"EVT-Windows-C++-No-3.4.254.1\"\n \"1.3.221.3\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$57","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$58","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00004016-00000CCE-1189579285\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":3,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"BouncyCastle.Cryptography.dll\"\n YARA signature for RSA public and private key matched on file \"Microsoft.Web.WebView2.WinForms.dll\"\n YARA signature for RSA public and private key matched on file \"Microsoft.Web.WebView2.Core.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopShortcut\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00005020-42227-486-013D28E4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"[GetLogonTime WTSQuerySessionInformation failed][0x%x]\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00003524.00000000.141300.10B80000.00000004.mdmp\")\n Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00004016.00000000.140745.00D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"682868,1048,3025,,RtlGetNtProductType,NTDLL.dll,\"00:36:59.390\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00002712.00000001.142047.03430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"MicrosoftEdgeUpdate.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 72940000\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 5C200000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$5b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Jutsu-Setup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"MicrosoftEdgeWebview2Setup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"MicrosoftEdgeUpdate.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate logical drives on the computer","description":"\"MicrosoftEdgeUpdate.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"260\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1680","relevance":6,"id":"api-326","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"MicrosoftEdgeUpdate.exe\" called \"GetComputerNameW\" (UID: 00000000-00004016)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base64\"; File: \"Jutsu.exe\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"Jutsu.exe\")\n Found string \"AEs?\" (Indicator: \"aes\"; Source: \"00000000-00005020.00000000.140656.013F8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004016.00000000.140745.01359000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004016.00000000.140745.01359000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"IsUserAnAdmin@SHELL32.DLL at 00000000-00005020-42227-522-013D25E3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to to enumerates the credentials (API string)","description":"Found reference to API \"CredEnumerateW\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-81","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"%1!s!, %2!s!2Enter username and password for proxy server %1!s!\" (Indicator: \"password\"; Source: \"00000000-00004016.00000000.140745.04AA0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"KLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Microsoft Edge Update\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\n \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\n \"KCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Microsoft Edge\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\n \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00002712.00000000.141210.72B4F000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"[F8]D\" (Indicator: \"[F8]\"; Source: \"00000000-00005020.00000000.140656.013F8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$60","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00007356-00000C2C-1192047143\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in file \"Jutsu-Setup.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"Jutsu-Setup.exe\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"Jutsu-Setup.exe\"\n Found registry deletion API: \"RegDeleteKeyTransactedW\" in \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueA\" in \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"MicrosoftEdgeUpdate.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004016)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$61","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"[File::OpenShareMode - SetFileAttributes failed][0x%x]\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00004016.00000000.140745.01341000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp, 00000000-00002712.00000001.142047.00999000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004016.00000000.140745.01359000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"MicrosoftEdgeUpdate.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\EDGEUPDATE\")\n \"MicrosoftEdgeUpdate.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\EDGEUPDATE\"; Key: \"EVENTMESSAGEFILE\"; Value: \"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.275.13\\msedgeupdate.dll\"), \"MicrosoftEdgeUpdate.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\EDGEUPDATEM\"), \"MicrosoftEdgeUpdate.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\EDGEUPDATEM\"; Key: \"EVENTMESSAGEFILE\"; Value: \"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.275.13\\msedgeupdate.dll\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"taskkill.exe\" opened \"\\Device\\KsecDD\"\n \"MicrosoftEdgeUpdate.exe\" opened \"\\Device\\KsecDD\"\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$65","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$66","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; File: \"Jutsu-Setup.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"Jutsu-Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"[CreateMutex failed][%s][0x%08x]\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002712.00000000.141210.72B4F000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005020.00000000.140656.013EC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"MicrosoftEdgeWebview2Setup.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections\"- Location: [%TEMP%\\nsl4021.tmp\\MicrosoftEdgeWebview2Setup.exe]- [targetUID: 00000000-00005020]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%TEMP%\\nsl4021.tmp\\System.dll]- [targetUID: 00000000-00006316]\n \"nsDialogs.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 8 sections\"- Location: [%TEMP%\\nsl4021.tmp\\nsDialogs.dll]- [targetUID: 00000000-00006316]\n \"nsExec.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 7 sections\"- Location: [%TEMP%\\nsl4021.tmp\\nsExec.dll]- [targetUID: 00000000-00006316]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$67","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"modern-wizard.bmp\" has type \"PC bitmap Windows 3.x format 164 x 314 x 4 image size 26376 resolution 2834 x 2834 px/m cbSize 26494 bits offset 118\" and extension \"bmp\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Jutsu-Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Jutsu-Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"MicrosoftEdgeWebview2Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"%WINDIR%\\SysWOW64\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00006316-00000BC0-1185253216\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\nsl4021.tmp\\MicrosoftEdgeWebview2Setup.exe\" has high entropy 7.94083\n Dropped file \"%LOCALAPPDATA%\\Programs\\Jutsu\\Jutsu.exe\" has high entropy 7.94384\n Dropped file \"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\MicrosoftEdgeUpdateSetup.exe\" has high entropy 7.94083","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"Jutsu-Setup.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}\n \"taskkill.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}\n \"MicrosoftEdgeWebview2Setup.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}\n \"MicrosoftEdgeUpdate.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00005020-42227-578-013D8A25\n cpuid at 00000000-00004016-43721-525-0134C0B3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00005020-42227-65-013E9527\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00005020-42227-134-013DBAC0\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005020-42227-145-013DBA7D\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005020-42227-536-013D3116\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005020-42227-748-013EB902\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005020-42227-860-013D88D0\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00004016-43721-101-0134ED57\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004016-43721-112-0134ED14\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004016-43721-497-0134ACE2\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004016-43721-506-0134AF7A\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004016-43721-712-0134BF26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00005020-42227-478-013D4873\n GetStartupInfoW@KERNEL32.DLL at 00000000-00005020-42227-584-013D889A\n GetStartupInfoW@KERNEL32.DLL at 00000000-00005020-42227-684-013E0558\n GetStartupInfoW@KERNEL32.DLL at 00000000-00004016-43721-531-0134BEF0\n GetStartupInfoW@KERNEL32.DLL at 00000000-00004016-43721-559-013512A8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Jutsu-Setup.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\SysWOW64\\taskkill.exe\" queried ProcessMitigationPolicy\n \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl4021.tmp\\MicrosoftEdgeWebview2Setup.exe\" queried ProcessMitigationPolicy\n \"C:\\Program Files (x86)\\Microsoft\\Temp\\EU77CF.tmp\\MicrosoftEdgeUpdate.exe\" queried ProcessMitigationPolicy\n \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.275.13\\MicrosoftEdgeUpdate.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"SizeofResource@KERNEL32.DLL at 00000000-00005020-42227-271-013D5220\n SizeofResource@KERNEL32.DLL at 00000000-00005020-42227-274-013D50C0\n SizeofResource@KERNEL32.DLL at 00000000-00005020-42227-276-013D5010\n SizeofResource@KERNEL32.DLL at 00000000-00005020-42227-278-013D4FA0\n FindResourceExW@KERNEL32.DLL at 00000000-00005020-42227-313-013D3484\n FindResourceW@KERNEL32.DLL at 00000000-00005020-42227-314-013D3794\n LoadResource@KERNEL32.DLL at 00000000-00005020-42227-317-013D1195\n FindResourceW@KERNEL32.DLL at 00000000-00005020-42227-475-013D1A73\n FindResourceW@KERNEL32.DLL at 00000000-00005020-42227-498-013D27AB\n LoadResource@KERNEL32.DLL at 00000000-00005020-42227-511-013D43D1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$69","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$6a","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"MicrosoftEdgeUpdate.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\MICROSOFTEDGEUPDATE.EXE\")\n \"MicrosoftEdgeUpdate.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\MICROSOFTEDGEUPDATE.EXE\"; Key: \"DISABLEEXCEPTIONCHAINVALIDATION\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$6b","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to retrieve NetBIOS or DNS name associated with the local computer","description":"\"MicrosoftEdgeUpdate.exe\" called \"GetComputerNameExW\" with parameters {\"NameType\": \"3\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-287","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" connects to 150.171.22.17 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" connects to 23.45.137.206 on port 80 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$6c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$6d","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Command line contains long Base64-encoded string","description":"Commandline contains long base64 encoded string \"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFo.......\" in [Source : MicrosoftEdgeUpdate.exe]\n Commandline contains long base64 encoded string \"PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEi.......\" in [Source : MicrosoftEdgeUpdate.exe]\n Commandline contains long base64 encoded string \"PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4yMjEuMyIgbmV4.......\" in [Source : MicrosoftEdgeUpdate.exe]\n Commandline contains long base64 encoded string \"PGV4cCBldGFnPSImcXVvdDtJMEVhaGI2dklQcGdHZ3NFbzUvejdDbUlsTzNxY0VWclJreTlvUDIrV09FPSZxdW90OyIvPjxhcHAg.......\" in [Source : MicrosoftEdgeUpdate.exe]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":5,"id":"string-509","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a file with double extension","description":"Dropped a double extension file \"Jutsu.exe.config\"","origin":"Binary File","mitre_attack_id":"T1036.007","relevance":5,"id":"binary-80","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.275.13\\MicrosoftEdgeUpdateComRegisterShell64.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Writes multiple files with double extensions (often indicator of ransomware infection)","description":"\"Jutsu-Setup.exe\" write more than 100 files with extension \".Cryptography.dll\"","origin":"API Call","mitre_attack_id":"T1486","relevance":5,"id":"api-201","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"MicrosoftEdgeUpdate.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /handoff \"appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&app\" - (UID: 00000000-00004016)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /IM \"Jutsu.exe\" /F\" (UID: 00000000-00005072)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$6e","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$6f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]}],"intel_graph":{"map":{"Domain:4feea217852bd82b4f1f5fcaa68b9b921ec8b41ce097186d00b094a5affeb0aa":{"type":"Domain","value":"jut-su.net","verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["reported malicious domain"]}},"File:0091730b7be0637aa21460a8c8f6b803aeaaa2957e8563e3b2d385aa86ef1b2b":{"type":"File","value":"0091730b7be0637aa21460a8c8f6b803aeaaa2957e8563e3b2d385aa86ef1b2b"},"File:00d135792459d1c58bf7419a437612f0342b3b12c9e7eb9f284f33c32cdd6da1":{"type":"File","value":"00d135792459d1c58bf7419a437612f0342b3b12c9e7eb9f284f33c32cdd6da1"},"File:051eb338beac88ce7fdff7eff8e09632f4efc52b7200c435220d59ece202aa12":{"type":"File","value":"051eb338beac88ce7fdff7eff8e09632f4efc52b7200c435220d59ece202aa12"},"File:07deeea3e62340fe2e2a18dda4f8153acafb4a6908f01192931b1afc0778ef24":{"type":"File","value":"07deeea3e62340fe2e2a18dda4f8153acafb4a6908f01192931b1afc0778ef24"},"File:099aeee0c71189460d97d78cb5ac83023be4d0416f2cc0f97e09ba02ff1dd8d1":{"type":"File","value":"099aeee0c71189460d97d78cb5ac83023be4d0416f2cc0f97e09ba02ff1dd8d1"},"File:0bf33a087007b36bb056087abc73e2ba1d7ff575e2f0497a344ee08eed312cfe":{"type":"File","value":"0bf33a087007b36bb056087abc73e2ba1d7ff575e2f0497a344ee08eed312cfe"},"File:0cedec5bc78ae86ed6b4823695d161be05d7ac156fee92d1a936118b99f426d9":{"type":"File","value":"0cedec5bc78ae86ed6b4823695d161be05d7ac156fee92d1a936118b99f426d9"},"File:0dafc0ad2b710868656e3dd2f958b26d5bb3bd18dbb4a6e7a302baecd369be9a":{"type":"File","value":"0dafc0ad2b710868656e3dd2f958b26d5bb3bd18dbb4a6e7a302baecd369be9a","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:112fee25ca4cab5227bed33f1a19d3e42125776d9d84e282684e0137e314c700":{"type":"File","value":"112fee25ca4cab5227bed33f1a19d3e42125776d9d84e282684e0137e314c700"},"File:12267a74033dffc7e4d21a6733f0f53ecba68e83f344fe650c73b023845cc06b":{"type":"File","value":"12267a74033dffc7e4d21a6733f0f53ecba68e83f344fe650c73b023845cc06b"},"File:15618c8acb1c3eeec08d7571a54be4550f3b4628b925a25a0227b28079952fac":{"type":"File","value":"15618c8acb1c3eeec08d7571a54be4550f3b4628b925a25a0227b28079952fac"},"File:178d2a3887104af9a1683f452e60b0eac539da7f8b53a851f0446b361467a145":{"type":"File","value":"178d2a3887104af9a1683f452e60b0eac539da7f8b53a851f0446b361467a145"},"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de":{"type":"File","value":"18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","filetype":"PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive, 7 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:1d715e9790e43acb426cc9a2779debb10003cf11740e014a8edf47afd46c420d":{"type":"File","value":"1d715e9790e43acb426cc9a2779debb10003cf11740e014a8edf47afd46c420d"},"File:1ff153da4c6c14d2780adc08589deda678178cd2b26975a4ac6f79f1ef50a743":{"type":"File","value":"1ff153da4c6c14d2780adc08589deda678178cd2b26975a4ac6f79f1ef50a743"},"File:20ddf1bf1821ce3061895016cdcf90de67eafc58a05d3dc1c4230948bf73720a":{"type":"File","value":"20ddf1bf1821ce3061895016cdcf90de67eafc58a05d3dc1c4230948bf73720a","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:217fc025775804fc674b52c95f0aebbc7bb6297684ad64ac2651a950ce1b1ad4":{"type":"File","value":"217fc025775804fc674b52c95f0aebbc7bb6297684ad64ac2651a950ce1b1ad4"},"File:25128b906bfc82e2613876eb1c0121b3b1493f482721317ba1e9f9b16a6d4e4b":{"type":"File","value":"25128b906bfc82e2613876eb1c0121b3b1493f482721317ba1e9f9b16a6d4e4b"},"File:271ae77a01c7c9df279efca6880419a9d2ba4637faed29198eda748bd34a24eb":{"type":"File","value":"271ae77a01c7c9df279efca6880419a9d2ba4637faed29198eda748bd34a24eb"},"File:2884d3427a20fb7e3b9edb2dd649110eeff5eacf15b32ec51a18306cee3b5cbe":{"type":"File","value":"2884d3427a20fb7e3b9edb2dd649110eeff5eacf15b32ec51a18306cee3b5cbe"},"File:29fc954c3fde1749817d158f3dd5ebe9efd3b3ce9708d86092fb1e9f023a1cb0":{"type":"File","value":"29fc954c3fde1749817d158f3dd5ebe9efd3b3ce9708d86092fb1e9f023a1cb0","filetype":"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:2ae9ecad851dfc736271cc8ddc192dd4db8caf36f8ad4dcea1f78a70f7c61432":{"type":"File","value":"2ae9ecad851dfc736271cc8ddc192dd4db8caf36f8ad4dcea1f78a70f7c61432"},"File:2b32395df2fea42a3a79db54b29f01d82db71bc090255201e03a6db872942ee8":{"type":"File","value":"2b32395df2fea42a3a79db54b29f01d82db71bc090255201e03a6db872942ee8","filetype":"PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 8 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:2d1f597505a2a5ecf43a652693ea2de066c69b0e6b214a188b0356c5295cf1db":{"type":"File","value":"2d1f597505a2a5ecf43a652693ea2de066c69b0e6b214a188b0356c5295cf1db"},"File:2dc2c7b3a84d361eeff609d0835433ba6a1f17e04d09d030c2a068740507e33b":{"type":"File","value":"2dc2c7b3a84d361eeff609d0835433ba6a1f17e04d09d030c2a068740507e33b"},"File:2fafcc2b8924650f9b14a743e6a93c257ae45428870fcb3082026f1f5ea0f604":{"type":"File","value":"2fafcc2b8924650f9b14a743e6a93c257ae45428870fcb3082026f1f5ea0f604"},"File:31eb9434cb8c9dff0e38bb604ee0af9502f143fe0d4708a8568cbf9e22f58492":{"type":"File","value":"31eb9434cb8c9dff0e38bb604ee0af9502f143fe0d4708a8568cbf9e22f58492"},"File:36b98af3e692d96186bf691c39983ebd9db6534771dc61f6e1a4829ce5ff6bd1":{"type":"File","value":"36b98af3e692d96186bf691c39983ebd9db6534771dc61f6e1a4829ce5ff6bd1"},"File:37dc1b8075e841bb28c8f9297c2bbf2a26f04346f00167a6d654b897f858ea5e":{"type":"File","value":"37dc1b8075e841bb28c8f9297c2bbf2a26f04346f00167a6d654b897f858ea5e"},"File:38b921a689333fd1e77d52ab1ae344c206dad2ac161028464ca8fb8376b2c228":{"type":"File","value":"38b921a689333fd1e77d52ab1ae344c206dad2ac161028464ca8fb8376b2c228"},"File:3964ef3beea4bd2e99277224c83e316137bc508bf6de8523cfa029a566eca895":{"type":"File","value":"3964ef3beea4bd2e99277224c83e316137bc508bf6de8523cfa029a566eca895"},"File:3a3c23b67f040e8cf1e524a226c62e27e6b040a80c5e12380dc3224765b49878":{"type":"File","value":"3a3c23b67f040e8cf1e524a226c62e27e6b040a80c5e12380dc3224765b49878"},"File:3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2":{"type":"File","value":"3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118","filetype_short":"BMP","mime_type":"image/bmp"},"File:3ae368f2b0df7918d9f7291c76241c74b9ec654a607527b931155bd2a57503d9":{"type":"File","value":"3ae368f2b0df7918d9f7291c76241c74b9ec654a607527b931155bd2a57503d9"},"File:3b7da30b8548a85cc9665ec2cad824ef45435230f6f3105c6a8b2e03dfcbbc13":{"type":"File","value":"3b7da30b8548a85cc9665ec2cad824ef45435230f6f3105c6a8b2e03dfcbbc13"},"File:3c410305b0b6516c248425b798eba0a8e7d523186fcf6d09b433ba89a473fc94":{"type":"File","value":"3c410305b0b6516c248425b798eba0a8e7d523186fcf6d09b433ba89a473fc94"},"File:3d3d8338c17615bc2e8ab8de6f4f445c694b2a0c1fe02524390c7c27c7055d26":{"type":"File","value":"3d3d8338c17615bc2e8ab8de6f4f445c694b2a0c1fe02524390c7c27c7055d26"},"File:44688840a2e5d59fedfbee12b894d5c8783ecb448e66c0aed4a2061bdfe2bd8b":{"type":"File","value":"44688840a2e5d59fedfbee12b894d5c8783ecb448e66c0aed4a2061bdfe2bd8b"},"File:462b36fd1be6ca9f7563466a89e57c41ef4a4def3e0a84fa885d203aea4a3aaf":{"type":"File","value":"462b36fd1be6ca9f7563466a89e57c41ef4a4def3e0a84fa885d203aea4a3aaf","filetype":"PE32+ executable (DLL) (console) x86-64, for MS Windows, 10 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:46a2df6bac42e52d796cb0837dae379a2048136a3f8a7b43db6e7f758da72a4f":{"type":"File","value":"46a2df6bac42e52d796cb0837dae379a2048136a3f8a7b43db6e7f758da72a4f"},"File:46b364f13d089636b60c33d3f6a4b1d2cd32e6af8d9bc29339af0b7dadd21703":{"type":"File","value":"46b364f13d089636b60c33d3f6a4b1d2cd32e6af8d9bc29339af0b7dadd21703","filetype":"PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 10 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:4b1be4dd130a19dc6fbb973ce604f8bac26f2c0c242054970a05553d4a320de8":{"type":"File","value":"4b1be4dd130a19dc6fbb973ce604f8bac26f2c0c242054970a05553d4a320de8"},"File:4cf00f17bd2f5408c719f0a69395f3f265f4faa5a812551537c7b93750f26c9d":{"type":"File","value":"4cf00f17bd2f5408c719f0a69395f3f265f4faa5a812551537c7b93750f26c9d","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:4e4d7825c0b343f4b488a0b65b22e98c702e70849be8108da64903c38b82231c":{"type":"File","value":"4e4d7825c0b343f4b488a0b65b22e98c702e70849be8108da64903c38b82231c"},"File:50155d7c937bb698c8c2511455c4672da8e3b73a77c6f53b2d71de1a81cb9c42":{"type":"File","value":"50155d7c937bb698c8c2511455c4672da8e3b73a77c6f53b2d71de1a81cb9c42"},"File:52f307ba32e9c95f0d07a83138b93032994780b29bc04546d6852c4112d50740":{"type":"File","value":"52f307ba32e9c95f0d07a83138b93032994780b29bc04546d6852c4112d50740"},"File:54df865ea5105d2b43092a284312279774e0b7b82d6625ea63089791e939b692":{"type":"File","value":"54df865ea5105d2b43092a284312279774e0b7b82d6625ea63089791e939b692","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:56a63a5e7db40cb1b27d34cf60811abfe676055bb4a84d0db6e42889dc162588":{"type":"File","value":"56a63a5e7db40cb1b27d34cf60811abfe676055bb4a84d0db6e42889dc162588"},"File:5e60d9f68ab20b26abc15a13386d56502e9a3b05d3f89da6cfb969d47e7505bc":{"type":"File","value":"5e60d9f68ab20b26abc15a13386d56502e9a3b05d3f89da6cfb969d47e7505bc"},"File:607b24ae6b2daf3ea882fd6354e84feb109f239f7eee509fec014c6478a678c5":{"type":"File","value":"607b24ae6b2daf3ea882fd6354e84feb109f239f7eee509fec014c6478a678c5","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]},"filetype":"PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 7 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:63f91bf316304b9ff6c77347d4ecb94942a1d33d1a5e69d4d8e0ba2a0b7f9b1b":{"type":"File","value":"63f91bf316304b9ff6c77347d4ecb94942a1d33d1a5e69d4d8e0ba2a0b7f9b1b"},"File:64cbc8db736e0c671d2fbf2faf8a82232a72440ce3b9b936e3f1212f1201dbbf":{"type":"File","value":"64cbc8db736e0c671d2fbf2faf8a82232a72440ce3b9b936e3f1212f1201dbbf"},"File:64e97301e6599756123884da4054a9b063ce9f2c257fac639681985b5af6b4ee":{"type":"File","value":"64e97301e6599756123884da4054a9b063ce9f2c257fac639681985b5af6b4ee"},"File:652d69605a4db36cc9ec2c8cf5043555c9309baac22052e5e63bbbf2fa98232f":{"type":"File","value":"652d69605a4db36cc9ec2c8cf5043555c9309baac22052e5e63bbbf2fa98232f"},"File:699de53c95291a6f177c9184c7a05e8de9579ef7a1d222899b4dc77ecbfebddd":{"type":"File","value":"699de53c95291a6f177c9184c7a05e8de9579ef7a1d222899b4dc77ecbfebddd"},"File:6d3cce01fb2ab1b77658ac1550c3c2664fc19955cac2e09086da28615910d646":{"type":"File","value":"6d3cce01fb2ab1b77658ac1550c3c2664fc19955cac2e09086da28615910d646","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:6f59ad578fde1f65c44b6935dab0901f014b5268e056b930fb34c0919f1bf4b9":{"type":"File","value":"6f59ad578fde1f65c44b6935dab0901f014b5268e056b930fb34c0919f1bf4b9","filetype":"PE32 executable (DLL) (console) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:70a87fd4f78f6f9563502275ce8f915bc5fa0f98032d51ef5414ce4991cdbac7":{"type":"File","value":"70a87fd4f78f6f9563502275ce8f915bc5fa0f98032d51ef5414ce4991cdbac7"},"File:757577e9ada7c2a0b1b14bd7bb8c12db7f35489357a0a908871bc5f788f40293":{"type":"File","value":"757577e9ada7c2a0b1b14bd7bb8c12db7f35489357a0a908871bc5f788f40293"},"File:764a0bfb80a9977a60aa168b2a984fbd72201e1215e7388d0aeaf4262d8ef5e1":{"type":"File","value":"764a0bfb80a9977a60aa168b2a984fbd72201e1215e7388d0aeaf4262d8ef5e1"},"File:765db9d434a44f86089bdd57ab7c1431de2419c5c9f23cec11929b3c9ebdf414":{"type":"File","value":"765db9d434a44f86089bdd57ab7c1431de2419c5c9f23cec11929b3c9ebdf414","filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:7893da95d5c57f68aa9b8b16d4a2329e4a655e0a98df014318883a99e3391e57":{"type":"File","value":"7893da95d5c57f68aa9b8b16d4a2329e4a655e0a98df014318883a99e3391e57"},"File:7f18308410a3e4d25b3baadd1108e8c5f8535c740d0cab7ba5ca1fa62eaba0e8":{"type":"File","value":"7f18308410a3e4d25b3baadd1108e8c5f8535c740d0cab7ba5ca1fa62eaba0e8"},"File:819fdea1f910b12ff08c55fa7b2271da9a37ba77485e63c321fadc2cf37db2c2":{"type":"File","value":"819fdea1f910b12ff08c55fa7b2271da9a37ba77485e63c321fadc2cf37db2c2"},"File:82e65d8f28fd3e5983e72f8bda602041784005c9a73ba413493eb2d621620248":{"type":"File","value":"82e65d8f28fd3e5983e72f8bda602041784005c9a73ba413493eb2d621620248"},"File:839e09b9949336983ee40794a10708faa57ba1e03636e61c35ebbde683b1df29":{"type":"File","value":"839e09b9949336983ee40794a10708faa57ba1e03636e61c35ebbde683b1df29"},"File:84ad6f6851fa0f2be94c3574ae62a28c153911e8d69a9b6b9d777150a1082b95":{"type":"File","value":"84ad6f6851fa0f2be94c3574ae62a28c153911e8d69a9b6b9d777150a1082b95"},"File:88a3b62f45225a811cdb85df6dfd95c2bff9a0e43e3b04f813b125eaca56cc9f":{"type":"File","value":"88a3b62f45225a811cdb85df6dfd95c2bff9a0e43e3b04f813b125eaca56cc9f","filetype":"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:907e98ddbc343268da2ae1b7156049fb7296df6f7aab250dd4a9dfd871f13a52":{"type":"File","value":"907e98ddbc343268da2ae1b7156049fb7296df6f7aab250dd4a9dfd871f13a52"},"File:9203978b6630dc6aa858457bf42775f73102e3db7e5ceba4ce19beef0ca455d8":{"type":"File","value":"9203978b6630dc6aa858457bf42775f73102e3db7e5ceba4ce19beef0ca455d8"},"File:9290a90705e0faaf0efcbd0fa835837b9c1b6a905bbb1d4f2ca16b4619b4618e":{"type":"File","value":"9290a90705e0faaf0efcbd0fa835837b9c1b6a905bbb1d4f2ca16b4619b4618e"},"File:9ab2d24c3d1f299d477d150961a07b3771bb4ce4c4061d8cc687bd3f24a4883f":{"type":"File","value":"9ab2d24c3d1f299d477d150961a07b3771bb4ce4c4061d8cc687bd3f24a4883f"},"File:9bf00bbae583c7b04d26791916df37ad23fc107c33e7ddb16278442da6ab5a17":{"type":"File","value":"9bf00bbae583c7b04d26791916df37ad23fc107c33e7ddb16278442da6ab5a17"},"File:9cc81afd38a73dc41dc3685d922cf5ab39e8c10766cc04620ca46ac8f9b4fd37":{"type":"File","value":"9cc81afd38a73dc41dc3685d922cf5ab39e8c10766cc04620ca46ac8f9b4fd37"},"File:9d10f861d07c8f7aa9da29e3d6e9b445eebbbb2313e10e3c69a1b4e78e50584d":{"type":"File","value":"9d10f861d07c8f7aa9da29e3d6e9b445eebbbb2313e10e3c69a1b4e78e50584d"},"File:9ebe1eac8ab243df6e7353644e9e934edfa80fdaee687c70c4013afa17f1b7c9":{"type":"File","value":"9ebe1eac8ab243df6e7353644e9e934edfa80fdaee687c70c4013afa17f1b7c9"},"File:a17e6d4a7f2f7ae852808f04912b7d32cfc085151fd6c4c1ea724ed796a71d46":{"type":"File","value":"a17e6d4a7f2f7ae852808f04912b7d32cfc085151fd6c4c1ea724ed796a71d46"},"File:a753f9150f7991fd538ef84b4a174c74e8fa1eef00039292a20a81406688dcfa":{"type":"File","value":"a753f9150f7991fd538ef84b4a174c74e8fa1eef00039292a20a81406688dcfa"},"File:a78a23a4415af13668f5ef6e9782b2d791b7e96fd1796a19c1b0933db6a58f3b":{"type":"File","value":"a78a23a4415af13668f5ef6e9782b2d791b7e96fd1796a19c1b0933db6a58f3b"},"File:a81c4d033ef47409155df6ae7c4fc32c24e7af4e8a1181e7fc953d07af8a9b39":{"type":"File","value":"a81c4d033ef47409155df6ae7c4fc32c24e7af4e8a1181e7fc953d07af8a9b39"},"File:aa38a8cfce6179b87181609b1c730a29eaf26138fc833af5759e67576770f3a3":{"type":"File","value":"aa38a8cfce6179b87181609b1c730a29eaf26138fc833af5759e67576770f3a3","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:aa75835f9b17779af422aeb470761c1863e821f432bc7b9597d9007ae5f379bc":{"type":"File","value":"aa75835f9b17779af422aeb470761c1863e821f432bc7b9597d9007ae5f379bc"},"File:acc2bb4558f5f14626162bb21e97691411abef29edc5f1d3a727f5ea7edcb083":{"type":"File","value":"acc2bb4558f5f14626162bb21e97691411abef29edc5f1d3a727f5ea7edcb083","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:ae489f74fc1aa02cdf18e3d17435fe927ee48befa37b17d8016d41bd04c8fe25":{"type":"File","value":"ae489f74fc1aa02cdf18e3d17435fe927ee48befa37b17d8016d41bd04c8fe25"},"File:ae4d6a990775fb52158a2fc8732799ef66d45fdbd125796f2ffa1e2a2fd771f0":{"type":"File","value":"ae4d6a990775fb52158a2fc8732799ef66d45fdbd125796f2ffa1e2a2fd771f0"},"File:aec227154fc549739ff5a07920723641f773ce65d05dca70b215183c93e9641d":{"type":"File","value":"aec227154fc549739ff5a07920723641f773ce65d05dca70b215183c93e9641d","filetype":"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:afe76402613f52863d1b7742b6bbdd2864a5d08293f9f249b74d43fe423628cc":{"type":"File","value":"afe76402613f52863d1b7742b6bbdd2864a5d08293f9f249b74d43fe423628cc"},"File:b0919f4e8a83cd038f5c70ba88ffad32222b820a65a28ccf184789c9299f3c35":{"type":"File","value":"b0919f4e8a83cd038f5c70ba88ffad32222b820a65a28ccf184789c9299f3c35"},"File:b3918135d3bd6df9cc4ccfd41c25853b79423f0aaa55c449c19115489ad25f1a":{"type":"File","value":"b3918135d3bd6df9cc4ccfd41c25853b79423f0aaa55c449c19115489ad25f1a"},"File:b3fcd4e8414037b778b88c469b290197efccb61584edab89bdcdbe40ef8dab2d":{"type":"File","value":"b3fcd4e8414037b778b88c469b290197efccb61584edab89bdcdbe40ef8dab2d"},"File:b560830b19d6316cd019665fd4fd9ab591ba12b0be8f2d2a6889e26ab6f0dfd7":{"type":"File","value":"b560830b19d6316cd019665fd4fd9ab591ba12b0be8f2d2a6889e26ab6f0dfd7"},"File:bb1f0ec8cd0b6e2337e3d7ac33772b379166e022bda368c6801afdd16299901f":{"type":"File","value":"bb1f0ec8cd0b6e2337e3d7ac33772b379166e022bda368c6801afdd16299901f"},"File:bb21682d9d93e6425b6971634477b111abc2e0490855229e00e675ee07dd30ad":{"type":"File","value":"bb21682d9d93e6425b6971634477b111abc2e0490855229e00e675ee07dd30ad"},"File:c38b22754642771a76b945d1369cda810ea47cbff481957ce89981087c78d79e":{"type":"File","value":"c38b22754642771a76b945d1369cda810ea47cbff481957ce89981087c78d79e"},"File:c44fcce508eb1b3c98f3c83a8b9847c7b8ffca29ced68e5785fbdbd67dbddf30":{"type":"File","value":"c44fcce508eb1b3c98f3c83a8b9847c7b8ffca29ced68e5785fbdbd67dbddf30","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:c549ef4c0f8c834d75306144dbbc246ddbe3b8e32e48415b77762c83459f42db":{"type":"File","value":"c549ef4c0f8c834d75306144dbbc246ddbe3b8e32e48415b77762c83459f42db"},"File:cb561ae4537e39bba5dd8af1f648f189d9562b1003fd110a9e889ace527fb4e8":{"type":"File","value":"cb561ae4537e39bba5dd8af1f648f189d9562b1003fd110a9e889ace527fb4e8","filetype":"PE32+ executable (DLL) (console) Aarch64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:cb7434f9788b541a70147737c07ddfa9c702af115bfebf0e1e12d4d4732ec47c":{"type":"File","value":"cb7434f9788b541a70147737c07ddfa9c702af115bfebf0e1e12d4d4732ec47c"},"File:cd4fe3b5de1a4ea022f4b3f3124b6873c536f787175be106fdaea2f4d5752b0a":{"type":"File","value":"cd4fe3b5de1a4ea022f4b3f3124b6873c536f787175be106fdaea2f4d5752b0a"},"File:ce3da5018b16798fab201824f2a0ce241bb340e61befe9c6cdbae4c26f0f9f38":{"type":"File","value":"ce3da5018b16798fab201824f2a0ce241bb340e61befe9c6cdbae4c26f0f9f38"},"File:cfeaa1d39f9713b3092c4bb7b84536d5cf0763c33e894866cd77e83109530d09":{"type":"File","value":"cfeaa1d39f9713b3092c4bb7b84536d5cf0763c33e894866cd77e83109530d09"},"File:d1197fe4b60161ab5d5aaa4feea5e85da33683b296e3a10c6605f09861b71195":{"type":"File","value":"d1197fe4b60161ab5d5aaa4feea5e85da33683b296e3a10c6605f09861b71195"},"File:d3ac458f80301bf7e6b9428a5a479317a613e0145a23d98315a3a3906ba9436a":{"type":"File","value":"d3ac458f80301bf7e6b9428a5a479317a613e0145a23d98315a3a3906ba9436a","filetype":"XML 1.0 document, ASCII text","filetype_short":"XML","mime_type":"text/xml"},"File:d6d92c0ce4b7e49ba89507bf48965cda6f1b9faea9dd30700b548977b823f813":{"type":"File","value":"d6d92c0ce4b7e49ba89507bf48965cda6f1b9faea9dd30700b548977b823f813"},"File:db69e927fcb6bc87393ec675cda593713a61b26640f034db78938cfefd825380":{"type":"File","value":"db69e927fcb6bc87393ec675cda593713a61b26640f034db78938cfefd825380"},"File:defc05db4ad96bfa3be0f4aa06c0a361adab12277986fb4a5b3b7818b4ab2197":{"type":"File","value":"defc05db4ad96bfa3be0f4aa06c0a361adab12277986fb4a5b3b7818b4ab2197"},"File:e26e31f94a6dfad56cbb69eea1944a8a9f5a42012774b2a3b7bf890c3c051a3c":{"type":"File","value":"e26e31f94a6dfad56cbb69eea1944a8a9f5a42012774b2a3b7bf890c3c051a3c"},"File:e3f5aa9a806e974e73d9cc0070a2010eec757f0eb20b68a10d3498ac527e7f4d":{"type":"File","value":"e3f5aa9a806e974e73d9cc0070a2010eec757f0eb20b68a10d3498ac527e7f4d"},"File:e52c104fb648f0b4556d368eb3980039f18621a7e3bcdc6900fec40ed0273ab8":{"type":"File","value":"e52c104fb648f0b4556d368eb3980039f18621a7e3bcdc6900fec40ed0273ab8"},"File:e7ec86a8124ee6bef57037fb09d77bbbfcd47261cf3dd0dd40ffdadf40e6f8df":{"type":"File","value":"e7ec86a8124ee6bef57037fb09d77bbbfcd47261cf3dd0dd40ffdadf40e6f8df"},"File:eeae2f47a68aafd1cf77ec40160daa9cb808b7caaa0805a9b5da4f26eead0fc3":{"type":"File","value":"eeae2f47a68aafd1cf77ec40160daa9cb808b7caaa0805a9b5da4f26eead0fc3"},"File:efbda61ea6a2eb859936cdf0c3f46c16ea387ac79ca619d9c589b6b716bced73":{"type":"File","value":"efbda61ea6a2eb859936cdf0c3f46c16ea387ac79ca619d9c589b6b716bced73"},"File:f025326e242ca605bb8eda5b81038b6fdbac038686f0009214806da61d73b64d":{"type":"File","value":"f025326e242ca605bb8eda5b81038b6fdbac038686f0009214806da61d73b64d"},"File:f052ce2982bc73e622ab4bea62b255aed8d9f41c614045f0712fa436dc3b8090":{"type":"File","value":"f052ce2982bc73e622ab4bea62b255aed8d9f41c614045f0712fa436dc3b8090"},"File:f0eb57ad7229e51c7f4cd76d530d330d9e1e35f2d30360c24e689bc433dd86ab":{"type":"File","value":"f0eb57ad7229e51c7f4cd76d530d330d9e1e35f2d30360c24e689bc433dd86ab"},"File:f1cf2ed30be294402d976c5d1074060abe76b43418f9cfe9468fdd7d4ca9d338":{"type":"File","value":"f1cf2ed30be294402d976c5d1074060abe76b43418f9cfe9468fdd7d4ca9d338"},"File:f443ffe34ec89766f003d4caafb4cd263afa26b55180aacac18a1eba45bf0b61":{"type":"File","value":"f443ffe34ec89766f003d4caafb4cd263afa26b55180aacac18a1eba45bf0b61"},"File:f463b4ab4a963fec35a882ce9078ac917b58d7e585b5a47e06d42c4a4653749c":{"type":"File","value":"f463b4ab4a963fec35a882ce9078ac917b58d7e585b5a47e06d42c4a4653749c","filetype":"PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive, 7 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f6aec00806d2c69137aabb583ed0eea29e485d27e3882f34d0e8f5ebab7f5dc5":{"type":"File","value":"f6aec00806d2c69137aabb583ed0eea29e485d27e3882f34d0e8f5ebab7f5dc5"},"File:f7d51e90f166c744957d8f384dacc6365885bec647b50f7c3cd095dfdbafd3a3":{"type":"File","value":"f7d51e90f166c744957d8f384dacc6365885bec647b50f7c3cd095dfdbafd3a3"},"File:fcc906ec270f2939a99090179175a85c4f3909730f14d87fac88fc90e44bb0b6":{"type":"File","value":"fcc906ec270f2939a99090179175a85c4f3909730f14d87fac88fc90e44bb0b6"},"File:fd039af53f4c0d605e49b4ef9f71e9ffad8efb7ad0a5bedf6a4c8aae20c985f9":{"type":"File","value":"fd039af53f4c0d605e49b4ef9f71e9ffad8efb7ad0a5bedf6a4c8aae20c985f9"},"File:fd5d92f8e281213b55a66587adf139d4e7c33e29d4e129a5be3a3f2565e6459a":{"type":"File","value":"fd5d92f8e281213b55a66587adf139d4e7c33e29d4e129a5be3a3f2565e6459a"}},"chains":[{"id":"1557101657101386125","root":"Domain:4feea217852bd82b4f1f5fcaa68b9b921ec8b41ce097186d00b094a5affeb0aa","edges":[],"verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["reported malicious domain"]}},{"id":"1557101655233624491","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:2b32395df2fea42a3a79db54b29f01d82db71bc090255201e03a6db872942ee8"}],"verdict":{"verdict":"unknown"}},{"id":"1557101655426562482","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1557101655233624490","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:46b364f13d089636b60c33d3f6a4b1d2cd32e6af8d9bc29339af0b7dadd21703"}],"verdict":{"verdict":"unknown"}},{"id":"1557101655229430180","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:765db9d434a44f86089bdd57ab7c1431de2419c5c9f23cec11929b3c9ebdf414"}],"verdict":{"verdict":"unknown"}},{"id":"1557101655229430183","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:d3ac458f80301bf7e6b9428a5a479317a613e0145a23d98315a3a3906ba9436a"}],"verdict":{"verdict":"unknown"}},{"id":"1557101655229430182","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:f463b4ab4a963fec35a882ce9078ac917b58d7e585b5a47e06d42c4a4653749c"}],"verdict":{"verdict":"unknown"}},{"id":"1557101655233624492","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:29fc954c3fde1749817d158f3dd5ebe9efd3b3ce9708d86092fb1e9f023a1cb0"},{"edge_kind":"extracted_from_archive","from_key":"File:29fc954c3fde1749817d158f3dd5ebe9efd3b3ce9708d86092fb1e9f023a1cb0","to_key":"File:acc2bb4558f5f14626162bb21e97691411abef29edc5f1d3a727f5ea7edcb083"}],"verdict":{"verdict":"unknown"}},{"id":"1557101655229430184","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:462b36fd1be6ca9f7563466a89e57c41ef4a4def3e0a84fa885d203aea4a3aaf"},{"edge_kind":"extracted_from_archive","from_key":"File:462b36fd1be6ca9f7563466a89e57c41ef4a4def3e0a84fa885d203aea4a3aaf","to_key":"File:4cf00f17bd2f5408c719f0a69395f3f265f4faa5a812551537c7b93750f26c9d"}],"verdict":{"verdict":"unknown"}},{"id":"1557101655233624493","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:6f59ad578fde1f65c44b6935dab0901f014b5268e056b930fb34c0919f1bf4b9"},{"edge_kind":"extracted_from_archive","from_key":"File:6f59ad578fde1f65c44b6935dab0901f014b5268e056b930fb34c0919f1bf4b9","to_key":"File:54df865ea5105d2b43092a284312279774e0b7b82d6625ea63089791e939b692"}],"verdict":{"verdict":"unknown"}},{"id":"1557101655229430178","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:88a3b62f45225a811cdb85df6dfd95c2bff9a0e43e3b04f813b125eaca56cc9f"},{"edge_kind":"extracted_from_archive","from_key":"File:88a3b62f45225a811cdb85df6dfd95c2bff9a0e43e3b04f813b125eaca56cc9f","to_key":"File:20ddf1bf1821ce3061895016cdcf90de67eafc58a05d3dc1c4230948bf73720a"}],"verdict":{"verdict":"unknown"}},{"id":"1557101655229430181","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:aa38a8cfce6179b87181609b1c730a29eaf26138fc833af5759e67576770f3a3"},{"edge_kind":"extracted_from_archive","from_key":"File:aa38a8cfce6179b87181609b1c730a29eaf26138fc833af5759e67576770f3a3","to_key":"File:c44fcce508eb1b3c98f3c83a8b9847c7b8ffca29ced68e5785fbdbd67dbddf30"}],"verdict":{"verdict":"unknown"}},{"id":"1557101655229430179","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:aec227154fc549739ff5a07920723641f773ce65d05dca70b215183c93e9641d"},{"edge_kind":"extracted_from_archive","from_key":"File:aec227154fc549739ff5a07920723641f773ce65d05dca70b215183c93e9641d","to_key":"File:0dafc0ad2b710868656e3dd2f958b26d5bb3bd18dbb4a6e7a302baecd369be9a"}],"verdict":{"verdict":"unknown"}},{"id":"1557101655229430185","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:cb561ae4537e39bba5dd8af1f648f189d9562b1003fd110a9e889ace527fb4e8"},{"edge_kind":"extracted_from_archive","from_key":"File:cb561ae4537e39bba5dd8af1f648f189d9562b1003fd110a9e889ace527fb4e8","to_key":"File:6d3cce01fb2ab1b77658ac1550c3c2664fc19955cac2e09086da28615910d646"}],"verdict":{"verdict":"unknown"}},{"id":"1557101667462106910","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:f463b4ab4a963fec35a882ce9078ac917b58d7e585b5a47e06d42c4a4653749c"},{"edge_kind":"extracted_from_archive","from_key":"File:f463b4ab4a963fec35a882ce9078ac917b58d7e585b5a47e06d42c4a4653749c","to_key":"File:607b24ae6b2daf3ea882fd6354e84feb109f239f7eee509fec014c6478a678c5"}],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"sandbox_files","root":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","edges":[{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:f463b4ab4a963fec35a882ce9078ac917b58d7e585b5a47e06d42c4a4653749c"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:88a3b62f45225a811cdb85df6dfd95c2bff9a0e43e3b04f813b125eaca56cc9f"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:6f59ad578fde1f65c44b6935dab0901f014b5268e056b930fb34c0919f1bf4b9"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:46b364f13d089636b60c33d3f6a4b1d2cd32e6af8d9bc29339af0b7dadd21703"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:20ddf1bf1821ce3061895016cdcf90de67eafc58a05d3dc1c4230948bf73720a"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:54df865ea5105d2b43092a284312279774e0b7b82d6625ea63089791e939b692"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:4cf00f17bd2f5408c719f0a69395f3f265f4faa5a812551537c7b93750f26c9d"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:6d3cce01fb2ab1b77658ac1550c3c2664fc19955cac2e09086da28615910d646"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:aa38a8cfce6179b87181609b1c730a29eaf26138fc833af5759e67576770f3a3"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:0dafc0ad2b710868656e3dd2f958b26d5bb3bd18dbb4a6e7a302baecd369be9a"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:462b36fd1be6ca9f7563466a89e57c41ef4a4def3e0a84fa885d203aea4a3aaf"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:aec227154fc549739ff5a07920723641f773ce65d05dca70b215183c93e9641d"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:607b24ae6b2daf3ea882fd6354e84feb109f239f7eee509fec014c6478a678c5"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:c44fcce508eb1b3c98f3c83a8b9847c7b8ffca29ced68e5785fbdbd67dbddf30"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:cb561ae4537e39bba5dd8af1f648f189d9562b1003fd110a9e889ace527fb4e8"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:d3ac458f80301bf7e6b9428a5a479317a613e0145a23d98315a3a3906ba9436a"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:acc2bb4558f5f14626162bb21e97691411abef29edc5f1d3a727f5ea7edcb083"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:765db9d434a44f86089bdd57ab7c1431de2419c5c9f23cec11929b3c9ebdf414"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:29fc954c3fde1749817d158f3dd5ebe9efd3b3ce9708d86092fb1e9f023a1cb0"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:2b32395df2fea42a3a79db54b29f01d82db71bc090255201e03a6db872942ee8"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:6f59ad578fde1f65c44b6935dab0901f014b5268e056b930fb34c0919f1bf4b9"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:1d715e9790e43acb426cc9a2779debb10003cf11740e014a8edf47afd46c420d"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:25128b906bfc82e2613876eb1c0121b3b1493f482721317ba1e9f9b16a6d4e4b"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:afe76402613f52863d1b7742b6bbdd2864a5d08293f9f249b74d43fe423628cc"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:fd5d92f8e281213b55a66587adf139d4e7c33e29d4e129a5be3a3f2565e6459a"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:099aeee0c71189460d97d78cb5ac83023be4d0416f2cc0f97e09ba02ff1dd8d1"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:fcc906ec270f2939a99090179175a85c4f3909730f14d87fac88fc90e44bb0b6"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:aa38a8cfce6179b87181609b1c730a29eaf26138fc833af5759e67576770f3a3"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:2fafcc2b8924650f9b14a743e6a93c257ae45428870fcb3082026f1f5ea0f604"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:f1cf2ed30be294402d976c5d1074060abe76b43418f9cfe9468fdd7d4ca9d338"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:d1197fe4b60161ab5d5aaa4feea5e85da33683b296e3a10c6605f09861b71195"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:31eb9434cb8c9dff0e38bb604ee0af9502f143fe0d4708a8568cbf9e22f58492"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:f6aec00806d2c69137aabb583ed0eea29e485d27e3882f34d0e8f5ebab7f5dc5"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:178d2a3887104af9a1683f452e60b0eac539da7f8b53a851f0446b361467a145"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:9ebe1eac8ab243df6e7353644e9e934edfa80fdaee687c70c4013afa17f1b7c9"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:aa38a8cfce6179b87181609b1c730a29eaf26138fc833af5759e67576770f3a3"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:46b364f13d089636b60c33d3f6a4b1d2cd32e6af8d9bc29339af0b7dadd21703"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:2b32395df2fea42a3a79db54b29f01d82db71bc090255201e03a6db872942ee8"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:607b24ae6b2daf3ea882fd6354e84feb109f239f7eee509fec014c6478a678c5"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:757577e9ada7c2a0b1b14bd7bb8c12db7f35489357a0a908871bc5f788f40293"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:764a0bfb80a9977a60aa168b2a984fbd72201e1215e7388d0aeaf4262d8ef5e1"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:0cedec5bc78ae86ed6b4823695d161be05d7ac156fee92d1a936118b99f426d9"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:44688840a2e5d59fedfbee12b894d5c8783ecb448e66c0aed4a2061bdfe2bd8b"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:db69e927fcb6bc87393ec675cda593713a61b26640f034db78938cfefd825380"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:defc05db4ad96bfa3be0f4aa06c0a361adab12277986fb4a5b3b7818b4ab2197"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:12267a74033dffc7e4d21a6733f0f53ecba68e83f344fe650c73b023845cc06b"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:b0919f4e8a83cd038f5c70ba88ffad32222b820a65a28ccf184789c9299f3c35"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:d6d92c0ce4b7e49ba89507bf48965cda6f1b9faea9dd30700b548977b823f813"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:819fdea1f910b12ff08c55fa7b2271da9a37ba77485e63c321fadc2cf37db2c2"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:bb21682d9d93e6425b6971634477b111abc2e0490855229e00e675ee07dd30ad"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:f0eb57ad7229e51c7f4cd76d530d330d9e1e35f2d30360c24e689bc433dd86ab"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:3b7da30b8548a85cc9665ec2cad824ef45435230f6f3105c6a8b2e03dfcbbc13"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:7893da95d5c57f68aa9b8b16d4a2329e4a655e0a98df014318883a99e3391e57"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:38b921a689333fd1e77d52ab1ae344c206dad2ac161028464ca8fb8376b2c228"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:cb7434f9788b541a70147737c07ddfa9c702af115bfebf0e1e12d4d4732ec47c"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:e26e31f94a6dfad56cbb69eea1944a8a9f5a42012774b2a3b7bf890c3c051a3c"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:82e65d8f28fd3e5983e72f8bda602041784005c9a73ba413493eb2d621620248"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:2dc2c7b3a84d361eeff609d0835433ba6a1f17e04d09d030c2a068740507e33b"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:9203978b6630dc6aa858457bf42775f73102e3db7e5ceba4ce19beef0ca455d8"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:50155d7c937bb698c8c2511455c4672da8e3b73a77c6f53b2d71de1a81cb9c42"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:9bf00bbae583c7b04d26791916df37ad23fc107c33e7ddb16278442da6ab5a17"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:00d135792459d1c58bf7419a437612f0342b3b12c9e7eb9f284f33c32cdd6da1"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:7f18308410a3e4d25b3baadd1108e8c5f8535c740d0cab7ba5ca1fa62eaba0e8"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:907e98ddbc343268da2ae1b7156049fb7296df6f7aab250dd4a9dfd871f13a52"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:efbda61ea6a2eb859936cdf0c3f46c16ea387ac79ca619d9c589b6b716bced73"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:839e09b9949336983ee40794a10708faa57ba1e03636e61c35ebbde683b1df29"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:b560830b19d6316cd019665fd4fd9ab591ba12b0be8f2d2a6889e26ab6f0dfd7"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:3c410305b0b6516c248425b798eba0a8e7d523186fcf6d09b433ba89a473fc94"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:e3f5aa9a806e974e73d9cc0070a2010eec757f0eb20b68a10d3498ac527e7f4d"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:f443ffe34ec89766f003d4caafb4cd263afa26b55180aacac18a1eba45bf0b61"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:0bf33a087007b36bb056087abc73e2ba1d7ff575e2f0497a344ee08eed312cfe"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:a17e6d4a7f2f7ae852808f04912b7d32cfc085151fd6c4c1ea724ed796a71d46"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:b3918135d3bd6df9cc4ccfd41c25853b79423f0aaa55c449c19115489ad25f1a"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:ae4d6a990775fb52158a2fc8732799ef66d45fdbd125796f2ffa1e2a2fd771f0"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:c38b22754642771a76b945d1369cda810ea47cbff481957ce89981087c78d79e"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:70a87fd4f78f6f9563502275ce8f915bc5fa0f98032d51ef5414ce4991cdbac7"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:84ad6f6851fa0f2be94c3574ae62a28c153911e8d69a9b6b9d777150a1082b95"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:aa75835f9b17779af422aeb470761c1863e821f432bc7b9597d9007ae5f379bc"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:3a3c23b67f040e8cf1e524a226c62e27e6b040a80c5e12380dc3224765b49878"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:36b98af3e692d96186bf691c39983ebd9db6534771dc61f6e1a4829ce5ff6bd1"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:bb1f0ec8cd0b6e2337e3d7ac33772b379166e022bda368c6801afdd16299901f"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:b3fcd4e8414037b778b88c469b290197efccb61584edab89bdcdbe40ef8dab2d"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:e7ec86a8124ee6bef57037fb09d77bbbfcd47261cf3dd0dd40ffdadf40e6f8df"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:652d69605a4db36cc9ec2c8cf5043555c9309baac22052e5e63bbbf2fa98232f"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:cd4fe3b5de1a4ea022f4b3f3124b6873c536f787175be106fdaea2f4d5752b0a"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:9290a90705e0faaf0efcbd0fa835837b9c1b6a905bbb1d4f2ca16b4619b4618e"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:ae489f74fc1aa02cdf18e3d17435fe927ee48befa37b17d8016d41bd04c8fe25"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:64e97301e6599756123884da4054a9b063ce9f2c257fac639681985b5af6b4ee"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:46a2df6bac42e52d796cb0837dae379a2048136a3f8a7b43db6e7f758da72a4f"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:3964ef3beea4bd2e99277224c83e316137bc508bf6de8523cfa029a566eca895"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:f7d51e90f166c744957d8f384dacc6365885bec647b50f7c3cd095dfdbafd3a3"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:15618c8acb1c3eeec08d7571a54be4550f3b4628b925a25a0227b28079952fac"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:e52c104fb648f0b4556d368eb3980039f18621a7e3bcdc6900fec40ed0273ab8"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:56a63a5e7db40cb1b27d34cf60811abfe676055bb4a84d0db6e42889dc162588"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:3d3d8338c17615bc2e8ab8de6f4f445c694b2a0c1fe02524390c7c27c7055d26"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:9d10f861d07c8f7aa9da29e3d6e9b445eebbbb2313e10e3c69a1b4e78e50584d"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:c549ef4c0f8c834d75306144dbbc246ddbe3b8e32e48415b77762c83459f42db"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:eeae2f47a68aafd1cf77ec40160daa9cb808b7caaa0805a9b5da4f26eead0fc3"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:4e4d7825c0b343f4b488a0b65b22e98c702e70849be8108da64903c38b82231c"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:07deeea3e62340fe2e2a18dda4f8153acafb4a6908f01192931b1afc0778ef24"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:a753f9150f7991fd538ef84b4a174c74e8fa1eef00039292a20a81406688dcfa"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:3ae368f2b0df7918d9f7291c76241c74b9ec654a607527b931155bd2a57503d9"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:217fc025775804fc674b52c95f0aebbc7bb6297684ad64ac2651a950ce1b1ad4"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:0091730b7be0637aa21460a8c8f6b803aeaaa2957e8563e3b2d385aa86ef1b2b"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:37dc1b8075e841bb28c8f9297c2bbf2a26f04346f00167a6d654b897f858ea5e"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:f025326e242ca605bb8eda5b81038b6fdbac038686f0009214806da61d73b64d"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:ce3da5018b16798fab201824f2a0ce241bb340e61befe9c6cdbae4c26f0f9f38"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:5e60d9f68ab20b26abc15a13386d56502e9a3b05d3f89da6cfb969d47e7505bc"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:2ae9ecad851dfc736271cc8ddc192dd4db8caf36f8ad4dcea1f78a70f7c61432"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:cfeaa1d39f9713b3092c4bb7b84536d5cf0763c33e894866cd77e83109530d09"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:1ff153da4c6c14d2780adc08589deda678178cd2b26975a4ac6f79f1ef50a743"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:9ab2d24c3d1f299d477d150961a07b3771bb4ce4c4061d8cc687bd3f24a4883f"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:271ae77a01c7c9df279efca6880419a9d2ba4637faed29198eda748bd34a24eb"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:52f307ba32e9c95f0d07a83138b93032994780b29bc04546d6852c4112d50740"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:f052ce2982bc73e622ab4bea62b255aed8d9f41c614045f0712fa436dc3b8090"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:fd039af53f4c0d605e49b4ef9f71e9ffad8efb7ad0a5bedf6a4c8aae20c985f9"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:699de53c95291a6f177c9184c7a05e8de9579ef7a1d222899b4dc77ecbfebddd"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:63f91bf316304b9ff6c77347d4ecb94942a1d33d1a5e69d4d8e0ba2a0b7f9b1b"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:9cc81afd38a73dc41dc3685d922cf5ab39e8c10766cc04620ca46ac8f9b4fd37"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:2d1f597505a2a5ecf43a652693ea2de066c69b0e6b214a188b0356c5295cf1db"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:112fee25ca4cab5227bed33f1a19d3e42125776d9d84e282684e0137e314c700"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:a81c4d033ef47409155df6ae7c4fc32c24e7af4e8a1181e7fc953d07af8a9b39"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:2884d3427a20fb7e3b9edb2dd649110eeff5eacf15b32ec51a18306cee3b5cbe"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:a78a23a4415af13668f5ef6e9782b2d791b7e96fd1796a19c1b0933db6a58f3b"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:4b1be4dd130a19dc6fbb973ce604f8bac26f2c0c242054970a05553d4a320de8"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:051eb338beac88ce7fdff7eff8e09632f4efc52b7200c435220d59ece202aa12"},{"edge_kind":"extracted","from_key":"File:18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","to_key":"File:64cbc8db736e0c671d2fbf2faf8a82232a72440ce3b9b936e3f1212f1201dbbf"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":13,"spawned_processes_count":13,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":53,"imported_dlls_count":103,"dropped_files_count":0,"extracted_files_count":128,"files_written_count":137,"files_deleted_count":0,"registry_keys_created_count":39,"registry_keys_modified_count":0,"registry_keys_deleted_count":6,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":45,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6ac541e795cb831e1f0da99b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"submit_name":"Jutsu-Setup.exe","analysis_start_time":"2026-10-06T18:46:01+00:00","indicators_count":{"informative":236,"suspicious":59,"malicious":6},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null,"embedded_domains":[{"value":"jut-su.net","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}],"processes":[{"pid":6316,"ppid":0,"name":"Jutsu-Setup.exe","command_line":"","sha256":"18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de","normalized_path":"C:\\Jutsu-Setup.exe","uid":"00000000-00006316","icon":"$70"},{"pid":5072,"ppid":6316,"name":"taskkill.exe","command_line":"taskkill /IM \"Jutsu.exe\" /F","sha256":"ea3a07c527f431d3c1ae733cf0f1a1c2e221079fdd36f1c56bf71e5eeb96ff1b","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00006316","uid":"00000000-00005072"},{"pid":5020,"ppid":6316,"name":"MicrosoftEdgeWebview2Setup.exe","command_line":"/silent /install","sha256":"aa38a8cfce6179b87181609b1c730a29eaf26138fc833af5759e67576770f3a3","normalized_path":"%TEMP%\\nsl4021.tmp\\MicrosoftEdgeWebview2Setup.exe","parent_uid":"00000000-00006316","uid":"00000000-00005020"},{"pid":4016,"ppid":5020,"name":"MicrosoftEdgeUpdate.exe","command_line":"/silent /install \"appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers\"","sha256":"1d715e9790e43acb426cc9a2779debb10003cf11740e014a8edf47afd46c420d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00005020","uid":"00000000-00004016"},{"pid":7356,"ppid":4016,"name":"MicrosoftEdgeUpdate.exe","command_line":"/regsvc","sha256":"1d715e9790e43acb426cc9a2779debb10003cf11740e014a8edf47afd46c420d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00004016","uid":"00000000-00007356"},{"pid":2712,"ppid":4016,"name":"MicrosoftEdgeUpdate.exe","command_line":"/regserver","sha256":"1d715e9790e43acb426cc9a2779debb10003cf11740e014a8edf47afd46c420d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00004016","uid":"00000000-00002712"},{"pid":3524,"ppid":2712,"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","command_line":"","sha256":"fd5d92f8e281213b55a66587adf139d4e7c33e29d4e129a5be3a3f2565e6459a","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.275.13\\MicrosoftEdgeUpdateComRegisterShell64.exe","parent_uid":"00000000-00002712","uid":"00000000-00003524"},{"pid":5124,"ppid":2712,"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","command_line":"","sha256":"fd5d92f8e281213b55a66587adf139d4e7c33e29d4e129a5be3a3f2565e6459a","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.275.13\\MicrosoftEdgeUpdateComRegisterShell64.exe","parent_uid":"00000000-00002712","uid":"00000000-00005124"},{"pid":6228,"ppid":2712,"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","command_line":"","sha256":"fd5d92f8e281213b55a66587adf139d4e7c33e29d4e129a5be3a3f2565e6459a","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.275.13\\MicrosoftEdgeUpdateComRegisterShell64.exe","parent_uid":"00000000-00002712","uid":"00000000-00006228"},{"pid":5384,"ppid":4016,"name":"MicrosoftEdgeUpdate.exe","command_line":"$71","sha256":"1d715e9790e43acb426cc9a2779debb10003cf11740e014a8edf47afd46c420d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00004016","uid":"00000000-00005384"},{"pid":5076,"ppid":4016,"name":"MicrosoftEdgeUpdate.exe","command_line":"/handoff \"appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers\" /installsource otherinstallcmd /sessionid \"{32B35872-AE8D-4122-9E54-590B72A1F2FD}\" /silent","sha256":"1d715e9790e43acb426cc9a2779debb10003cf11740e014a8edf47afd46c420d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00004016","uid":"00000000-00005076"},{"pid":5624,"ppid":0,"name":"MicrosoftEdgeUpdate.exe","command_line":"/svc","sha256":"1d715e9790e43acb426cc9a2779debb10003cf11740e014a8edf47afd46c420d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","uid":"00000000-00005624","icon":"$72"},{"pid":6296,"ppid":5624,"name":"MicrosoftEdgeUpdate.exe","command_line":"$73","sha256":"1d715e9790e43acb426cc9a2779debb10003cf11740e014a8edf47afd46c420d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00005624","uid":"00000000-00006296"}],"all_imported_dlls":["msls31.dll","ntasn1.dll","advapi32.dll","gdi32.dll","VxSSL32.dll","System.dll","mpr.dll","wbemprox.dll","propsys.dll","msctf.dll","nsDialogs.dll","SHCore.dll","windows.storage.dll","sspicli.dll","bcryptprimitives.dll","comctl32.dll","wow64cpu.dll","msvcrt.dll","msvcp_win.dll","profapi.dll","oleaut32.dll","uxtheme.dll","riched20.dll","ucrtbase.dll","gdi32full.dll","imm32.dll","WinTypes.dll","winsta.dll","fastprox.dll","dsreg.dll","psmachine_64.dll","ole32.dll","shell32.dll","fltLib.dll","comdlg32.dll","srvcli.dll","wbemcomn.dll","Windows.StateRepositoryPS.dll","kernel.appcore.dll","cfgmgr32.dll","cryptsp.dll","shfolder.dll","CoreUIComponents.dll","bcrypt.dll","msvcp110_win.dll","KernelBase.dll","ws2_32.dll","oleacc.dll","shlwapi.dll","version.dll","wtsapi32.dll","dmcmnutils.dll","msasn1.dll","msxml6.dll","imagehlp.dll","vcruntime140.dll","ntmarta.dll","dbghelp.dll","msedgeupdate.dll","winhttp.dll","IconCodecService.dll","usp10.dll","user32.dll","sechost.dll","framedynos.dll","devobj.dll","edputil.dll","VxSSL64.dll","win32u.dll","vcruntime140_1.dll","wow64win.dll","rpcrt4.dll","msvcp140.dll","setupapi.dll","samcli.dll","wintrust.dll","urlmon.dll","CoreMessaging.dll","nsExec.dll","netutils.dll","wkscli.dll","mdmregistration.dll","ncrypt.dll","cldapi.dll","iertutil.dll","kernel32.dll","userenv.dll","WindowsCodecs.dll","TextInputFramework.dll","wbemsvc.dll","crypt32.dll","taskschd.dll","aepic.dll","ntdll.dll","cryptbase.dll","clbcatq.dll","netapi32.dll","psmachine.dll","wow64.dll","combase.dll","powrprof.dll","apphelp.dll","dwmapi.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"Uninstall.exe","sha256":"f463b4ab4a963fec35a882ce9078ac917b58d7e585b5a47e06d42c4a4653749c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Microsoft.Web.WebView2.Core.dll","sha256":"88a3b62f45225a811cdb85df6dfd95c2bff9a0e43e3b04f813b125eaca56cc9f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"runtimes/win-x86/native/WebView2Loader.dll","sha256":"6f59ad578fde1f65c44b6935dab0901f014b5268e056b930fb34c0919f1bf4b9","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/System.dll","sha256":"46b364f13d089636b60c33d3f6a4b1d2cd32e6af8d9bc29339af0b7dadd21703","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"20ddf1bf1821ce3061895016cdcf90de67eafc58a05d3dc1c4230948bf73720a","sha256":"20ddf1bf1821ce3061895016cdcf90de67eafc58a05d3dc1c4230948bf73720a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"54df865ea5105d2b43092a284312279774e0b7b82d6625ea63089791e939b692","sha256":"54df865ea5105d2b43092a284312279774e0b7b82d6625ea63089791e939b692","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"4cf00f17bd2f5408c719f0a69395f3f265f4faa5a812551537c7b93750f26c9d","sha256":"4cf00f17bd2f5408c719f0a69395f3f265f4faa5a812551537c7b93750f26c9d","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"6d3cce01fb2ab1b77658ac1550c3c2664fc19955cac2e09086da28615910d646","sha256":"6d3cce01fb2ab1b77658ac1550c3c2664fc19955cac2e09086da28615910d646","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/modern-wizard.bmp","sha256":"3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/MicrosoftEdgeWebview2Setup.exe","sha256":"aa38a8cfce6179b87181609b1c730a29eaf26138fc833af5759e67576770f3a3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"0dafc0ad2b710868656e3dd2f958b26d5bb3bd18dbb4a6e7a302baecd369be9a","sha256":"0dafc0ad2b710868656e3dd2f958b26d5bb3bd18dbb4a6e7a302baecd369be9a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"runtimes/win-x64/native/WebView2Loader.dll","sha256":"462b36fd1be6ca9f7563466a89e57c41ef4a4def3e0a84fa885d203aea4a3aaf","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"BouncyCastle.Cryptography.dll","sha256":"aec227154fc549739ff5a07920723641f773ce65d05dca70b215183c93e9641d","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"$$PLUGINSDIR/nsExec.dll","sha256":"607b24ae6b2daf3ea882fd6354e84feb109f239f7eee509fec014c6478a678c5","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"c44fcce508eb1b3c98f3c83a8b9847c7b8ffca29ced68e5785fbdbd67dbddf30","sha256":"c44fcce508eb1b3c98f3c83a8b9847c7b8ffca29ced68e5785fbdbd67dbddf30","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"runtimes/win-arm64/native/WebView2Loader.dll","sha256":"cb561ae4537e39bba5dd8af1f648f189d9562b1003fd110a9e889ace527fb4e8","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Jutsu.exe.config","sha256":"d3ac458f80301bf7e6b9428a5a479317a613e0145a23d98315a3a3906ba9436a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"acc2bb4558f5f14626162bb21e97691411abef29edc5f1d3a727f5ea7edcb083","sha256":"acc2bb4558f5f14626162bb21e97691411abef29edc5f1d3a727f5ea7edcb083","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Jutsu.exe","sha256":"765db9d434a44f86089bdd57ab7c1431de2419c5c9f23cec11929b3c9ebdf414","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Microsoft.Web.WebView2.WinForms.dll","sha256":"29fc954c3fde1749817d158f3dd5ebe9efd3b3ce9708d86092fb1e9f023a1cb0","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"$$PLUGINSDIR/nsDialogs.dll","sha256":"2b32395df2fea42a3a79db54b29f01d82db71bc090255201e03a6db872942ee8","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"WebView2Loader.dll","sha256":"6f59ad578fde1f65c44b6935dab0901f014b5268e056b930fb34c0919f1bf4b9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"MicrosoftEdgeUpdate.exe","sha256":"1d715e9790e43acb426cc9a2779debb10003cf11740e014a8edf47afd46c420d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"MicrosoftEdgeComRegisterShellARM64.exe","sha256":"25128b906bfc82e2613876eb1c0121b3b1493f482721317ba1e9f9b16a6d4e4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"MicrosoftEdgeUpdateBroker.exe","sha256":"afe76402613f52863d1b7742b6bbdd2864a5d08293f9f249b74d43fe423628cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","sha256":"fd5d92f8e281213b55a66587adf139d4e7c33e29d4e129a5be3a3f2565e6459a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"MicrosoftEdgeUpdateCore.exe","sha256":"099aeee0c71189460d97d78cb5ac83023be4d0416f2cc0f97e09ba02ff1dd8d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"MicrosoftEdgeUpdateOnDemand.exe","sha256":"fcc906ec270f2939a99090179175a85c4f3909730f14d87fac88fc90e44bb0b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"MicrosoftEdgeUpdateSetup.exe","sha256":"aa38a8cfce6179b87181609b1c730a29eaf26138fc833af5759e67576770f3a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdate.dll","sha256":"2fafcc2b8924650f9b14a743e6a93c257ae45428870fcb3082026f1f5ea0f604","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"psmachine.dll","sha256":"f1cf2ed30be294402d976c5d1074060abe76b43418f9cfe9468fdd7d4ca9d338","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"psmachine_64.dll","sha256":"d1197fe4b60161ab5d5aaa4feea5e85da33683b296e3a10c6605f09861b71195","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"psmachine_arm64.dll","sha256":"31eb9434cb8c9dff0e38bb604ee0af9502f143fe0d4708a8568cbf9e22f58492","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"psuser.dll","sha256":"f6aec00806d2c69137aabb583ed0eea29e485d27e3882f34d0e8f5ebab7f5dc5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"psuser_64.dll","sha256":"178d2a3887104af9a1683f452e60b0eac539da7f8b53a851f0446b361467a145","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"psuser_arm64.dll","sha256":"9ebe1eac8ab243df6e7353644e9e934edfa80fdaee687c70c4013afa17f1b7c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"MicrosoftEdgeWebview2Setup.exe","sha256":"aa38a8cfce6179b87181609b1c730a29eaf26138fc833af5759e67576770f3a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"System.dll","sha256":"46b364f13d089636b60c33d3f6a4b1d2cd32e6af8d9bc29339af0b7dadd21703","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"nsDialogs.dll","sha256":"2b32395df2fea42a3a79db54b29f01d82db71bc090255201e03a6db872942ee8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"nsExec.dll","sha256":"607b24ae6b2daf3ea882fd6354e84feb109f239f7eee509fec014c6478a678c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"MicrosoftEdgeUpdate.log","sha256":"757577e9ada7c2a0b1b14bd7bb8c12db7f35489357a0a908871bc5f788f40293","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"CopilotUpdate.exe","sha256":"764a0bfb80a9977a60aa168b2a984fbd72201e1215e7388d0aeaf4262d8ef5e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_af.dll","sha256":"0cedec5bc78ae86ed6b4823695d161be05d7ac156fee92d1a936118b99f426d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_am.dll","sha256":"44688840a2e5d59fedfbee12b894d5c8783ecb448e66c0aed4a2061bdfe2bd8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ar.dll","sha256":"db69e927fcb6bc87393ec675cda593713a61b26640f034db78938cfefd825380","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_as.dll","sha256":"defc05db4ad96bfa3be0f4aa06c0a361adab12277986fb4a5b3b7818b4ab2197","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_az.dll","sha256":"12267a74033dffc7e4d21a6733f0f53ecba68e83f344fe650c73b023845cc06b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_bg.dll","sha256":"b0919f4e8a83cd038f5c70ba88ffad32222b820a65a28ccf184789c9299f3c35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_bn-IN.dll","sha256":"d6d92c0ce4b7e49ba89507bf48965cda6f1b9faea9dd30700b548977b823f813","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_bn.dll","sha256":"819fdea1f910b12ff08c55fa7b2271da9a37ba77485e63c321fadc2cf37db2c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_bs.dll","sha256":"bb21682d9d93e6425b6971634477b111abc2e0490855229e00e675ee07dd30ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ca-Es-VALENCIA.dll","sha256":"f0eb57ad7229e51c7f4cd76d530d330d9e1e35f2d30360c24e689bc433dd86ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ca.dll","sha256":"3b7da30b8548a85cc9665ec2cad824ef45435230f6f3105c6a8b2e03dfcbbc13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_cs.dll","sha256":"7893da95d5c57f68aa9b8b16d4a2329e4a655e0a98df014318883a99e3391e57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_cy.dll","sha256":"38b921a689333fd1e77d52ab1ae344c206dad2ac161028464ca8fb8376b2c228","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_da.dll","sha256":"cb7434f9788b541a70147737c07ddfa9c702af115bfebf0e1e12d4d4732ec47c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_de.dll","sha256":"e26e31f94a6dfad56cbb69eea1944a8a9f5a42012774b2a3b7bf890c3c051a3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_el.dll","sha256":"82e65d8f28fd3e5983e72f8bda602041784005c9a73ba413493eb2d621620248","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_en-GB.dll","sha256":"2dc2c7b3a84d361eeff609d0835433ba6a1f17e04d09d030c2a068740507e33b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_en.dll","sha256":"9203978b6630dc6aa858457bf42775f73102e3db7e5ceba4ce19beef0ca455d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_es-419.dll","sha256":"50155d7c937bb698c8c2511455c4672da8e3b73a77c6f53b2d71de1a81cb9c42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_es.dll","sha256":"9bf00bbae583c7b04d26791916df37ad23fc107c33e7ddb16278442da6ab5a17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_et.dll","sha256":"00d135792459d1c58bf7419a437612f0342b3b12c9e7eb9f284f33c32cdd6da1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_eu.dll","sha256":"7f18308410a3e4d25b3baadd1108e8c5f8535c740d0cab7ba5ca1fa62eaba0e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_fa.dll","sha256":"907e98ddbc343268da2ae1b7156049fb7296df6f7aab250dd4a9dfd871f13a52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_fi.dll","sha256":"efbda61ea6a2eb859936cdf0c3f46c16ea387ac79ca619d9c589b6b716bced73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_fil.dll","sha256":"839e09b9949336983ee40794a10708faa57ba1e03636e61c35ebbde683b1df29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_fr-CA.dll","sha256":"b560830b19d6316cd019665fd4fd9ab591ba12b0be8f2d2a6889e26ab6f0dfd7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_fr.dll","sha256":"3c410305b0b6516c248425b798eba0a8e7d523186fcf6d09b433ba89a473fc94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ga.dll","sha256":"e3f5aa9a806e974e73d9cc0070a2010eec757f0eb20b68a10d3498ac527e7f4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_gd.dll","sha256":"f443ffe34ec89766f003d4caafb4cd263afa26b55180aacac18a1eba45bf0b61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_gl.dll","sha256":"0bf33a087007b36bb056087abc73e2ba1d7ff575e2f0497a344ee08eed312cfe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_gu.dll","sha256":"a17e6d4a7f2f7ae852808f04912b7d32cfc085151fd6c4c1ea724ed796a71d46","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_hi.dll","sha256":"b3918135d3bd6df9cc4ccfd41c25853b79423f0aaa55c449c19115489ad25f1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_hr.dll","sha256":"ae4d6a990775fb52158a2fc8732799ef66d45fdbd125796f2ffa1e2a2fd771f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_hu.dll","sha256":"c38b22754642771a76b945d1369cda810ea47cbff481957ce89981087c78d79e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_id.dll","sha256":"70a87fd4f78f6f9563502275ce8f915bc5fa0f98032d51ef5414ce4991cdbac7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_is.dll","sha256":"84ad6f6851fa0f2be94c3574ae62a28c153911e8d69a9b6b9d777150a1082b95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_it.dll","sha256":"aa75835f9b17779af422aeb470761c1863e821f432bc7b9597d9007ae5f379bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_iw.dll","sha256":"3a3c23b67f040e8cf1e524a226c62e27e6b040a80c5e12380dc3224765b49878","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ja.dll","sha256":"36b98af3e692d96186bf691c39983ebd9db6534771dc61f6e1a4829ce5ff6bd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ka.dll","sha256":"bb1f0ec8cd0b6e2337e3d7ac33772b379166e022bda368c6801afdd16299901f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_kk.dll","sha256":"b3fcd4e8414037b778b88c469b290197efccb61584edab89bdcdbe40ef8dab2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_km.dll","sha256":"e7ec86a8124ee6bef57037fb09d77bbbfcd47261cf3dd0dd40ffdadf40e6f8df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_kn.dll","sha256":"652d69605a4db36cc9ec2c8cf5043555c9309baac22052e5e63bbbf2fa98232f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ko.dll","sha256":"cd4fe3b5de1a4ea022f4b3f3124b6873c536f787175be106fdaea2f4d5752b0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_kok.dll","sha256":"9290a90705e0faaf0efcbd0fa835837b9c1b6a905bbb1d4f2ca16b4619b4618e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_lb.dll","sha256":"ae489f74fc1aa02cdf18e3d17435fe927ee48befa37b17d8016d41bd04c8fe25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_lo.dll","sha256":"64e97301e6599756123884da4054a9b063ce9f2c257fac639681985b5af6b4ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_lt.dll","sha256":"46a2df6bac42e52d796cb0837dae379a2048136a3f8a7b43db6e7f758da72a4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_lv.dll","sha256":"3964ef3beea4bd2e99277224c83e316137bc508bf6de8523cfa029a566eca895","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_mi.dll","sha256":"f7d51e90f166c744957d8f384dacc6365885bec647b50f7c3cd095dfdbafd3a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_mk.dll","sha256":"15618c8acb1c3eeec08d7571a54be4550f3b4628b925a25a0227b28079952fac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ml.dll","sha256":"e52c104fb648f0b4556d368eb3980039f18621a7e3bcdc6900fec40ed0273ab8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_mr.dll","sha256":"56a63a5e7db40cb1b27d34cf60811abfe676055bb4a84d0db6e42889dc162588","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ms.dll","sha256":"3d3d8338c17615bc2e8ab8de6f4f445c694b2a0c1fe02524390c7c27c7055d26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_mt.dll","sha256":"9d10f861d07c8f7aa9da29e3d6e9b445eebbbb2313e10e3c69a1b4e78e50584d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_nb.dll","sha256":"c549ef4c0f8c834d75306144dbbc246ddbe3b8e32e48415b77762c83459f42db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ne.dll","sha256":"eeae2f47a68aafd1cf77ec40160daa9cb808b7caaa0805a9b5da4f26eead0fc3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_nl.dll","sha256":"4e4d7825c0b343f4b488a0b65b22e98c702e70849be8108da64903c38b82231c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_nn.dll","sha256":"07deeea3e62340fe2e2a18dda4f8153acafb4a6908f01192931b1afc0778ef24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_or.dll","sha256":"a753f9150f7991fd538ef84b4a174c74e8fa1eef00039292a20a81406688dcfa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_pa.dll","sha256":"3ae368f2b0df7918d9f7291c76241c74b9ec654a607527b931155bd2a57503d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_pl.dll","sha256":"217fc025775804fc674b52c95f0aebbc7bb6297684ad64ac2651a950ce1b1ad4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_pt-BR.dll","sha256":"0091730b7be0637aa21460a8c8f6b803aeaaa2957e8563e3b2d385aa86ef1b2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_pt-PT.dll","sha256":"37dc1b8075e841bb28c8f9297c2bbf2a26f04346f00167a6d654b897f858ea5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_quz.dll","sha256":"f025326e242ca605bb8eda5b81038b6fdbac038686f0009214806da61d73b64d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ro.dll","sha256":"ce3da5018b16798fab201824f2a0ce241bb340e61befe9c6cdbae4c26f0f9f38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ru.dll","sha256":"5e60d9f68ab20b26abc15a13386d56502e9a3b05d3f89da6cfb969d47e7505bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_sk.dll","sha256":"2ae9ecad851dfc736271cc8ddc192dd4db8caf36f8ad4dcea1f78a70f7c61432","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_sl.dll","sha256":"cfeaa1d39f9713b3092c4bb7b84536d5cf0763c33e894866cd77e83109530d09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_sq.dll","sha256":"1ff153da4c6c14d2780adc08589deda678178cd2b26975a4ac6f79f1ef50a743","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_sr-Cyrl-BA.dll","sha256":"9ab2d24c3d1f299d477d150961a07b3771bb4ce4c4061d8cc687bd3f24a4883f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_sr-Cyrl-RS.dll","sha256":"271ae77a01c7c9df279efca6880419a9d2ba4637faed29198eda748bd34a24eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_sr-Latn-RS.dll","sha256":"52f307ba32e9c95f0d07a83138b93032994780b29bc04546d6852c4112d50740","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_sr.dll","sha256":"f052ce2982bc73e622ab4bea62b255aed8d9f41c614045f0712fa436dc3b8090","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_sv.dll","sha256":"fd039af53f4c0d605e49b4ef9f71e9ffad8efb7ad0a5bedf6a4c8aae20c985f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ta.dll","sha256":"699de53c95291a6f177c9184c7a05e8de9579ef7a1d222899b4dc77ecbfebddd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_te.dll","sha256":"63f91bf316304b9ff6c77347d4ecb94942a1d33d1a5e69d4d8e0ba2a0b7f9b1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_th.dll","sha256":"9cc81afd38a73dc41dc3685d922cf5ab39e8c10766cc04620ca46ac8f9b4fd37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_tr.dll","sha256":"2d1f597505a2a5ecf43a652693ea2de066c69b0e6b214a188b0356c5295cf1db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_tt.dll","sha256":"112fee25ca4cab5227bed33f1a19d3e42125776d9d84e282684e0137e314c700","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ug.dll","sha256":"a81c4d033ef47409155df6ae7c4fc32c24e7af4e8a1181e7fc953d07af8a9b39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_uk.dll","sha256":"2884d3427a20fb7e3b9edb2dd649110eeff5eacf15b32ec51a18306cee3b5cbe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_ur.dll","sha256":"a78a23a4415af13668f5ef6e9782b2d791b7e96fd1796a19c1b0933db6a58f3b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_vi.dll","sha256":"4b1be4dd130a19dc6fbb973ce604f8bac26f2c0c242054970a05553d4a320de8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_zh-CN.dll","sha256":"051eb338beac88ce7fdff7eff8e09632f4efc52b7200c435220d59ece202aa12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"msedgeupdateres_zh-TW.dll","sha256":"64cbc8db736e0c671d2fbf2faf8a82232a72440ce3b9b936e3f1212f1201dbbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%TEMP%\\nsl3FD1.tmp","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%TEMP%\\nsv4010.tmp","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%TEMP%\\nsl4021.tmp","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%TEMP%\\nsl4021.tmp\\modern-wizard.bmp","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%TEMP%\\nsl4021.tmp\\nsDialogs.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%TEMP%\\nsl4021.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%TEMP%\\nsl4021.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%LOCALAPPDATA%\\Programs\\Jutsu\\Jutsu.exe","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%LOCALAPPDATA%\\Programs\\Jutsu\\Jutsu.exe.config","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%LOCALAPPDATA%\\Programs\\Jutsu\\Microsoft.Web.WebView2.Core.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%LOCALAPPDATA%\\Programs\\Jutsu\\Microsoft.Web.WebView2.WinForms.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%LOCALAPPDATA%\\Programs\\Jutsu\\BouncyCastle.Cryptography.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%LOCALAPPDATA%\\Programs\\Jutsu","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%LOCALAPPDATA%\\Programs\\Jutsu\\runtimes\\win-x64\\native\\WebView2Loader.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%LOCALAPPDATA%\\Programs\\Jutsu\\runtimes","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%LOCALAPPDATA%\\Programs\\Jutsu\\runtimes\\win-x86\\native\\WebView2Loader.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%LOCALAPPDATA%\\Programs\\Jutsu\\runtimes\\win-arm64\\native\\WebView2Loader.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%TEMP%\\nsl4021.tmp\\MicrosoftEdgeWebview2Setup.exe","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\MicrosoftEdgeUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\CopilotUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdate.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\MicrosoftEdgeUpdateBroker.exe","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\MicrosoftEdgeUpdateOnDemand.exe","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\MicrosoftEdgeUpdateComRegisterShell64.exe","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\MicrosoftEdgeComRegisterShellARM64.exe","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\psmachine.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\psmachine_64.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\psmachine_arm64.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\psuser.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\psuser_64.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\psuser_arm64.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\NOTICE.TXT","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\EdgeUpdate.dat","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\MicrosoftEdgeUpdateCore.exe","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_am.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ar.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_bg.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_bn.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ca.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_cs.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_da.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_de.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_el.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_en.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_en-GB.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_es.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_es-419.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_et.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_fa.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_fi.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_fil.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_fr.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_gu.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_hi.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_hr.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_hu.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_id.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_is.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_it.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_iw.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ja.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_kn.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ko.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_lt.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_lv.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ml.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_mr.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ms.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_nb.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_nl.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_pl.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_pt-BR.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_pt-PT.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ro.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ru.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_sk.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_sl.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_sr.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_sv.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ta.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_te.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_th.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_tr.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_uk.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ur.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_vi.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_zh-CN.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_zh-TW.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_af.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_as.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_az.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_bn-IN.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_bs.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ca-Es-VALENCIA.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_cy.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_eu.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_fr-CA.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ga.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_gd.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_gl.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ka.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_kk.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_km.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_kok.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_lb.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_lo.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_mi.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_mk.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_mt.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ne.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_nn.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_or.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_pa.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_quz.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_sq.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_sr-Cyrl-BA.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_sr-Cyrl-RS.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_sr-Latn-RS.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_tt.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\msedgeupdateres_ug.dll","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU77CF.tmp\\MicrosoftEdgeUpdateSetup.exe","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\CopilotUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{DA6570DE-122B-4A09-B42B-37603CABA4FC}\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{DA6570DE-122B-4A09-B42B-37603CABA4FC}\\INPROCHANDLER32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{59A5853A-2739-421B-999B-91F186558B08}\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{59A5853A-2739-421B-999B-91F186558B08}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C853632E-36CA-4999-B992-EC0D408CF5AB}\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C853632E-36CA-4999-B992-EC0D408CF5AB}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C853632E-36CA-4999-B992-EC0D408CF5AB}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{60355531-5BFD-45AB-942C-7912628752C7}\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{60355531-5BFD-45AB-942C-7912628752C7}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{60355531-5BFD-45AB-942C-7912628752C7}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A5135E58-384F-4244-9A5F-30FA9259413C}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A5135E58-384F-4244-9A5F-30FA9259413C}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7E29BE61-5809-443F-9B5D-CF22156694EB}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7E29BE61-5809-443F-9B5D-CF22156694EB}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{DA6570DE-122B-4A09-B42B-37603CABA4FC}\\INPROCHANDLER32\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{DA6570DE-122B-4A09-B42B-37603CABA4FC}\\","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6316:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6316:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6316:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Local\\SM0:6316:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"SM0:6316:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"SM0:6316:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5072:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"SM0:5072:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5020:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5020:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"SM0:5020:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Local\\SM0:5020:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4016:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4016:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{F340B839-380B-4AA9-BA6F-B83F23E2DD05}","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{DDDDEAEB-04CC-4BAA-9C63-CCA5FE38F688}","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4016:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4016:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Local\\SM0:4016:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Local\\SM0:4016:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"SM0:4016:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"SM0:4016:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7356:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7356:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"SM0:7356:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Local\\SM0:7356:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2712:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2712:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Local\\SM0:2712:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"SM0:2712:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3524:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3524:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"SM0:3524:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Local\\SM0:3524:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"SM0:5124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Local\\SM0:5124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Local\\SM0:6228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"SM0:6228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5384:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5384:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"SM0:5384:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Local\\SM0:5384:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"SM0:5076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]},{"name":"Local\\SM0:5076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac541e795cb831e1f0da99b"}]}]}},"report_ids":{"sandbox_job_ids":["6ac541e795cb831e1f0da99b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 18e7d5b61dd3… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 18e7d5b61dd3…. Threat score 85/100. 0/26 AV engines flagged this file. 4 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 18e7d5b61dd3… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 18e7d5b61dd3…. Threat score 85/100. 0/26 AV engines flagged this file. 4 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/18e7d5b61dd36a1d8433bdff7ff83726c342b317777bed00eff3abd49bce81de"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 18e7d5b61dd3… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 18e7d5b61dd3…. Threat score 85/100. 0/26 AV engines flagged this file. 4 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L74","11",{}]]