24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 72:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware_ Sample 429c792a9586… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 429c792a9586…. Malware family: Malware_. Threat score 100/100. 1/27 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","keywords":["Malicious","Malware_","malware analysis","sandbox report","threat intelligence","429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510"],"about":{"@type":"SoftwareApplication","name":"Posline_0.1.1_x64-setup.exe","applicationCategory":["compressed","7zip"],"identifier":"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware_","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T420,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "System.dll") file/memory contains long string with (Indicator: "VirtualFree"; File: "System.dll") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp")26:T9e9,Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp")27:T5ef,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") file/memory contains long string with (Indicator: "FreeLibrary"; File: "System.dll") file/memory contains long string with (Indicator: "LoadLibrary"; File: "System.dll") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp")28:T73e,"MicrosoftEdgeWebview2Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "MicrosoftEdgeWebview2Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "MicrosoftEdgeWebview2Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "MicrosoftEdgeWebview2Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "MicrosoftEdgeWebview2Setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "MicrosoftEdgeWebview2Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION") "MicrosoftEdgeWebview2Setup.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION") "MicrosoftEdgeWebview2Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "MicrosoftEdgeWebview2Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "MicrosoftEdgeWebview2Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\MICROSOFTEDGEUPDATE.EXE") "MicrosoftEdgeWebview2Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS") "MicrosoftEdgeWebview2Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS") "MicrosoftEdgeWebview2Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS") "MicrosoftEdgeWebview2Setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS")29:Tc25,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" queried SystemProcessInformation at 00000000-00000064-00000C15-1230507222 [PID: 64] "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" queried SystemProcessInformation at 00000000-00000064-00000C15-1230516024 [PID: 64] "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" queried SystemProcessInformation at 00000000-00000064-00000C15-1230688735 [PID: 64] "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" queried SystemProcessInformation at 00000000-00000064-00000C15-1230697270 [PID: 64] "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" queried SystemProcessInformation at 00000000-00000064-00000C15-1230833989 [PID: 64] "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" queried SystemProcessInformation at 00000000-00000064-00000C15-1230843276 [PID: 64] "MicrosoftEdgeWebview2Setup.exe" queried SystemProcessInformation at 00000000-00001892-00000C15-1238405814 [PID: 1892] "MicrosoftEdgeWebview2Setup.exe" queried SystemProcessInformation at 00000000-00001892-00000C15-1238415148 [PID: 1892] "MicrosoftEdgeWebview2Setup.exe" queried SystemProcessInformation at 00000000-00001892-00000C15-1238572284 [PID: 1892] "MicrosoftEdgeWebview2Setup.exe" queried SystemProcessInformation at 00000000-00001892-00000C15-1238580989 [PID: 1892] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00002636-00000C15-1240619337 [PID: 2636] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00002636-00000C15-1240629346 [PID: 2636] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00002636-00000C15-1240782146 [PID: 2636] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00002636-00000C15-1240791218 [PID: 2636] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00002636-00000C15-1240887073 [PID: 2636] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00002636-00000C15-1240896602 [PID: 2636] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00002636-00000C15-1241063872 [PID: 2636] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00002636-00000C15-1241072421 [PID: 2636] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00002636-00000C15-1241194835 [PID: 2636] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00002636-00000C15-1241203888 [PID: 2636] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00002636-00000C15-1241571544 [PID: 2636] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00002636-00000C15-1241580016 [PID: 2636] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00002636-00000C15-1242141593 [PID: 2636] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00002636-00000C15-1242150844 [PID: 2636] "MicrosoftEdgeUpdate.exe" queried SystemProcessInformation at 00000000-00006444-00000C15-1243219233 [PID: 6444]2a:T13e7,"MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdate.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdate.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\CopilotUpdate.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\CopilotUpdate.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdate.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\Muca.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\Muca.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateCore.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateCore.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateComRegisterShell64.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeComRegisterShellARM64.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeComRegisterShellARM64.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\NOTICE.TXT" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\NOTICE.TXT" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\EdgeUpdate.dat" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\EdgeUpdate.dat" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_af.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_af.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_am.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_am.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ar.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_ar.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_as.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_as.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_az.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_az.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bg.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_bg.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bn.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_bn.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bn-IN.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_bn-IN.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bs.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_bs.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ca.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_ca.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ca-Es-VALENCIA.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_ca-Es-VALENCIA.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_cs.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_cs.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_cy.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_cy.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_da.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_da.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_de.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_de.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_el.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_el.dll"2b:T13e4,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-41-00EFEA7A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-41-00EFEA7A Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00001892-58013-89-00F088FD Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00001892-58013-89-00F088FD Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00001892-58013-89-00F088FD Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00001892-58013-89-00F088FD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-108-00EFFCDB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-108-00EFFCDB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-111-00EFF949 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-111-00EFF949 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-158-00F00D19 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-158-00F00D19 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001892-58013-274-00EF50C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001892-58013-274-00EF50C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-284-00EF40F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-284-00EF40F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-289-00EF29E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-289-00EF29E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-442-00EF15DC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-442-00EF15DC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-467-00EF4418 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-467-00EF4418 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-472-00EF187B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-472-00EF187B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-473-00EF1938 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-473-00EF1938 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001892-58013-475-00EF1A73 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001892-58013-475-00EF1A73 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-476-00EF1DA2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-476-00EF1DA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-478-00EF4873 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-478-00EF4873 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-481-00EF1E84 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-481-00EF1E84 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-482-00EF2DE7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-482-00EF2DE7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-484-00EF3E90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-484-00EF3E90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-486-00EF28E4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-486-00EF28E4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-489-00EF498A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-489-00EF498A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-497-00EF2833 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-497-00EF2833 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-498-00EF27AB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-498-00EF27AB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-513-00EF26D3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-513-00EF26D3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-514-00EF2505 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-514-00EF2505 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-58013-515-00EF2329 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-58013-515-00EF23292c:T748c,Found XOR loop in file "msedgeupdate.dll" at offset 297328; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 335794; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 465534; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 609567; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 610254; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 610331; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 1531538; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 1578610; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 1580500; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 1700308; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 1863160; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2239311; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2456475; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2467189; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2468533; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2490775; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2499327; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2499943; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2503783; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2505995; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2508051; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2510107; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2512523; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2513281; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2514211; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2516819; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2520630; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 15771; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 125296; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 380964; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 398451; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 440731; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 440883; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 559937; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1170574; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1181377; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1181520; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1181589; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1181655; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1288334; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1380899; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2190075; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2260831; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2268141; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2399178; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2438251; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2439467; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2467881; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2471401; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2480945; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2495039; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2495551; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1563960; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1570935; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1614428; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1626778; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1854188; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2102180; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2181313; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2204285; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2260089; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2264535; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2383642; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2447022; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2458082; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2479396; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2499308; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2500924; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2503744; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2505956; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2508012; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2510068; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2510988; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2512508; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2514182; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2516536; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2516780; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2518258; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2523235; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 230057; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 247010; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 279606; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 394501; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 408550; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 464039; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 519082; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 684878; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 739034; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 754826; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 766986; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 784374; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 844091; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 863321; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 911110; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 928345; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 935079; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1078732; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1133013; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1165224; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1202673; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1238002; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1267129; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1271717; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1300125; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1327159; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1328571; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1494359; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1548906; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1769434; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1862796; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1927316; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1988175; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1993270; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 31396; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 36126; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 191126; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 216754; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 256231; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 262508; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 281925; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 303111; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 363738; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 452394; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 510897; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 580711; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 606110; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 677407; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 808556; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 931171; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1005186; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1039682; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1040098; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1102188; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1161857; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1163286; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1217975; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1263610; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1295798; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1347146; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1475836; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1584412; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1630686; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1635504; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1665872; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1714416; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1755698; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1758867; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1774845; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1776496; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1800964; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1824524; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1882562; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1892241; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1920367; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1985711; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 51183; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 303016; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 366987; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 490136; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 491015; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 506434; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 625674; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 680208; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 726456; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 782993; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 806724; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1078243; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1166008; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1169584; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1290814; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1496447; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1585158; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1630792; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1687423; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1706637; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1797662; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1799412; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1850596; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1902395; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1989806; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1990898; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1996109; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1997794; code bytes = 8030 Found XOR loop in file "Muca.dll" at offset 178228; code bytes = 30d0 Found XOR loop in file "Muca.dll" at offset 179047; code bytes = 30d0 Found XOR loop in file "Muca.dll" at offset 180501; code bytes = 30d0 Found XOR loop in file "Muca.dll" at offset 524427; code bytes = 30d0 Found XOR loop in file "Muca.dll" at offset 526105; code bytes = 30d0 Found XOR loop in file "Muca.dll" at offset 529041; code bytes = 30d0 Found XOR loop in file "Muca.dll" at offset 530409; code bytes = 30d0 Found XOR loop in file "Muca.dll" at offset 530737; code bytes = 30d0 Found XOR loop in file "Muca.dll" at offset 534582; code bytes = 30d0 Found XOR loop in file "Muca.dll" at offset 79917; code bytes = 33c1 Found XOR loop in file "Muca.dll" at offset 275827; code bytes = 33c1 Found XOR loop in file "Muca.dll" at offset 297206; code bytes = 33c1 Found XOR loop in file "Muca.dll" at offset 307552; code bytes = 33c1 Found XOR loop in file "Muca.dll" at offset 516841; code bytes = 33c1 Found XOR loop in file "Muca.dll" at offset 517945; code bytes = 33c1 Found XOR loop in file "Muca.dll" at offset 518209; code bytes = 33c1 Found XOR loop in file "Muca.dll" at offset 520668; code bytes = 8030 Found XOR loop in file "Muca.dll" at offset 524408; code bytes = 8030 Found XOR loop in file "Muca.dll" at offset 526088; code bytes = 8030 Found XOR loop in file "Muca.dll" at offset 527926; code bytes = 8030 Found XOR loop in file "Muca.dll" at offset 528412; code bytes = 8030 Found XOR loop in file "Muca.dll" at offset 532210; code bytes = 8030 Found XOR loop in file "Muca.dll" at offset 535502; code bytes = 8030 Found XOR loop in file "Muca.dll" at offset 537187; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 438152; code bytes = 30d0 Found XOR loop in file "psuser_64.dll" at offset 510006; code bytes = 30d0 Found XOR loop in file "psuser_64.dll" at offset 64325; code bytes = 33c1 Found XOR loop in file "psuser_64.dll" at offset 159336; code bytes = 33c1 Found XOR loop in file "psuser_64.dll" at offset 320371; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 507634; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 512611; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 510006; code bytes = 30d0 Found XOR loop in file "psmachine_64.dll" at offset 64325; code bytes = 33c1 Found XOR loop in file "psmachine_64.dll" at offset 159336; code bytes = 33c1 Found XOR loop in file "psmachine_64.dll" at offset 320371; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 507634; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 512610; code bytes = 8030 Found XOR loop in file "psmachine_arm64.dll" at offset 444672; code bytes = 30d0 Found XOR loop in file "psmachine_arm64.dll" at offset 486966; code bytes = 30d0 Found XOR loop in file "psmachine_arm64.dll" at offset 484594; code bytes = 8030 Found XOR loop in file "psmachine_arm64.dll" at offset 487886; code bytes = 8030 Found XOR loop in file "psmachine_arm64.dll" at offset 489571; code bytes = 8030 Found XOR loop in file "psuser_arm64.dll" at offset 444672; code bytes = 30d0 Found XOR loop in file "psuser_arm64.dll" at offset 486966; code bytes = 30d0 Found XOR loop in file "psuser_arm64.dll" at offset 484594; code bytes = 8030 Found XOR loop in file "psuser_arm64.dll" at offset 487886; code bytes = 8030 Found XOR loop in file "psuser_arm64.dll" at offset 489571; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 69079; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 388829; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 390339; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 395251; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 400391; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 404022; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 111118; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 121363; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 386157; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 390017; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 393641; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 66073; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 66093; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 239756; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 252106; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 391026; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 395232; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 397126; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 400356; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 401650; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 406627; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 69079; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 388829; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 390339; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 395251; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 400391; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 404022; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 111118; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 121363; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 386157; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 390017; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 393641; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 66073; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 66093; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 239756; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 252106; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 391026; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 395232; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 397126; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 400356; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 401650; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 404942; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 406627; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 328035; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 336950; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 90739; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 95470; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 323697; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 215356; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 227706; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 332188; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 334578; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 337870; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 339555; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 226870; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 23432; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 120467; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 128344; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 132688; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 224498; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 227790; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 229475; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 193351; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 194297; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 201270; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 45308; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 193332; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 194278; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 198898; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 202190; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 203875; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 193078; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 190706; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 193998; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 195683; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 87805; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 93750; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 2925; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 91378; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 96355; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 87805; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 93750; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 2925; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 95926; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 91378; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 94670; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 96355; code bytes = 8030 Found XOR loop in file "msedgeupdateres_de.dll" at offset 24630; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_de.dll" at offset 22258; code bytes = 8030 Found XOR loop in file "msedgeupdateres_de.dll" at offset 25550; code bytes = 8030 Found XOR loop in file "msedgeupdateres_de.dll" at offset 27235; code bytes = 8030 Found XOR loop in file "msedgeupdateres_el.dll" at offset 24630; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_el.dll" at offset 22258; code bytes = 8030 Found XOR loop in file "msedgeupdateres_el.dll" at offset 25550; code bytes = 8030 Found XOR loop in file "msedgeupdateres_el.dll" at offset 27235; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ml.dll" at offset 24630; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_ml.dll" at offset 26806; code bytes = 33c1 Found XOR loop in file "msedgeupdateres_ml.dll" at offset 22258; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ml.dll" at offset 25550; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ml.dll" at offset 27235; code bytes = 8030 Found XOR loop in file "msedgeupdateres_lb.dll" at offset 24118; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_lb.dll" at offset 21746; code bytes = 8030 Found XOR loop in file "msedgeupdateres_lb.dll" at offset 26723; code bytes = 8030 Found XOR loop in file "msedgeupdateres_it.dll" at offset 24118; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_it.dll" at offset 21746; code bytes = 8030 Found XOR loop in file "msedgeupdateres_it.dll" at offset 26723; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ca.dll" at offset 24118; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_ca.dll" at offset 21746; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ca.dll" at offset 26723; code bytes = 8030 Found XOR loop in file "msedgeupdateres_fr-CA.dll" at offset 24118; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_fr-CA.dll" at offset 21746; code bytes = 8030 Found XOR loop in file "msedgeupdateres_fr-CA.dll" at offset 25038; code bytes = 8030 Found XOR loop in file "msedgeupdateres_fr-CA.dll" at offset 26723; code bytes = 8030 Found XOR loop in file "msedgeupdateres_gd.dll" at offset 24118; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_gd.dll" at offset 21746; code bytes = 8030 Found XOR loop in file "msedgeupdateres_gd.dll" at offset 25038; code bytes = 8030 Found XOR loop in file "msedgeupdateres_gd.dll" at offset 26723; code bytes = 8030 Found XOR loop in file "msedgeupdateres_fr.dll" at offset 24118; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_fr.dll" at offset 21746; code bytes = 8030 Found XOR loop in file "msedgeupdateres_fr.dll" at offset 25038; code bytes = 8030 Found XOR loop in file "msedgeupdateres_fr.dll" at offset 26723; code bytes = 8030 Found XOR loop in file "msedgeupdateres_pl.dll" at offset 24118; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_pl.dll" at offset 21746; code bytes = 8030 Found XOR loop in file "msedgeupdateres_pl.dll" at offset 25038; code bytes = 8030 Found XOR loop in file "msedgeupdateres_pl.dll" at offset 26723; code bytes = 80302d:T49d,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeUpdateComRegisterShell64.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeUpdate.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeComRegisterShellARM64.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeUpdateOnDemand.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeUpdateBroker.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "CopilotUpdate.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp")2e:T522,Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp")2f:T6ec,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "NSISdl.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "nsDialogs.dll") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "InSendMessageEx" (Indicator: "sendmessage"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp")30:T75d,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "GetWindowTextW" with parameter "&Next >" - (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "GetWindowTextW" with parameter "Welcome to Posline Setup" - (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "GetWindowTextW" with parameter "Setup will guide you through the installation of Posline.It is recommended that you close all other applications before starti" - (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "GetWindowTextW" with parameter "< &Back" - (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "GetWindowTextW" with parameter "Choose Install Location" - (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "GetWindowTextW" with parameter "Choose the folder in which to install Posline." - (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "GetWindowTextW" with parameter "Nullsoft Install System v3.13" - (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "GetWindowTextW" with parameter "%LOCALAPPDATA%\Posline" - (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "GetWindowTextW" with parameter "Space required: 9.8 MB" - (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "GetWindowTextW" with parameter "Space available: 34.9 GB" - (UID: 00000000-00000064)31:T2f38,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c8f92f01ad6192770cfa2f01000000009b6292777be110730cfa2f0140bf3d0334fa2f010000000040bf3d030000000000000000000000000100000000000000ee13930080f92f01ee13937780fa2f01506a96774be8a105feffffffdc009677055d92779000000003000000ecf92f01040000000000000000000000ffffffff0100000038fa2f01b556977734fa2f01d0569777000000000cfa2f01000000000300000068353d030000000000000000000000000000000000000000000000000200000080fa2f01700a9677ec029677603b957723e21073c4fa2f0100008f770090170100b0a077001000000000ee000100000000008f7700000000 (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000002f0116e15a7768f12f0160f12f016cf12f010300000080f6067578f12f01aaec5a770300000000000000e447bf73b6ec5a777182861ab0f12f017de05a7764e05a77b982861ae447bf7305000000f09dbf730000000075e2bf7386e2bf7330f22f01802b5d776935ce6cfeffffffbcf12f01e0df5a772002c173ccf12f0149d9c073c064c3732002c173d8f12f0163d9c0732002c173fcf12f01fa9dbf73010000000100000037069277010000000b2e5b7706000000dad8c07340f22f01eecfc073c4dcc073e2cfc07334f963b80100000001000000000000005fe91073180000003cf22f0132ba9477a068c37300000000000000000000000050f22f01 (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000f8ce2f0138cf9377cc373d0364cf2f010100000080373d03cc373d0380373d03040000000400000000e011750010000064cf2f010100000080373d03cd9793779c97937737c91073b50f087580373d0300009377000000009413e2730000000080ee0e750100000000000000f8e2117500000000040000000000000048401075f8e2117568cf2f0180e85b74789b3d0380e85b7464cf2f010000000080e85b7480373d039cd42f01000000001c001c00ac4def0058f92f0100000000e8b03d036cd12f0120d12f0140d42f010101010154f92f01000200000000000000000000ffffffff000000000000000000000000c69c3f03dc9c3f03 (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000f8ce2f0138cf9377cc373d0364cf2f010100000080373d03cc373d0380373d03040000000400000000e011750010000064cf2f010100000080373d03cd9793779c97937737c91073b50f087580373d0300009377000000009413e2730000000080ee0e750100000000000000f8e2117500000000040000000000000048401075f8e2117568cf2f0180e85b74789b3d0380e85b7464cf2f010000000080e85b7480373d039cd42f01000000001c001c00ac4def0058f92f0100000000e8b03d036cd12f0120d12f0140d42f010101010154f92f01000200000000000000000000ffffffff000000000000000000000000aede3f03c6de3f03 (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000f8ce2f0138cf9377cc373d0364cf2f010100000080373d03cc373d0380373d03040000000400000000e011750010000064cf2f010100000080373d03cd9793779c97937737c91073b50f087580373d0300009377000000009413e2730000000080ee0e750100000000000000f8e2117500000000040000000000000048401075f8e2117568cf2f0180e85b74789b3d0380e85b7464cf2f010000000080e85b7480373d039cd42f01000000001c001c00ac4def0058f92f0100000000e8b03d036cd12f0120d12f0140d42f010101010154f92f01000200000000000000000000ffffffff000000000000000000000000aede3f03c2de3f03 (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000f8ce2f0138cf9377cc373d0364cf2f010100000080373d03cc373d0380373d03040000000400000000e011750010000064cf2f010100000080373d03cd9793779c97937737c91073b50f087580373d0300009377000000009413e2730000000080ee0e750100000000000000f8e2117500000000040000000000000048401075f8e2117568cf2f0180e85b74789b3d0380e85b7464cf2f010000000080e85b7480373d039cd42f01000000001c001c00ac4def0058f92f0100000000e8b03d036cd12f0120d12f0140d42f010101010154f92f01000200000000000000000000ffffffff000000000000000000000000862f40039e2f4003 (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000f8ce2f0138cf9377cc373d0364cf2f010100000080373d03cc373d0380373d03040000000400000000e011750010000064cf2f010100000080373d03cd9793779c97937737c91073b50f087580373d0300009377000000009413e2730000000080ee0e750100000000000000f8e2117500000000040000000000000048401075f8e2117568cf2f0180e85b74789b3d0380e85b7464cf2f010000000080e85b7480373d039cd42f01000000001c001c00ac4def0058f92f0100000000e8b03d036cd12f0120d12f0140d42f010101010154f92f01000200000000000000000000ffffffff0000000000000000000000009e993f03b4993f03 (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000f8ce2f0138cf9377cc373d0364cf2f010100000080373d03cc373d0380373d03040000000400000000e011750010000064cf2f010100000080373d03cd9793779c97937737c91073b50f087580373d0300009377000000009413e2730000000080ee0e750100000000000000f8e2117500000000040000000000000048401075f8e2117568cf2f0180e85b74789b3d0380e85b7464cf2f010000000080e85b7480373d039cd42f01000000001c001c00ac4def0058f92f0100000000e8b03d036cd12f0120d12f0140d42f010101010154f92f01000200000000000000000000ffffffff0000000000000000000000009e993f03b6993f03 (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000064) "MicrosoftEdgeWebview2Setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001892) "MicrosoftEdgeWebview2Setup.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001892) "MicrosoftEdgeWebview2Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001892) "MicrosoftEdgeUpdate.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000060000000001000c0038dd670006000000080000006002fc00e048fc0007000000a0dc00000000f573100000000000fc0058f0ba00fefffffff8efba00b71693772800000030000000d007be0018000000d8f0ba003d0000000000be0000f0ba00e5009477307ba077030000005831fd00108ffc000f00000000000000200000000000be00c401be009408be00000000009008be000100000050f0ba00591693771000000000000c00d8f0ba000000fc0074f0ba0018000000000000000000000003000000020000000000fc001000000000000c000100000074f0ba00ee13937700000000ee13937700000c000000000000000000000000004ce99577 (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02cfb750cefba00226e25750000ed04000000002d6e2575c54bd8a82d000000ecb7f17590efba00b1ce9800888efd002890fc000000000080000000d0eeba000000be0054efba0070c8267531d549ddfeffffff2d000000d0cc00762700000024efba00856a27751c232c7564efba00f85f277508000000bb692675b2692675ad4bd8a82d000000ecb7f17527000000d0cc007638efba002d000000d0cc00762700000068efba00856a27751c232c75b0efba007e8aff75ee8cff75738aff7584705c2e2d000000ecb7f17527000000d0cc00762c11ed04c010ed0484705c2e78efba00fc523d7664f0ba00e084ff750c6edd58feffffff738aff75 (UID: 00000000-00002636)32:T462,Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "069818,1516,109,,GetWindowTextW,user32.dll,"00:37:24.046",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp")33:T83c,"MicrosoftEdgeUpdate.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "ENABLEDHCP"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")34:Tb1d,"MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00002636-00000C17-1241782912 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3" at 00000000-00002636-00000C17-1266819039 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\Program Files (x86)\Microsoft\EdgeUpdate\Offline" at 00000000-00002636-00000C17-1267088405 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00006444-00000C17-1244337075 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00006072-00000C17-1249430499 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00006072-00000C17-1255544335 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00006072-00000C17-1260929219 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00006072-00000C17-1266414066 "MicrosoftEdgeUpdateComRegisterShell64.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00007124-00000C17-1250008495 "MicrosoftEdgeUpdateComRegisterShell64.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00002004-00000C17-1256138546 "MicrosoftEdgeUpdateComRegisterShell64.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00001148-00000C17-1261495290 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00007188-00000C17-1269235171 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00005256-00000C17-1269877287 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00005256-00000C17-1272500047 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00007376-00000C17-1271758778 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2C5E8545-77C5-41DE-896B-7EA8CF456EE4}" at 00000000-00007376-00000C17-1272582708 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00008076-00000C17-127498357935:Ta8f,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYNAME") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "PUBLISHER") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "PUBLISHER") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "PUBLISHER") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "PUBLISHER") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "PUBLISHER")36:T5cf,"MicrosoftEdgeUpdate.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESLASTSYNCTIME") "MicrosoftEdgeUpdate.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESENCODEDCTL") "MicrosoftEdgeUpdate.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "MicrosoftEdgeUpdate.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "MicrosoftEdgeUpdate.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "MicrosoftEdgeUpdate.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "MicrosoftEdgeUpdate.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "MicrosoftEdgeUpdate.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "MicrosoftEdgeUpdate.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "MicrosoftEdgeUpdate.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "MicrosoftEdgeUpdate.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB")37:T670,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "CreateDirectoryW" with parameter %TEMP%\nse29AC.tmp (UID: 00000000-00000064) "MicrosoftEdgeWebview2Setup.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Microsoft (UID: 00000000-00001892) "MicrosoftEdgeWebview2Setup.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Microsoft\Temp (UID: 00000000-00001892) "MicrosoftEdgeWebview2Setup.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp (UID: 00000000-00001892) "MicrosoftEdgeUpdate.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21 (UID: 00000000-00002636)38:T661,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "CreateProcessW" with parameter "%TEMP%\MicrosoftEdgeWebview2Setup.exe /silent /install" - (UID: 00000000-00000064) "MicrosoftEdgeWebview2Setup.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3" - (UID: 00000000-00001892), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc" - (UID: 00000000-00002636), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver" - (UID: 00000000-00002636), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cm" - (UID: 00000000-00002636), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&app" - (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateComRegisterShell64.exe"" - (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cm" - (UID: 00000000-00007376)39:T5d7a,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %TEMP%\nse29AC.tmp\System.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %TEMP%\nse29AC.tmp\nsDialogs.dll (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "LoadLibrary" with a parameter %TEMP%\nse29AC.tmp\NSISdl.dll (UID: 00000000-00000064) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001892) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001892) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001892) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001892) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001892) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdate.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_en.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntdll.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wldp.dll (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_en.dll (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006444) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\psmachine.dll (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006072) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006072) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00007124) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00007124) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007124) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007124) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\psmachine_64.dll (UID: 00000000-00007124) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00007124) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007124) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00002004) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00002004) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002004) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002004) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\psmachine_64.dll (UID: 00000000-00002004) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002004) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002004) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter Iphlpapi.dll (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\winhttp (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_en.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter atlthunk.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntdll.dll (UID: 00000000-00005256) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdateres_en.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntdll.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wldp.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wtsapi32.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter slwga.dll (UID: 00000000-00007376) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wtsapi32.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter Iphlpapi.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\winhttp (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00008076) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00008076)3a:T15d82,Found reference to API (Indicator: "RegEnumValueW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "RegEnumKeyW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "RegCloseKey"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SHFileOperationW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "IIDFromString"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "OleUninitialize"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "OleInitialize"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "FillRect"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetClientRect"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "BeginPaint"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "InvalidateRect"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "EnableWindow"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "ReleaseDC"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetDC"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "LoadImageW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "IsWindow"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "wsprintfW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "ShowWindow"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SetTimer"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "DestroyWindow"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CharNextW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "RegisterClassW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "ScreenToClient"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetWindowRect"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SetWindowPos"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetSysColor"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SetCursor"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "LoadCursorW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CloseClipboard"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SetClipboardData"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "OpenClipboard"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "AppendMenuW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CharPrevW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CharNextA"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "wsprintfA"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "PeekMessageW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SelectObject"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "DeleteObject"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "MulDiv"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "DeleteFileW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "FindNextFileW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "FindClose"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SetFilePointer"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "ReadFile"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "lstrlenA"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "FreeLibrary"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GlobalFree"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "lstrcmpW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CloseHandle"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SetFileTime"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CompareFileTime"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SearchPathW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "MoveFileW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "Sleep"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetTickCount"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CreateFileW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetFileSize"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetLastError"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "ExitProcess"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CopyFileW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetTempPathW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetVersionExW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SetErrorMode"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "lstrlenW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "lstrcpynW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GlobalLock"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CreateThread"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "CreateProcessW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "WriteFile"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "lstrcpyA"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "MoveFileExW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "lstrcatW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetProcAddress"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API (Indicator: "lstrcpyW"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "LoadIconW"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "MoveWindow"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextW"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "SetWindowTextA"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "CharPrevA"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetFocus"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "lstrcpynA"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "lstrcatA"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "KillTimer"; File: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00001892.00000000.144050.00EF1000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00001892.00000000.144050.00EF1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00001892.00000000.144050.00EF1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00001892.00000000.144050.00EF1000.00000020.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00001892.00000000.144050.00EF1000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringEx"; File: "00000000-00001892.00000000.144050.00EF1000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "00000000-00001892.00000000.144050.00EF1000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; File: "00000000-00001892.00000000.144050.00EF1000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00001892.00000000.144050.00EF1000.00000020.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; File: "00000000-00001892.00000000.144050.00EF1000.00000020.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "00000000-00001892.00000000.144050.00EF1000.00000020.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "00000000-00001892.00000000.144050.00EF1000.00000020.mdmp") Found reference to API (Indicator: "SetProcessMitigationPolicy"; File: "00000000-00002636.00000002.148032.011E1000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "MapDialogRect"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "CharPrevW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "DrawFocusRect"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "MapWindowPoints"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.735F1000.00000020.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00000064.00000000.143538.033D0000.00000004.mdmp, 00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00000064.00000000.143538.033D0000.00000004.mdmp, 00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "AppendMenuW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "SetSystemFileCacheSize"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemRealloc"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "StringFromCLSID"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "OpenMutexW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "InitOnceBeginInitialize"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "InitOnceComplete"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetThreadDesktop"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "EqualRect"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "IntersectRect"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "SetWinEventHook"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "IsRectEmpty"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetMessageTime"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "NdrOleFree"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "NdrOleAllocate"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "NdrStubCall2"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPopEntrySList"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "SHCreateStreamOnFileEx"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "StrCmpIW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "PathAppendW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "InitializeSid"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetSidLengthRequired"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp")3b:T445,Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp")3c:Tfc1,"Software\Microsoft\Windows\CurrentVersion" in Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe "SOFTWARE\Microsoft\EdgeUpdate" in Source: 58013-523-00EF41CD "Software\OEM\MicrosoftEdge" in Source: 58013-523-00EF41CD "Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 59209-473-011E9A36 "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp 00000000-00000064.00000002.147378.03468000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp 00000000-00000064.00000002.147378.03468000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp 00000000-00000064.00000001.145460.033D0000.00000004.mdmp 00000000-00000064.00000002.147378.033D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp 00000000-00000064.00000001.145460.033D0000.00000004.mdmp 00000000-00000064.00000002.147378.033D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Posline" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp 00000000-00000064.00000001.145460.033D0000.00000004.mdmp 00000000-00000064.00000002.147378.033D0000.00000004.mdmp "Software\softias\Posline" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp 00000000-00000064.00000001.145460.033D0000.00000004.mdmp 00000000-00000064.00000002.147378.033D0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp 00000000-00000064.00000001.145460.033D0000.00000004.mdmp 00000000-00000064.00000002.147378.033D0000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp 00000000-00000064.00000001.145460.033D0000.00000004.mdmp 00000000-00000064.00000002.147378.033D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00000064.00000001.145460.00408000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00000064.00000001.145460.0040A000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00000064.00000001.145460.735F1000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00000064.00000001.145460.735F1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00000064.00000001.145460.735F1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00000064.00000001.145460.735F1000.00000020.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000064.00000002.147378.03468000.00000004.mdmp "Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp "sWinPEHost: Cannot open reg key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNT. Assuming the host is NOT WinPE. RegOpenKeyExW err" in Source: 00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp "Y\MACHINE\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp "Software\OEM\MicrosoftEdge" in Source: 00000000-00001892.00000000.144050.00F0C000.00000002.mdmp "SOFTWARE\Microsoft\EdgeUpdate" in Source: 00000000-00001892.00000000.144050.00F0C000.00000002.mdmp3d:Tbfa,Process 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:64:168:WilStaging_02" Process 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:64:168:WilStaging_02" Process 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:64:64:WilError_01" Process 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe created mutex with name "Local\SM0:64:168:WilStaging_02" Process 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe created mutex with name "SM0:64:168:WilStaging_02" Process 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe created mutex with name "SM0:64:64:WilError_01" Process MicrosoftEdgeWebview2Setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1892:168:WilStaging_02" Process MicrosoftEdgeWebview2Setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1892:168:WilStaging_02" Process MicrosoftEdgeWebview2Setup.exe created mutex with name "Local\SM0:1892:168:WilStaging_02" Process MicrosoftEdgeWebview2Setup.exe created mutex with name "SM0:1892:168:WilStaging_02" Process MicrosoftEdgeUpdate.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2636:168:WilStaging_02" Process MicrosoftEdgeUpdate.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2636:168:WilStaging_02" Process MicrosoftEdgeUpdate.exe created mutex with name "\Sessions\1\BaseNamedObjects\_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log" Process MicrosoftEdgeUpdate.exe created mutex with name "\BaseNamedObjects\EdgeUpdate{F340B839-380B-4AA9-BA6F-B83F23E2DD05}" Process MicrosoftEdgeUpdate.exe created mutex with name "\BaseNamedObjects\EdgeUpdate{DDDDEAEB-04CC-4BAA-9C63-CCA5FE38F688}" Process MicrosoftEdgeUpdate.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2636:64:WilError_01" Process MicrosoftEdgeUpdate.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process MicrosoftEdgeUpdate.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2636:64:WilError_01" Process MicrosoftEdgeUpdate.exe created mutex with name "Local\SM0:2636:168:WilStaging_02" Process MicrosoftEdgeUpdate.exe created mutex with name "SM0:2636:64:WilError_01" Process MicrosoftEdgeUpdate.exe created mutex with name "Local\SM0:2636:64:WilError_01" Process MicrosoftEdgeUpdate.exe created mutex with name "_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log" Process MicrosoftEdgeUpdate.exe created mutex with name "SM0:2636:168:WilStaging_02" Process MicrosoftEdgeUpdate.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6444:168:WilStaging_02" Process MicrosoftEdgeUpdate.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6444:168:WilStaging_02"3e:Tb91,Antivirus vendors marked dropped file "msedgeupdate.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "Muca.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "psuser_64.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "psmachine_64.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "psmachine_arm64.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"), Antivirus vendors marked dropped file "psuser_arm64.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"), Antivirus vendors marked dropped file "psuser.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "psmachine.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateCore.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateComRegisterShell64.exe" as clean (type is "PE32+ executable for MS Windows 5.02 (GUI) x86-64 8 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdate.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeComRegisterShellARM64.exe" as clean (type is "PE32+ executable for MS Windows 10.00 (GUI) ARM64 7 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateOnDemand.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateBroker.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "msedgeupdateres_de.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "msedgeupdateres_el.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "msedgeupdateres_ml.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "msedgeupdateres_lb.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "msedgeupdateres_it.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeWebview2Setup.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections")3f:T108e,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "msedgeupdate.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "MicrosoftEdgeUpdateSetup.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Muca.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psuser_64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psmachine_64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psmachine_arm64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psuser_arm64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psuser.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psmachine.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "MicrosoftEdgeUpdateCore.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeUpdateComRegisterShell64.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeUpdate.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeComRegisterShellARM64.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeUpdateOnDemand.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeUpdateBroker.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "msedgeupdateres_de.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF "msedgeupdateres_el.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF "msedgeupdateres_ml.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF "msedgeupdateres_lb.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF "msedgeupdateres_it.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF "msedgeupdateres_ca.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF40:T9551,"stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Posline" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp "Software\softias\Posline" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00000064.00000001.145460.00408000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00000064.00000001.145460.0040A000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000064.00000001.145460.033D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00000064.00000001.145460.033D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Posline" in Source: 00000000-00000064.00000001.145460.033D0000.00000004.mdmp "Software\softias\Posline" in Source: 00000000-00000064.00000001.145460.033D0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00000064.00000001.145460.033D0000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00000064.00000001.145460.033D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00000064.00000001.145460.735F1000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00000064.00000001.145460.735F1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00000064.00000001.145460.735F1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00000064.00000001.145460.735F1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000064.00000002.147378.033D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00000064.00000002.147378.033D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Posline" in Source: 00000000-00000064.00000002.147378.033D0000.00000004.mdmp "Software\softias\Posline" in Source: 00000000-00000064.00000002.147378.033D0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00000064.00000002.147378.033D0000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00000064.00000002.147378.033D0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000064.00000002.147378.03468000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000064.00000002.147378.03468000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000064.00000002.147378.03468000.00000004.mdmp "Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp "sWinPEHost: Cannot open reg key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNT. Assuming the host is NOT WinPE. RegOpenKeyExW err" in Source: 00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp "Y\MACHINE\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate" in Source: 00000000-00001892.00000000.144050.00F0C000.00000002.mdmp "Software\OEM\MicrosoftEdge" in Source: 00000000-00001892.00000000.144050.00F0C000.00000002.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001892.00000001.145971.00A20000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001892.00000002.147888.00A20000.00000004.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00002004.00000000.145175.44E38000.00000002.mdmp "SOFTWARE\Microsoft\Office\OfficeHub" in Source: 00000000-00002004.00000000.145175.44E38000.00000002.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: 00000000-00002004.00000000.145175.44E38000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00002004.00000000.145175.44E38000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" in Source: 00000000-00002004.00000000.145175.44E38000.00000002.mdmp "Software\Classes" in Source: 00000000-00002004.00000000.145175.44E38000.00000002.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00002004.00000000.145175.44E38000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepository\Packages" in Source: 00000000-00002004.00000000.145175.44E38000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" in Source: 00000000-00002004.00000000.145175.44E38000.00000002.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00002004.00000000.145175.88D00000.00000004.mdmp "HHKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00002004.00000000.145175.88D00000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00002004.00000000.145175.88D00000.00000004.mdmp "Y\MACHINE\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00002004.00000000.145175.88D00000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002636.00000000.144193.00FC0000.00000004.mdmp "Software\Microsoft\" in Source: 00000000-00002636.00000000.144193.00FC0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00002636.00000000.144193.00FC0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00002636.00000000.144193.00FC0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00002636.00000000.144193.00FC0000.00000004.mdmp "HKLM\Software\Microsoft\" in Source: 00000000-00002636.00000000.144193.00FC0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002636.00000000.144193.00FC0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002636.00000000.144193.00FC0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00002636.00000000.144193.00FC0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00002636.00000000.144193.00FC0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002636.00000000.144193.00FC0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002636.00000000.144193.00FC0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002636.00000000.144193.00FC0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002636.00000001.146114.00FC0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00002636.00000001.146114.00FC0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002636.00000001.146114.00FC0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002636.00000001.146114.00FC0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\PersistedPings\{A5E894FB-5768-4BEE-BBDF-127A0AE3C8A5}" in Source: 00000000-00002636.00000001.146114.00FC0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002636.00000001.146114.00FC0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00002636.00000001.146114.00FC0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients" in Source: 00000000-00002636.00000001.146114.00FC0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002636.00000001.146114.00FC0000.00000004.mdmp "stry\Machine\Software\Classes\Applications\MicrosoftEdgeUpdate.exe" in Source: 00000000-00002636.00000001.146114.00FC0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002636.00000002.148032.00FC0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00002636.00000002.148032.00FC0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002636.00000002.148032.00FC0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002636.00000002.148032.00FC0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\PersistedPings\{A5E894FB-5768-4BEE-BBDF-127A0AE3C8A5}" in Source: 00000000-00002636.00000002.148032.00FC0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002636.00000002.148032.00FC0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00002636.00000002.148032.00FC0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients" in Source: 00000000-00002636.00000002.148032.00FC0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002636.00000002.148032.00FC0000.00000004.mdmp "stry\Machine\Software\Classes\Applications\MicrosoftEdgeUpdate.exe" in Source: 00000000-00002636.00000002.148032.00FC0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00002636.00000002.148032.011E1000.00000020.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B31118B2-1F49-48E5-B6F" in Source: 00000000-00005256.00000000.145967.03070000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005256.00000000.145967.03070000.00000004.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005256.00000000.145967.03070000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00005256.00000000.145967.03070000.00000004.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00005256.00000000.145967.03070000.00000004.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005256.00000000.145967.03070000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005256.00000001.147884.008B1000.00000020.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B31118B2-1F49-48E5-B6F" in Source: 00000000-00005256.00000001.147884.03070000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005256.00000001.147884.03070000.00000004.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00005256.00000001.147884.03070000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00005256.00000001.147884.03070000.00000004.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005256.00000001.147884.03070000.00000004.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00005256.00000001.147884.721F6000.00000002.mdmp "SOFTWARE\Microsoft\Office\OfficeHub" in Source: 00000000-00005256.00000001.147884.721F6000.00000002.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: 00000000-00005256.00000001.147884.721F6000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" in Source: 00000000-00005256.00000001.147884.721F6000.00000002.mdmp "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005256.00000001.147884.721F6000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00005256.00000001.147884.721F6000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005256.00000001.147884.721F6000.00000002.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005256.00000001.147884.721F6000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005256.00000001.147884.721F6000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005256.00000001.147884.721F6000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" in Source: 00000000-00005256.00000001.147884.721F6000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepository\Packages" in Source: 00000000-00005256.00000001.147884.721F6000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00005256.00000001.147884.721F6000.00000002.mdmp "stry\Machine\Software\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}" in Source: 00000000-00005256.00000002.149805.03070000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B31118B2-1F49-48E5-B6F" in Source: 00000000-00005256.00000002.149805.03070000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005256.00000002.149805.03070000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00005256.00000002.149805.03070000.00000004.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00005256.00000002.149805.03070000.00000004.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005256.00000002.149805.03070000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "SOFTWARE\Microsoft\Office\OfficeHub" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "KCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "Software\Microsoft\%ws\UsageStats\Daily" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKU\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Setup\State" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "KLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "Software\Microsoft\EdgeUpdate\DownloaderLockout" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\CdpNames\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\AdditionalInstallArgs\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "Software\Classes" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepository\Packages" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Google\Update" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Google\Update\Clients\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Google\Update\ClientState\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\%s" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "Software\Microsoft\EdgeUpdate\proxy" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKCR\http\shell\open\command" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKCR\Applications\FIREFOX.EXE\shell\open\command" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKCU\SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKCR\Applications\chrome.exe\shell\open\command" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Policies\Microsoft\Edge\WebView2\DowngradeVersion" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "\SOFTWARE\Classes" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKCR\CLSID\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Microsoft\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKCU\Software\Microsoft\" in Source: 00000000-00006072.00000000.144687.732BF000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00006072.00000001.145564.02EDF000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00006072.00000001.145564.02EDF000.00000004.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00006072.00000001.145564.02EDF000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00006072.00000001.145564.02EDF000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00006072.00000001.145564.02EDF000.00000004.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00006072.00000001.145564.02EDF000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00006072.00000001.145564.02EDF000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00006444.00000000.144359.03560000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00006444.00000000.144359.03560000.00000004.mdmp "Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00007124.00000000.144779.28440000.00000004.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00007124.00000000.144779.28440000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007188.00000000.145911.03060000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00007188.00000000.145911.03060000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECF5BF46-E3B6-449A-B56" in Source: 00000000-00007188.00000000.145911.03060000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00007188.00000000.145911.060C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007188.00000001.146049.03060000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00007188.00000001.146049.030AA000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECF5BF46-E3B6-449A-B56" in Source: 00000000-00007188.00000001.146049.030AA000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00007188.00000001.146049.030FE000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007188.00000001.146049.030FE000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00007188.00000001.146049.030FE000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007188.00000001.146049.030FE000.00000004.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00007188.00000001.146049.03136000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007188.00000001.146049.03136000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007188.00000001.146049.03136000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007188.00000001.146049.03136000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007188.00000001.146049.03136000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00007188.00000001.146049.060C3000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007188.00000001.146049.060C3000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium" in Source: 00000000-00007188.00000001.146049.060C3000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00007188.00000001.146049.060C3000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007188.00000001.146049.060C3000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007188.00000001.146049.060C3000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState" in Source: 00000000-00007188.00000001.146049.060C3000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients" in Source: 00000000-00007188.00000001.146049.060C3000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007188.00000001.146049.060C3000.00000004.mdmp "REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\PersistedPings\{6ADC3954-E443-4917-BEE8-27CE73F4E5BB}" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "HKU\S-1-5-18\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B3B8D23-FA8D-40B9-8DB" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "HKU\S-1-5-21-735145574-3570218355-1207367261-1001\" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007376.00000000.146097.02A60000.00000004.mdmp "REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007376.00000001.148018.02A60000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState" in Source: 00000000-00007376.00000001.148018.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007376.00000001.148018.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState" in Source: 00000000-00007376.00000001.148018.02A60000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B3B8D23-FA8D-40B9-8DB" in Source: 00000000-00007376.00000001.148018.02A60000.00000004.mdmp "HKU\S-1-5-21-735145574-3570218355-1207367261-1001\" in Source: 00000000-00007376.00000001.148018.02A60000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007376.00000001.148018.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium" in Source: 00000000-00007376.00000001.148018.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00007376.00000001.148018.02A60000.00000004.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007376.00000001.148018.02A60000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007376.00000001.148018.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007376.00000001.148018.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState" in Source: 00000000-00007376.00000001.148018.02A60000.00000004.mdmp "REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007376.00000002.149939.02A60000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState" in Source: 00000000-00007376.00000002.149939.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007376.00000002.149939.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState" in Source: 00000000-00007376.00000002.149939.02A60000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B3B8D23-FA8D-40B9-8DB" in Source: 00000000-00007376.00000002.149939.02A60000.00000004.mdmp "HKU\S-1-5-21-735145574-3570218355-1207367261-1001\" in Source: 00000000-00007376.00000002.149939.02A60000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007376.00000002.149939.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium" in Source: 00000000-00007376.00000002.149939.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00007376.00000002.149939.02A60000.00000004.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007376.00000002.149939.02A60000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007376.00000002.149939.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007376.00000002.149939.02A60000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState" in Source: 00000000-00007376.00000002.149939.02A60000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00008076.00000000.146310.005A0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00008076.00000000.146310.005A0000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00008076.00000000.146310.005A0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECF5BF46-E3B6-449A-B56" in Source: 00000000-00008076.00000000.146310.005A0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\{8A69D345-D564-463c-AFF1-A69D9E530F96}" in Source: 00000000-00008076.00000000.146310.005A0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00008076.00000000.146310.005A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00008076.00000000.146310.044C0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00008076.00000001.148232.005A0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00008076.00000001.148232.005A0000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00008076.00000001.148232.005A0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECF5BF46-E3B6-449A-B56" in Source: 00000000-00008076.00000001.148232.005A0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\{8A69D345-D564-463c-AFF1-A69D9E530F96}" in Source: 00000000-00008076.00000001.148232.005A0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00008076.00000001.148232.005A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00008076.00000001.148232.044F9000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00008076.00000002.150149.005A0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00008076.00000002.150149.005A0000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00008076.00000002.150149.005A0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECF5BF46-E3B6-449A-B56" in Source: 00000000-00008076.00000002.150149.005A0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\{8A69D345-D564-463c-AFF1-A69D9E530F96}" in Source: 00000000-00008076.00000002.150149.005A0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00008076.00000002.150149.005A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00008076.00000002.150149.044F9000.00000004.mdmp41:T36cc,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f50000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ed0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 73ea0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 75370000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "NTDLL.DLL" at base 778f0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e00000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73c80000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73c50000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 74300000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 73bf0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 74d60000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 73bc0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73bb0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73ba0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "KERNEL32.DLL" at base 743b0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%TEMP%\NSE29AC.TMP\SYSTEM.DLL" at base 73b90000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 73b10000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "COMCTL32.DLL" at base 740e0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 74e20000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%TEMP%\NSE29AC.TMP\NSDIALOGS.DLL" at base 73aa0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74ae0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "OLEAUT32.DLL" at base 77230000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "RPCRT4.DLL" at base 774c0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74be0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74be0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 757a0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75ef0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 735f0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%TEMP%\NSE29AC.TMP\NSISDL.DLL" at base 735e0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73570000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 73550000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 73530000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 73510000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 73430000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 733e0000 "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 733b0000 "MicrosoftEdgeWebview2Setup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f50000 "MicrosoftEdgeWebview2Setup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f70000 "MicrosoftEdgeWebview2Setup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f70000 "MicrosoftEdgeWebview2Setup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f70000 "MicrosoftEdgeWebview2Setup.exe" loaded module "KERNEL32" at base 743b0000 "MicrosoftEdgeWebview2Setup.exe" loaded module "SHLWAPI.DLL" at base 75b60000 "MicrosoftEdgeWebview2Setup.exe" loaded module "KERNEL32.DLL" at base 743b0000 "MicrosoftEdgeWebview2Setup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ed0000 "MicrosoftEdgeWebview2Setup.exe" loaded module "NTDLL.DLL" at base 778f0000 "MicrosoftEdgeWebview2Setup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e00000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f50000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f70000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f70000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f70000 "MicrosoftEdgeUpdate.exe" loaded module "SHELL32.DLL" at base 75ef0000 "MicrosoftEdgeUpdate.exe" loaded module "KERNEL32" at base 743b0000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74f70000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74f70000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74f70000 "MicrosoftEdgeUpdate.exe" loaded module "SHLWAPI.DLL" at base 75b60000 "MicrosoftEdgeUpdate.exe" loaded module "KERNEL32.DLL" at base 743b0000 "MicrosoftEdgeUpdate.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\TEMP\EU4725.TMP\MSEDGEUPDATE.DLL" at base 73140000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 743b0000 "MicrosoftEdgeUpdate.exe" loaded module "ADVAPI32.DLL" at base 77440000 "MicrosoftEdgeUpdate.exe" loaded module "RPCRT4.DLL" at base 774c0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 73400000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 735d0000 "MicrosoftEdgeUpdate.exe" loaded module "NETAPI32.DLL" at base 735d0000 "MicrosoftEdgeUpdate.exe" loaded module "USER32.DLL" at base 74be0000 "MicrosoftEdgeUpdate.exe" loaded module "OLE32.DLL" at base 74ae0000 "MicrosoftEdgeUpdate.exe" loaded module "GDI32.DLL" at base 75ce0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\MSXML6.DLL" at base 72e40000 "MicrosoftEdgeUpdate.exe" loaded module "KERNELBASE.DLL" at base 74f70000 "MicrosoftEdgeUpdate.exe" loaded module "NTDLL.DLL" at base 778f0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e00000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 72db0000 "MicrosoftEdgeUpdate.exe" loaded module "OLEAUT32.DLL" at base 77230000 "MicrosoftEdgeUpdate.exe" loaded module "SSPICLI.DLL" at base 74310000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NTDLL.DLL" at base 778f0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WLDP.DLL" at base 73420000 "MicrosoftEdgeUpdate.exe" loaded module "COMCTL32.DLL" at base 740e0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ed0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 74e20000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73c80000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 743b0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72930000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75ef0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 744a0000 "MicrosoftEdgeUpdate.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEUPDATE\1.3.273.21\MSEDGEUPDATE.DLL" at base 73140000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74340000 "MicrosoftEdgeUpdate.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEUPDATE\1.3.273.21\PSMACHINE.DLL" at base 72d40000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff81b040000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 7ff833870000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 7ff841280000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "OLE32.DLL" at base 7ff84c6e0000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "USER32.DLL" at base 7ff84a2e0000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "RPCRT4.DLL" at base 7ff84c8f0000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff8490b0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 728f0000 "MicrosoftEdgeUpdate.exe" loaded module "IPHLPAPI.DLL" at base 73440000 "MicrosoftEdgeUpdate.exe" loaded module "WININET.DLL" at base 72640000 "MicrosoftEdgeUpdate.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72620000 "MicrosoftEdgeUpdate.exe" loaded module "WINHTTP.DLL" at base 72570000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72620000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 77440000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73570000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 72540000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 72530000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTP" at base 72570000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 733b0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72440000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 723d0000 "MicrosoftEdgeUpdate.exe" loaded module "MSISO.DLL" at base 72290000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 776a0000 "MicrosoftEdgeUpdate.exe" loaded module "MSKEYPROTECT.DLL" at base 72280000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 72260000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74a80000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72230000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 75bb0000 "MicrosoftEdgeUpdate.exe" loaded module "WS2_32.DLL" at base 776a0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 728d0000 "MicrosoftEdgeUpdate.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEUPDATE\1.3.273.21\PSMACHINE.DLL" at base 721c0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 72530000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 77230000 "MicrosoftEdgeUpdate.exe" loaded module "ATLTHUNK.DLL" at base 72560000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 72390000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WLDP.DLL" at base 72540000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WTSAPI32.DLL" at base 73560000 "MicrosoftEdgeUpdate.exe" loaded module "SLWGA.DLL" at base 72540000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WLDP.DLL" at base 72180000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 72510000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 72500000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72410000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 723a0000 "MicrosoftEdgeUpdate.exe" loaded module "MSKEYPROTECT.DLL" at base 72340000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 722d0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 722a0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 72640000 "MicrosoftEdgeUpdate.exe" loaded module "MSISO.DLL" at base 72140000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 72240000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 72240000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75d60000 "MicrosoftEdgeUpdate.exe" loaded module "CRYPTNET.DLL" at base 7224000042:T1010,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" was detected as "Microsoft Linker" and name: "Linker" "msedgeupdate.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "msedgeupdate.dll" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdateSetup.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MicrosoftEdgeUpdateSetup.exe" was detected as "Microsoft Linker" and name: "Linker" "Muca.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Muca.dll" was detected as "Microsoft Linker" and name: "Linker" "psuser_64.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "psuser_64.dll" was detected as "Microsoft Linker" and name: "Linker" "psmachine_64.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "psmachine_64.dll" was detected as "Microsoft Linker" and name: "Linker" "psmachine_arm64.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "psmachine_arm64.dll" was detected as "Microsoft Linker" and name: "Linker" "psuser_arm64.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "psuser_arm64.dll" was detected as "Microsoft Linker" and name: "Linker" "psuser.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "psuser.dll" was detected as "Microsoft Linker" and name: "Linker" "psmachine.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "psmachine.dll" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdateCore.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MicrosoftEdgeUpdateCore.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdateComRegisterShell64.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MicrosoftEdgeUpdateComRegisterShell64.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdate.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MicrosoftEdgeUpdate.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeComRegisterShellARM64.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MicrosoftEdgeComRegisterShellARM64.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdateOnDemand.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MicrosoftEdgeUpdateOnDemand.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdateBroker.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MicrosoftEdgeUpdateBroker.exe" was detected as "Microsoft Linker" and name: "Linker" "msedgeupdateres_de.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "msedgeupdateres_de.dll" was detected as "Microsoft Linker" and name: "Linker" "msedgeupdateres_el.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "msedgeupdateres_el.dll" was detected as "Microsoft Linker" and name: "Linker" "msedgeupdateres_ml.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "msedgeupdateres_ml.dll" was detected as "Microsoft Linker" and name: "Linker" "msedgeupdateres_lb.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "msedgeupdateres_lb.dll" was detected as "Microsoft Linker" and name: "Linker" "msedgeupdateres_it.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "msedgeupdateres_it.dll" was detected as "Microsoft Linker" and name: "Linker" "msedgeupdateres_ca.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "msedgeupdateres_ca.dll" was detected as "Microsoft Linker" and name: "Linker"43:Tabe,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "XML DOM Document 6.0" (Path: "HKCU\WOW6432NODE\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "MicrosoftEdgeUpdate.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "NetworkListManager" (Path: "HKCU\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "MicrosoftEdgeUpdate.exe" touched "Network List Manager" (Path: "HKCU\WOW6432NODE\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "Wininet Cache task object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0358B920-0AC7-461F-98F4-58E32CD89148}\TREATAS")44:T4c0,Process "MicrosoftEdgeWebview2Setup.exe" (UID: 00000000-00001892) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "MicrosoftEdgeWebview2Setup.exe" (UID: 00000000-00001892) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "MicrosoftEdgeUpdate.exe" (UID: 00000000-00007376) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles, NUMBER_OF_PROCESSORS" Process "MicrosoftEdgeUpdate.exe" (UID: 00000000-00007376) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, USERDNSDOMAIN, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE" Process "MicrosoftEdgeUpdate.exe" (UID: 00000000-00008076) was launched with new environment variables: "USERDNSDOMAIN="WORKGROUP", PROCESSOR_ARCHITEW6432="AMD64"" Process "MicrosoftEdgeUpdate.exe" (UID: 00000000-00008076) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS"45:T60f,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "MicrosoftEdgeWebview2Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "MicrosoftEdgeWebview2Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "MicrosoftEdgeWebview2Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "MicrosoftEdgeUpdate.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "MicrosoftEdgeUpdate.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "MicrosoftEdgeUpdate.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "MicrosoftEdgeUpdate.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "MicrosoftEdgeUpdateComRegisterShell64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "MicrosoftEdgeUpdateComRegisterShell64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")46:T890,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00000064-00000C2B-1230786007] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00000064-00000C2B-1230799617] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00000064-00000C2B-1230822162] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00000064-00000C2B-1230928485] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00000064-00000C2B-1230946516] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00000064-00000C2B-1230961745] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00000064-00000C2B-1230972554] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00000064-00000C2B-1230988141] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00000064-00000C2B-1231000828] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00000064-00000C2B-1231016642] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00000064-00000C2B-1231029046] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00000064-00000C2B-1231042414] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00000064-00000C2B-1231290627] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00002636-00000C2B-1241442346] Observed system executable string:"%WINDIR%\system32\MDMRegistration.dll" [Source: 00000000-00002636-00000C2B-1241557428] Observed system executable string:"%WINDIR%\system32\NetApi32.dll" [Source: 00000000-00002636-00000C2B-1241679710] Observed system executable string:"%WINDIR%\system32\ntdll.dll" [Source: 00000000-00002636-00000C2B-1266786893] Observed system executable string:"%WINDIR%\system32\wldp.dll" [Source: 00000000-00002636-00000C2B-1267144306] Observed system executable string:"%WINDIR%\system32\wtsapi32.dll" [Source: 00000000-00007376-00000C2B-1273001520]47:T4fc,Spawned process "MicrosoftEdgeWebview2Setup.exe" with commandline "/silent /install" (UID: 00000000-00001892) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} ..." (UID: 00000000-00002636), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regsvc" (UID: 00000000-00006444), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regserver" (UID: 00000000-00006072), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00007124), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00002004), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00001148), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00007188), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname ..." (UID: 00000000-00005256) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/svc" (UID: 00000000-00007376) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00008076)48:T4fc,Spawned process "MicrosoftEdgeWebview2Setup.exe" with commandline "/silent /install" (UID: 00000000-00001892) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} ..." (UID: 00000000-00002636), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regsvc" (UID: 00000000-00006444), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regserver" (UID: 00000000-00006072), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00007124), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00002004), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00001148), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00007188), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname ..." (UID: 00000000-00005256) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/svc" (UID: 00000000-00007376) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00008076)49:T5bf,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdate.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdateSetup.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Muca.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "psuser.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "psmachine.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdateCore.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdate.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdateOnDemand.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdateBroker.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_de.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_el.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_ml.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_lb.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_it.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_ca.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE4a:T6da,"MicrosoftEdgeUpdate.exe" create file "C:\Windows\SysWOW64\config\systemprofile" "MicrosoftEdgeUpdate.exe" create file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local" "MicrosoftEdgeUpdate.exe" create file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache" "MicrosoftEdgeUpdate.exe" create file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies" "MicrosoftEdgeUpdate.exe" create file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History" "MicrosoftEdgeUpdate.exe" create file "C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7A19A3F6AFF08A3C532EF8C78F47948C" "MicrosoftEdgeUpdate.exe" create file "C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7A19A3F6AFF08A3C532EF8C78F47948C" "MicrosoftEdgeUpdate.exe" create file "%WINDIR%\SysWOW64\config\systemprofile" "MicrosoftEdgeUpdate.exe" create file "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local" "MicrosoftEdgeUpdate.exe" create file "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache" "MicrosoftEdgeUpdate.exe" create file "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies" "MicrosoftEdgeUpdate.exe" create file "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History" "MicrosoftEdgeUpdate.exe" create file "%WINDIR%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7A19A3F6AFF08A3C532EF8C78F47948C" "MicrosoftEdgeUpdate.exe" create file "%WINDIR%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7A19A3F6AFF08A3C532EF8C78F47948C"4b:T5fa2,"msedgeupdate.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdate.dll]- [targetUID: 00000000-00007188] "MicrosoftEdgeUpdateSetup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateSetup.exe]- [targetUID: 00000000-00002636] "Muca.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\Muca.dll]- [targetUID: 00000000-00002636] "psuser_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psuser_64.dll]- [targetUID: 00000000-00002636] "psmachine_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psmachine_64.dll]- [targetUID: 00000000-00001148] "psmachine_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psmachine_arm64.dll]- [targetUID: 00000000-00002636] "psuser_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psuser_arm64.dll]- [targetUID: 00000000-00002636] "psuser.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psuser.dll]- [targetUID: 00000000-00002636] "psmachine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psmachine.dll]- [targetUID: 00000000-00002636] "MicrosoftEdgeUpdateCore.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateCore.exe]- [targetUID: 00000000-00002636] "MicrosoftEdgeUpdateComRegisterShell64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe]- [targetUID: 00000000-00002636] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00007188] "MicrosoftEdgeComRegisterShellARM64.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) ARM64 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeComRegisterShellARM64.exe]- [targetUID: 00000000-00002636] "MicrosoftEdgeUpdateOnDemand.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateOnDemand.exe]- [targetUID: 00000000-00002636] "MicrosoftEdgeUpdateBroker.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateBroker.exe]- [targetUID: 00000000-00002636] "msedgeupdateres_de.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_de.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_el.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_el.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ml.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ml.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_lb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_lb.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_it.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_it.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ca.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ca.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_fr-CA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fr-CA.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_gd.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_gd.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_fr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fr.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_pl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_pl.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ca-Es-VALENCIA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ca-Es-VALENCIA.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_nl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_nl.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ka.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ka.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_kn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_kn.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_bn-IN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bn-IN.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_mk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_mk.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sr-Cyrl-BA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sr-Cyrl-BA.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ro.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ro.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_bg.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bg.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_bn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bn.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_or.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_or.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_az.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_az.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_hu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_hu.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_fil.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fil.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_mt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_mt.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_hr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_hr.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_es-419.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_es-419.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_af.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_af.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sl.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sr.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_as.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_as.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_pa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_pa.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_pt-PT.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_pt-PT.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sv.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_eu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_eu.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_lv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_lv.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_nn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_nn.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_pt-BR.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_pt-BR.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_uk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_uk.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_gu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_gu.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ga.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ga.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_gl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_gl.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_bs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bs.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_hi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_hi.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ne.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ne.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ta.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ta.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_te.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_te.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_es.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_es.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sr-Cyrl-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sr-Cyrl-RS.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ur.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ur.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sr-Latn-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sr-Latn-RS.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_da.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_da.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sk.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_quz.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_quz.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_vi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_vi.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ms.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ms.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_cs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_cs.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_id.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_id.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_lt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_lt.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_fi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fi.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_is.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_is.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_cy.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_cy.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sq.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sq.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_mr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_mr.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_et.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_et.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ru.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ru.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_nb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_nb.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_tr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_tr.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_kk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_kk.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_mi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_mi.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_tt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_tt.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_kok.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_kok.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_th.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_th.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_fa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fa.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_lo.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_lo.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_en-GB.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_en-GB.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_en.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_en.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_km.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_km.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ug.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ug.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ar.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ar.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_iw.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_iw.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ja.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ja.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_am.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_am.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ko.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ko.dll]- [targetUID: 00000000-00002636] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe]- [targetUID: 00000000-00002636] "msedgeupdateres_zh-CN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_zh-CN.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_zh-TW.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_zh-TW.dll]- [targetUID: 00000000-00002636] "NSISdl.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nse29AC.tmp\NSISdl.dll]- [targetUID: 00000000-00000064] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nse29AC.tmp\System.dll]- [targetUID: 00000000-00000064] "nsDialogs.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nse29AC.tmp\nsDialogs.dll]- [targetUID: 00000000-00000064] "MicrosoftEdgeUpdate.log" has type "Unknown"- Location: [%ALLUSERSPROFILE%\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log]- [targetUID: 00000000-00007188] "nsp299C.tmp" has type "Unknown"- Location: [%TEMP%\nsp299C.tmp]- [targetUID: 00000000-00000064] "modern-wizard.bmp" has type "PC bitmap Windows 3.x format 164 x 314 x 4 image size 26376 resolution 2834 x 2834 px/m cbSize 26494 bits offset 118"- Location: [%TEMP%\nse29AC.tmp\modern-wizard.bmp]- [targetUID: 00000000-00000064] "7A19A3F6AFF08A3C532EF8C78F47948C" has type "Unknown"- Location: [%WINDIR%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7A19A3F6AFF08A3C532EF8C78F47948C]- [targetUID: 00000000-00008076] "7A19A3F6AFF08A3C532EF8C78F47948C" has type "Unknown"- Location: [%WINDIR%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7A19A3F6AFF08A3C532EF8C78F47948C]- [targetUID: 00000000-00008076] "af397ef28e484961ba48646a5d38cf54.db.ses" has type "Unknown"- Location: [%TEMP%\af397ef28e484961ba48646a5d38cf54.db.ses]- [targetUID: 00000000-00007188] "af397ef28e484961ba48646a5d38cf54.db.ses" has type "Unknown"- Location: [%WINDIR%\Temp\af397ef28e484961ba48646a5d38cf54.db.ses]- [targetUID: 00000000-00007188] "MicrosoftEdgeWebview2Setup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%TEMP%\MicrosoftEdgeWebview2Setup.exe]- [targetUID: 00000000-00000064] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00007188] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\CopilotUpdate.exe]- [targetUID: 00000000-00002636]4c:T71b,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT"; Key: ""; Value: "")4d:T14bd,"msedgeupdate.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdate.dll]- [targetUID: 00000000-00007188] "Muca.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\Muca.dll]- [targetUID: 00000000-00002636] "psuser_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psuser_64.dll]- [targetUID: 00000000-00002636] "psmachine_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psmachine_64.dll]- [targetUID: 00000000-00001148] "psmachine_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psmachine_arm64.dll]- [targetUID: 00000000-00002636] "psuser_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psuser_arm64.dll]- [targetUID: 00000000-00002636] "psuser.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psuser.dll]- [targetUID: 00000000-00002636] "psmachine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psmachine.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_de.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_de.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_el.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_el.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ml.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ml.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_lb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_lb.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_it.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_it.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ca.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ca.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_fr-CA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fr-CA.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_gd.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_gd.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_fr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fr.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_pl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_pl.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ca-Es-VALENCIA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ca-Es-VALENCIA.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_nl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_nl.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ka.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ka.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_kn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_kn.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_bn-IN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bn-IN.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_mk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_mk.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sr-Cyrl-BA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sr-Cyrl-BA.dll]- [targetUID: 00000000-00002636]4e:T668,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" queries basic process information of the "C:\429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (UID: 64) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" (UID: 64) "MicrosoftEdgeWebview2Setup.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdate.exe" (UID: 1892) "MicrosoftEdgeUpdate.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (UID: 2636) "MicrosoftEdgeUpdate.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdate.exe" (UID: 2636) "MicrosoftEdgeUpdate.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 6072) "MicrosoftEdgeUpdateComRegisterShell64.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 7124) "MicrosoftEdgeUpdateComRegisterShell64.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 2004) "MicrosoftEdgeUpdateComRegisterShell64.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 1148)4f:T1378,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "196A230F-7C17-4019-B2D9-71862D8F48C9"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "EBAD5978-C172-4AD7-A2FB-1DBD779684A5"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "4E887BED-1002-41E4-BA74-5AAF7C0EBC68"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BBBC81CF-E219-469C-A405-F820EE496194"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3333D2FC-3AEE-479F-985D-8BEBAE552B99"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "888489F6-5DDE-47B8-8506-E5BBC40E81D1"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "444290F4-897E-4602-8CE9-6FDAA3E4F26F"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "0021D6B4-2084-4354-937B-937B604D7051"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3ADB16EA-848E-44DD-A424-51D82D573E04"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "76EDBA48-6A13-45B3-A291-2CF072F615D3"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "6689DB7D-49B8-4772-8E6E-142015E0D1EB"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F31F7F37-EDE0-44CE-AB10-EB1D44E781BF"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "0400AB69-E680-4E7F-BE61-43EBA565D8C0"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "0F8D6C73-6BD5-45AF-8F1F-19070A40439C"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8611FED5-D9D3-47F9-B095-3645BA4EEAF6"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "53E66965-FCFD-4CDA-A520-34FA34599A7F"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "86F30092-E00A-4BBA-8789-66450E720BEB"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F883EB01-AE8F-486B-82A0-077DF8F6101D"; Value: "")50:T40b,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: The input sample contains the RDTSCP instruction Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to query volume size51:T6eb,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to touch file "C:\429C792A9586CE9B77EA659D11C402D38307F89DCC42DD75DDA2EAFF68AE8510.EXE.LOCAL" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to touch file "C:\429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe.Local\" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\COMCTL32.dll" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to touch file "\Device\CNG" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to touch file "\Device\DeviceApi\CMApi" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to touch file "C:\WINDOWS\SysWOW64\kernelbase.dll" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to touch file "C:\WINDOWS\SysWOW64\IMM32.DLL"52:Tb4e,"MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdate.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\CopilotUpdate.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdate.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\Muca.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateBroker.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateOnDemand.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeComRegisterShellARM64.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\psmachine.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\psmachine_64.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\psmachine_arm64.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\psuser.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\psuser_64.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\psuser_arm64.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\NOTICE.TXT" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\EdgeUpdate.dat" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateCore.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_am.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ar.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bg.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bn.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ca.dll"53:T8c9,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "MicrosoftEdgeUpdate.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "MicrosoftEdgeUpdate.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "MicrosoftEdgeUpdate.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "MicrosoftEdgeUpdate.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "MicrosoftEdgeUpdate.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "MicrosoftEdgeUpdate.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "MicrosoftEdgeUpdate.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "MicrosoftEdgeUpdate.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "MicrosoftEdgeUpdate.exe" touched file "C:\Windows\Temp\af397ef28e484961ba48646a5d38cf54.db.ses" "MicrosoftEdgeUpdate.exe" touched file "C:\Windows\SysWOW64\config\systemprofile" "MicrosoftEdgeUpdate.exe" touched file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local" "MicrosoftEdgeUpdate.exe" touched file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache" "MicrosoftEdgeUpdate.exe" touched file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies" "MicrosoftEdgeUpdate.exe" touched file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History" "MicrosoftEdgeUpdate.exe" touched file "C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7A19A3F6AFF08A3C532EF8C78F47948C" "MicrosoftEdgeUpdate.exe" touched file "C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7A19A3F6AFF08A3C532EF8C78F47948C" "MicrosoftEdgeUpdate.exe" touched file "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache" "MicrosoftEdgeUpdate.exe" touched file "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies"54:Tc33,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\FLTLIB.DLL" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\MSVCP140.DLL" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\MSVCP140.dll" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp\SYSTEM.DLL" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp\System.dll" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp\NSDIALOGS.DLL" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp\nsDialogs.dll" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp\NSISDL.DLL" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp\NSISdl.dll" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp\WSOCK32.DLL" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp\WSOCK32.dll" "MicrosoftEdgeWebview2Setup.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "MicrosoftEdgeWebview2Setup.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "MicrosoftEdgeWebview2Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\FLTLIB.DLL" "MicrosoftEdgeWebview2Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MSVCP140.DLL"55:T441,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\429C792A9586CE9B77EA659D11C402D38307F89DCC42DD75DDA2EAFF68AE8510.EXE.LOCAL" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe.Local\" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp\MODERN-WIZARD.BMP" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp\modern-wizard.bmp" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\POSLINE" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" trying to access non-existent file "\Device\RasAcd" "MicrosoftEdgeUpdate.exe" trying to access non-existent file "C:\MICROSOFTEDGEUPDATE.INI"56:T79a,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00007188-00000C2C-1270013740") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00007188-00000C2C-1270890382") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00007188-00000C2C-1270890545") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00007188-00000C2C-1270890564") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00007188-00000C2C-1270890564") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00007188-00000C2C-1270890564") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00007188-00000C2C-1270890631") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00007188-00000C2C-1270890677") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00007188-00000C2C-1270890720") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00007188-00000C2C-1270890720") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00007188-00000C2C-1271348770") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00007188-00000C2C-1271349698") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00007188-00000C2C-1271351065") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00007188-00000C2C-1272046553") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00007188-00000C2C-1272185251") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00007188-00000C2C-1272186439")57:T9b0,Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "b ;.gi" Heuristic match: "z*.hm" Heuristic match: "`+.de" Heuristic match: "]b+.ms" Heuristic match: "bhk8n.bo" Heuristic match: "kk.br" Heuristic match: "s.er" Pattern match: "http://nsis.sf.net/nsis_error" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0_gyu`=w8t&yf\v[~$anv,xmqmbvwashington1redmond1microsoft" Pattern match: "http://3rdpartysource.microsoft.com" Heuristic match: "config.edge.skype.com" Pattern match: "www.microsoft.com" Pattern match: "https://go.microsoft.com/fwlink/p/?linkid=2124703" Heuristic match: "g.microsoft.map.fastly.net" Heuristic match: "dp-f-ssl-nlu-net.trafficmanager.net" Pattern match: "https://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/e78b8ed2-851c-44ea-8502-ecdfd3c92217/microsoftedgewebview2setup.exe" Heuristic match: "e11290.dspg.akamaiedge.net" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "sets or retrieves which panel is currently active in the pen input panel.wf" Heuristic match: "specifies the stroke or collection of strokes to remove from the given collection of strokes.ws" Heuristic match: "provides the best tradeoff between save-time and storage for the typical application.ws" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Heuristic match: "2i&.sj" Heuristic match: "((.rs" Heuristic match: "3u_q<.gw" Heuristic match: "ze1.my" Heuristic match: "4wk.il"58:T11cd2,Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/p/?linkid=2124703download/silent" - Source: "00000000-00000064.00000000.143538.033D0000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found URL "http://location:content-length:bad" - Source: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/p/?linkid=2124703download/silent" - Source: "00000000-00000064.00000001.145460.033D0000.00000004.mdmp") Found URL "https://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/e78b8ed2-851c-44ea-8502-ecdfd3c92217/microsoftedgewebview2setup.exelmem@c\t4^c\t4/c\t4c\t409us" - Source: "00000000-00000064.00000001.145460.033D0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/p/?linkid=212470309usqss" - Source: "00000000-00000064.00000001.145460.033D0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/p/?linkid=2124703download/silent" - Source: "00000000-00000064.00000002.147378.033D0000.00000004.mdmp") Found URL "https://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/e78b8ed2-851c-44ea-8502-ecdfd3c92217/microsoftedgewebview2setup.exelmem@c\t4^c\t4/c\t4c\t409us" - Source: "00000000-00000064.00000002.147378.033D0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/p/?linkid=212470309usqss" - Source: "00000000-00000064.00000002.147378.033D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00000064.00000002.147378.03468000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0/]+w.dytbjh;9i*rq$.nv%wo" - Source: "00000000-00000064.00000002.147378.03468000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00001892.00000002.147888.009E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0_gyu" - Source: "00000000-00002636.00000002.148032.04EC0000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00002636.00000002.148032.04EC0000.00000002.mdmp") Found URL "https://www.microsoft.com" - Source: "00000000-00002636.00000002.148032.04EC0000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002636.00000002.148032.04EC0000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0::vm4" - Source: "00000000-00002636.00000002.148032.04EC0000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00002636.00000002.148032.04EC0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&https://go.microsoft.com/fwlink/?linkid=2111568&hklm\software\microsoft\windows" - Source: "00000000-00005256.00000000.145967.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&hl=&guver=1.3.273.21&m=1&os=10.0.16299.248&sp=&iid=&brand=&source=gethelp_windowsupdate0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000hl=&guver=1.3.273.21&m=1&os=10.0.16299.248&sp=&iid=&brand=&source=gethelp_windowsupdate" - Source: "00000000-00005256.00000000.145967.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&hl=&guver=1.3.273.21&m=1&os=10.0.16299.248&sp=&iid=&brand=&source=gethelp_windowsupdateofflinedirsessionidregisterproductpcserverregistereularequiredhealthchecksrfreejoininfo" - Source: "00000000-00005256.00000001.147884.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&hl=&guver=1.3.273.21&m=1&os=10.0.16299.248&sp=&iid=&brand=&source=gethelp_windowsupdate01:0:14c9:dc0e:28c8:1bad:bf83:f35db+ncalrpc:[ole031f01a21a04aeafdcff8d475055]t" - Source: "00000000-00005256.00000001.147884.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&hl=&guver=1.3.273.21&m=1&os=10.0.16299.248&sp=&iid=&brand=&source=gethelp_windowsupdate+ncalrpc:[ole031f01a21a04aeafdcff8d475055]t" - Source: "00000000-00005256.00000001.147884.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&https://go.microsoft.com/fwlink/?linkid=2111568&hklm\software\microsoft\windows" - Source: "00000000-00005256.00000001.147884.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&https://go.microsoft.com/fwlink/?linkid=2111568&https://go.microsoft.com/fwlink/?linkid=2111568&hklm\software\microsoft\windows" - Source: "00000000-00005256.00000001.147884.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&hklm\software\microsoft\windows" - Source: "00000000-00005256.00000001.147884.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&https://go.microsoft.com/fwlink/?linkid=2111568&lse]https://go.microsoft.com/fwlink/?linkid=2111568&https://go.microsoft.com/fwlink/?linkid=2111568&https://go.microsoft.com/fwlink/?linkid=2111568&hklm\software\microsoft\windows" - Source: "00000000-00005256.00000001.147884.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&lse]hklm\software\microsoft\windows" - Source: "00000000-00005256.00000001.147884.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&hl=&guver=1.3.273.21&m=1&os=10.0.16299.248&sp=&iid=&brand=&source=gethelp_windowsupdate:\program" - Source: "00000000-00005256.00000001.147884.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&hl=&guver=1.3.273.21&m=1&os=10.0.16299.248&sp=&iid=&brand=&source=gethelp_windowsupdate145574-clsid\" - Source: "00000000-00005256.00000002.149805.03070000.00000004.mdmp") Found URL "https://go.microsoft.comlinkid=2111568&hl=&guver=1.3.273.21&m=1&os=10.0.16299.248&sp=&iid=&brand=&source=gethelp_windowsupdate01:0:14c9:dc0e:28c8:1bad:bf83:f35db+ncalrpc:[ole031f01a21a04aeafdcff8d475055]t" - Source: "00000000-00005256.00000002.149805.03070000.00000004.mdmp") Found URL "https://oft.comlinkid=2111568&hl=&guver=1.3.273.21&m=1&os=10.0.16299.248&sp=&iid=&brand=&source=gethelp_windowsupdate+ncalrpc:[ole031f01a21a04aeafdcff8d475055]t" - Source: "00000000-00005256.00000002.149805.03070000.00000004.mdmp") Found URL "https://oft.comlinkid=2111568&hl=&guver=1.3.273.21&m=1&os=10.0.16299.248&sp=&iid=&brand=&source=gethelp_windowsupdaters\hapubws\onedriveos=windows_ntpath=c:\programdata\oracle\java\javapath;c:\wstem32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00005256.00000002.149805.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&https://go.microsoft.com/fwlink/?linkid=2111568&https://go.microsoft.com/fwlink/?linkid=2111568&https://go.microsoft.com/fwlink/?linkid=2111568&hklm\software\microsoft\windows" - Source: "00000000-00005256.00000002.149805.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&hklm\software\microsoft\windows" - Source: "00000000-00005256.00000002.149805.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&https://go.microsoft.com/fwlink/?linkid=2111568&hklm\software\microsoft\windows" - Source: "00000000-00005256.00000002.149805.03070000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2111568&hl=&guver=1.3.273.21&m=1&os=10.0.16299.248&sp=&iid=&brand=&source=gethelp_windowsupdate:\program" - Source: "00000000-00005256.00000002.149805.03070000.00000004.mdmp") Found URL "http://https://%s\%shku\runas[started" - Source: "00000000-00006072.00000000.144687.732BF000.00000002.mdmp") Found URL "https://msedge.api.cdp.microsoft.com/apihttps://config.edge.skype.com/config/v1/edgeupdatehttps://go.microsoft.com/fwlink/?linkid=2068169&https://to-be-replaced.invalid/cr/reporthttps://go.microsoft.com/fwlink/?linkid=2111568&software\microsoft\edgeupdate\downloaderlockout[ismanaged][%s][%d]%d," - Source: "00000000-00006072.00000000.144687.732BF000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2348704&gethelpgethelp_windowsupdateguverfrom_extra_codeextra_codeproducttestsource%1%2atl:%p%s" - Source: "00000000-00006072.00000000.144687.732BF000.00000002.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&appchannel_edgeupdate=6&appconsentstate_edgeupdate=0&appdayofinstall_edgeupdate=0&appinactivitybadgeapplied_edgeupdate=0&appinactivitybadgecleared_edgeupdate=0&appinactivitybadgeduration_edgeupdate=0&appinstalltimediffsec_edgeupdate=0&appispinnedsystem_edgeupdate=false&applastlaunchcount_edgeupdate=0&applastlaunchtime_edgeupdate=0&applastlaunchtimejson_edgeupdate=0&applastlaunchtimedaysago_edgeupdate=0&appversion_edgeupdate=1.3.273.21&appupdatecheckisupdatedisabled_edgeupdate=false&appupdatesallowedformeterednetworks_edgeupdate=false&hwdisktype=2&hwhasssse3=true&hwlogicalcpus=8&hwphysmemory=8&isctadevice=false&ismsftdomainjoined=false&oemproductmanufacturer=ut7d4nyx1&oemproductname=8au4bc4m5r&osarch=x64&osisdefaultnetworkconnectionmetered=false&osisinlockdownmode=false&osiswip=false&osplatform=win&osproducttype=48&osversion=10.0.16299.248&requestcheckperiodsec=-1&requestdomainjoined=false&requestinstallsource=otherinstallcmd&requestismachine=true&requestomahashellversion=1.3.273.21&requestomahaversion=1.3.273.21&experimentationmode=2url=https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&appchannel_edgeupdate=6&appconsentstate_edgeupdate=0&appdayofinstall_edgeupdate=0&appinactivitybadgeapplied_edgeupdate=0&appinactivitybadgecleared_edgeupdate=0&appinactivitybadgeduration_edgeupdate=0&appinstalltimediffsec_edgeupdate=0&appispinnedsystem_edgeupdate=false&applastlaunchcount_edgeupdate=0&applastlaunchtime_edgeupdate=0&applastlaunchtimejson_edgeupdate=0&applastlaunchtimedaysago_edgeupdate=0&appversion_edgeupdate=1.3.273.21&appupdatecheckisupdatedisabled_edgeupdate=false&appupdatesallowedformeterednetworks_edgeupdate=false&hwdisktype=2&hwhasssse3=true&hwlogicalcpus=8&hwphysmemory=8&isctadevice=false&ismsftdomainjoined=false&oemproductmanufacturer=ut7d4nyx1&oemproductname=8au4bc4m5r&osarch=x64&osisdefaultnetworkconnectionmetered=false&osisinlockdownmode=false&osiswip=false&osplatform=win&osproducttype=48&osversion=10.0.16299.248&requestcheckperiodsec=-1&requestdomainjoined=false&requestinstallsource=otherinstallcmd&requestismachine=true&requestomahashellversion=1.3.273.21&requestomahaversion=1.3.273.21&experimentationmode=2trying" - Source: "00000000-00007188.00000000.145911.03060000.00000004.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&appchannel_edgeupdate=6&appconsentstate_edgeupdate=0&appdayofinstall_edgeupdate=0&appinactivitybadgeapplied_edgeupdate=0&appinactivitybadgecleared_edgeupdate=0&appinactivitybadgeduration_edgeupdate=0&appinstalltimediffsec_edgeupdate=0&appispinnedsystem_edgeupdate=false&applastlaunchcount_edgeupdate=0&applastlaunchtime_edgeupdate=0&applastlaunchtimejson_edgeupdate=0&applastlaunchtimedaysago_edgeupdate=0&appversion_edgeupdate=1.3.273.21&appupdatecheckisupdatedisabled_edgeupdate=false&appupdatesallowedformeterednetworks_edgeupdate=false&hwdisktype=2&hwhasssse3=true&hwlogicalcpus=8&hwphysmemory=8&isctadevice=false&ismsftdomainjoined=false&oemproductmanufacturer=ut7d4nyx1&oemproductname=8au4bc4m5r&osarch=x64&osisdefaultnetworkconnectionmetered=false&osisinlockdownmode=false&osiswip=false&osplatform=win&osproducttype=48&osversion=10.0.16299.248&requestcheckperiodsec=-1&requestdomainjoined=false&requestinstallsource=otherinstallcmd&requestismachine=true&requestomahashellversion=1.3.273.21&requestomahaversion=1.3.273.21&experimentationmode=2ebcache_" - Source: "00000000-00007188.00000000.145911.03060000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/$/a*h" - Source: "00000000-00007188.00000000.145911.03060000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl08xadlv;gb" - Source: "00000000-00007188.00000000.145911.03060000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0grmmx7pgiy" - Source: "00000000-00007188.00000000.145911.03060000.00000004.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&appchannel_edgeupdate=6&appconsentstate_edgeupdate=0&appdayofinstall_edgeupdate=0&appinactivitybadgeapplied_edgeupdate=0&appinactivitybadgecleared_edgeupdate=0&appinactivitybadgeduration_edgeupdate=0&appinstalltimediffsec_edgeupdate=0&appispinnedsystem_edgeupdate=false&applastlaunchcount_edgeupdate=0&applastlaunchtime_edgeupdate=0&applastlaunchtimejson_edgeupdate=0&applastlaunchtimedaysago_edgeupdate=0&appversion_edgeupdate=1.3.273.21&appupdatecheckisupdatedisabled_edgeupdate=false&appupdatesallowedformeterednetworks_edgeupdate=false&hwdisktype=2&hwhasssse3=true&hwlogicalcpus=8&hwphysmemory=8&isctadevice=false&ismsftdomainjoined=false&oemproductmanufacturer=ut7d4nyx1&oemproductname=8au4bc4m5r&osarch=x64&osisdefaultnetworkconnectionmetered=false&osisinlockdownmode=false&osiswip=false&osplatform=win&osproducttype=48&osversion=10.0.16299.248&requestcheckperiodsec=-1&requestdomainjoined=false&requestinstallsource=otherinstallcmd&requestismachine=true&requestomahashellversion=1.3.273.21&requestomahaversion=1.3.273.21&experimentationmode=2pragmano-cacheschannelkerberos9.248negotiatedefault" - Source: "00000000-00007188.00000000.145911.03060000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/lmem8lmem8lmem8lmem81.3.6.1.4.1.311.80.1lmem8lmem8" - Source: "00000000-00007188.00000000.145911.03060000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/lmem0lmem0https://self.events.data.microsoft.com/onecollector/1.0/lmem0" - Source: "00000000-00007188.00000000.145911.03060000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/dk-versioncontinueontent-typepload-time790836973490pikeytimeeflateinuexpect00-continueself.events.data.microsoft.comself.events.data.microsoft.comself.events.data.microsoft.com6sp%self.events.data.microsoft.comxwhr" - Source: "00000000-00007188.00000000.145911.03060000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czcn.++globalsign" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcdigicert" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_0r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/$r@e%r1.3.6.1.4.1.311.10.11.15encdmicrosoft" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?0" - Source: "00000000-00007188.00000000.145911.03136000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007188.00000000.145911.060C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l(" - Source: "00000000-00007188.00000000.145911.060C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/]/miccerlisca2011_2011-03-29.crl0]ahttp://www.microsoft.com/pkimiccerlisca2011_2011-03-29.crt0bc6" - Source: "00000000-00007188.00000000.145911.060C0000.00000004.mdmp") Found URL "http://www.microsoft.com0ervererverontent-lengtherverontent-length0yykcahbwv$_ntye0yykcahbwv$_ntye0yykcahbwv$_ntye0yykcahbwv$_ntye0yykcahbwv$_ntye0yykcahbwv$_ntye170531232859z180601232859z0.files-df.1drv.com1.files.1drv.com1.aadrm.com1&0.afx.ms1&0.akadns.net1&0.aspnetcdn.com1.azure-int.net1&0.azure-mobile.net1.azure.com1&0.cloudapp.azure.com1" - Source: "00000000-00007188.00000000.145911.060C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007188.00000000.145911.060C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007188.00000000.145911.060C0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007188.00000000.145911.060C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007188.00000000.145911.060C0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007188.00000000.145911.060C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/c" - Source: "00000000-00007188.00000000.145911.060C0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl08xadlv;gb" - Source: "00000000-00007188.00000000.145911.0610C000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/$/a*h" - Source: "00000000-00007188.00000001.146049.03060000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl08xadlv;gb" - Source: "00000000-00007188.00000001.146049.030AA000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0grmmx7pgiy" - Source: "00000000-00007188.00000001.146049.030AA000.00000004.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&appchannel_edgeupdate=6&appconsentstate_edgeupdate=0&appdayofinstall_edgeupdate=0&appinactivitybadgeapplied_edgeupdate=0&appinactivitybadgecleared_edgeupdate=0&appinactivitybadgeduration_edgeupdate=0&appinstalltimediffsec_edgeupdate=0&appispinnedsystem_edgeupdate=false&applastlaunchcouasyclw\lasyc@rqqqqqqqqqqqqqqqq0lrwszu(lw" - Source: "00000000-00007188.00000001.146049.030D4000.00000004.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&appchannel_edgeupdate=6&appconsentstate_edgeupdate=0&appdayofinstall_edgeupdate=0&appinactivitybadgeapplied_edgeupdate=0&appinactivitybadgecleared_edgeupdate=0&appinactivitybadgeduration_edgeupdate=0&appinstalltimediffsec_edgeupdate=0&appispinnedsystem_edgeupdate=false&applastlaunchcount_edgeupdate=0&applastlaunchtime_edgeupdate=0&applastlaunchtimejson_edgeupdate=0&applastlaunchtimedaysago_edgeupdate=0&appversion_edgeupdate=1.3.273.21&appupdatecheckisupdatedisabled_edgeupdate=false&appupdatesallowedformeterednetworks_edgeupdate=false&hwdisktype=2&hwhasssse3=true&hwlogicalcpus=8&hwphysmemory=8&isctadevice=false&ismsftdomainjoined=false&oemproductmanufacturer=ut7d4nyx1&oemproductname=8au4bc4m5r&osarch=x64&osisdefaultnetworkconnectionmetered=false&osisinlockdownmode=false&osiswip=false&osplatform=win&osproducttype=48&osversion=10.0.16299.248&requestcheckperiodsec=-1&requestdomainjoined=false&requestinstallsource=otherinstallcmd&requestismachine=true&requestomahashellversion=1.3.273.21&requestomahaversion=1.3.273.21&experimentationmode=2pragmano-cacheschannelkerberos9.248negotiatedefault" - Source: "00000000-00007188.00000001.146049.030DF000.00000004.mdmp") Found URL "https://ecs.nel.measure.office.net/api/report?tenantid=edgeupdate&destinationendpoint=edge-prod-by1r5c&frontend=afd" - Source: "00000000-00007188.00000001.146049.030DF000.00000004.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&appchannel_edgeupdate=6&appconsentstate_edgeupdate=0&appdayofinstall_edgeupdate=0&appinactivitybadgeapplied_edgeupdate=0&appinactivitybadgecleared_edgeupdate=0&appinactivitybadgeduration_edgeupdate=0&appinstalltimediffsec_edgeupdate=0&appispinnedsystem_edgeupdate=false&applastlaunchcount_edgeupdate=0&applastlaunchtime_edgeupdate=0&applastlaunchtimejson_edgeupdate=0&applastlaunchtimedaysago_edgeupdate=0&appversion_edgeupdate=1.3.273.21&appupdatecheckisupdatedisabled_edgeupdate=false&appupdatesallowedformeterednetworks_edgeupdate=false&hwdisktype=2&hwhasssse3=true&hwlogicalcpus=8&hwphysmemory=8&isctadevice=false&ismsftdomainjoined=false&oemproductmanufacturer=ut7d4nyx1&oemproductname=8au4bc4m5r&osarch=x64&osisdefaultnetworkconnectionmetered=false&osisinlockdownmode=false&osiswip=false&osplatform=win&osproducttype=48&osversion=10.0.16299.248&requestcheckperiodsec=-1&requestdomainjoined=false&requestinstallsource=otherinstallcmd&requestismachine=true&requestomahashellversion=1.3.273.21&requestomahaversion=1.3.273.21&experimentationmode=2ebcache_" - Source: "00000000-00007188.00000001.146049.030FE000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/lmem0lmem0https://self.events.data.microsoft.com/onecollector/1.0/lmem0" - Source: "00000000-00007188.00000001.146049.030FE000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/dk-versioncontinueontent-typepload-time790836973490pikeytimeeflateinuexpect00-continueself.events.data.microsoft.comself.events.data.microsoft.comself.events.data.microsoft.com6sp%self.events.data.microsoft.comxwhr" - Source: "00000000-00007188.00000001.146049.030FE000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0grmmx7pgiy" - Source: "00000000-00007188.00000001.146049.030FE000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czcn.++globalsign" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcdigicert" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_0r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/$r@e%rdgeupdates_v3xpiration-cccfaluetstoregistaluetstoregistdgeupdates_v3dgeupdates_v3xpiration-cccf1.3.6.1.4.1.311.10.11.15egmentationencdications_v3pplications_v3xpiration-cccfigids2026microsoft" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?0" - Source: "00000000-00007188.00000001.146049.03136000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007188.00000001.146049.060C3000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00007188.00000001.146049.060C3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/]/miccerlisca2011_2011-03-29.crl0]ahttp://www.microsoft.com/pkimiccerlisca2011_2011-03-29.crt0bc6" - Source: "00000000-00007188.00000001.146049.060C3000.00000004.mdmp") Found URL "http://www.microsoft.com0erver0yykcahbwv$_ntye0yykcahbwv$_ntye0yykcahbwv$_ntye0yykcahbwv$_ntye0yykcahbwv$_ntye170531232859z180601232859z0.files-df.1drv.com1.files.1drv.com1.aadrm.com1&0.afx.ms1&0.akadns.net1&0.aspnetcdn.com1.azure-int.net1&0.azure-mobile.net1.azure.com1&0.cloudapp.azure.com1" - Source: "00000000-00007188.00000001.146049.060C3000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007188.00000001.146049.060C3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007188.00000001.146049.060C3000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007188.00000001.146049.060C3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007188.00000001.146049.060C3000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007188.00000001.146049.060C3000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl08xadlv;gb" - Source: "00000000-00007188.00000001.146049.0610C000.00000004.mdmp") Found URL "https://msedge.api.cdp.microsoft.com/apicmd4d3d-952d-82190637a96bm9ubxnpokrssvzfx1bsstpkb3dubg9hzdpjahjvbwvzzxr1cc5legu6zwrnzw5vdhzpc2libgu6mta6bm90yxvkaxq6bm90b29izqgr;;;wd)clsid\" - Source: "00000000-00007376.00000000.146097.02A60000.00000004.mdmp") Found URL "https://msedge.api.cdp.microsoft.com/apicmd4d3d-952d-82190637a96bm9ubxnpokrssvzfx1bsstpkb3dubg9hzdpjahjvbwvzzxr1cc5legu6zwrnzw5vdhzpc2libgu6mta6bm90yxvkaxq6bm90b29izqgr;;;wd)clsid\" - Source: "00000000-00007376.00000001.148018.02A60000.00000004.mdmp") Found URL "https://msedge.api.cdp.microsoft.com/apicmd4d3d-952d-82190637a96bm9ubxnpokrssvzfx1bsstpkb3dubg9hzdpjahjvbwvzzxr1cc5legu6zwrnzw5vdhzpc2libgu6mta6bm90yxvkaxq6bm90b29izqgr;;;wd)clsid\" - Source: "00000000-00007376.00000002.149939.02A60000.00000004.mdmp") Found URL "https://se.microsoft.com/www.microsoft.comocol" - Source: "00000000-00008076.00000000.146310.005A0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crlsoftware\microsoft\edgeupdate\clientstatemedium\" - Source: "00000000-00008076.00000000.146310.005A0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crlx-old-uid:" - Source: "00000000-00008076.00000000.146310.005A0000.00000004.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&experimentationmode=2clsid\" - Source: "00000000-00008076.00000000.146310.005A0000.00000004.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&experimentationmode=2trying" - Source: "00000000-00008076.00000000.146310.005A0000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/c:\windows\temp\af397ef28e484961ba48646a5d38cf54.db2or" - Source: "00000000-00008076.00000000.146310.005A0000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/xgzudeviceinfo.classminimumtracelevelcachememorysizelimitinbytesenablelifecyclesessionmultitenantenabledenabledbdropiffullmultitenantenableddeviceinfo.modeluserinfo.languageappinfo.languagemaxteardownuploadtimeinsecenabledbdropiffullmaxteardownuploadtimeinsecmaxpendinghttprequestsenablelifecyclesessionminimumtracelevelmaxdbflushqueuesdeviceinfo.osnameeventcollectorurideviceinfo.osbuildenablenetworkdetectorlargepayloadsenabledcachememorysizelimitinbytesclockskewenabledmicrosoftedgeupdateut7d4nyx1nufacturercachefilesizelimitinbytese,3000,300000,2,1cachefilesizelimitinbytesdeviceinfo.osversionminimumtracelevelenablenetworkdetectorenabledbdropiffullmaxteardownuploadtimeinsecclockskewenabledeventcollectoruricachefilesizelimitinbytese,3000,300000,2,1maxpendinghttprequestseventcollectoruricachememorysizelimitinbytesmaxdbflushqueuesmaxdbflushqueuesmultitenantenabledenablelifecyclesessionmaxpendinghttprequestslargepayloadsenabledenablenetworkdetector9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485ldapprovopenstores:d72ccd18-9555-46ce-be82-dd29eb26e920e920ldapprovopenstorefcd3d8ef-4aa5-467d-bd96-344f0433d16dokenintokenprod1.3.6.1.4.1.311.64.1.1tracelevelmaskbackoffconfigmaxretrycountletraceenabletraceaxblobsizeaxretrycountetrycountmaxblobsizeackoffconfigctivenprodplitsdkmoderovidergroupid4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-74858130ef8ff472405d89d6f420038927ea-0c0d561e-cca5-4c81-90ed-0aa9ad786a03-7166cachefilefullnotificationpercentagecachefullnotificationintervaltimecachefilefullnotificationpercentagecachefullnotificationintervaltime5781-895a-a690464fa89ccachememoryfullnotificationpercentagecachememoryfullnotificationpercentagecachefilefullnotificationpercentage780dddc8-18a1-5781-895a-a690464fa89c780dddc8-18a1-5781-895a-a690464fa89ccachefilefullnotificationpercentagecachefullnotificationintervaltimecachememoryfullnotificationpercentage780dddc8-18a1-5781-895a-a690464fa89cotificationpercentagecachefullnotificationintervaltimecachememoryfullnotificationpercentageu1.2.840.113549.3.4>pu,m@1" - Source: "00000000-00008076.00000000.146310.005A0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0grmmx7pgiy" - Source: "00000000-00008076.00000000.146310.005A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootg2.crt0b;09071http://crl3.digicert.com/digicertglobalrootg2.crl0c" - Source: "00000000-00008076.00000000.146310.005A0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0*+zen" - Source: "00000000-00008076.00000000.146310.005A0000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/eflateinueself.events.data.microsoft.comif-none-match" - Source: "00000000-00008076.00000000.146310.005A0000.00000004.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&experimentationmode=2reoo;2tp<2tmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008076.00000000.146310.005A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008076.00000000.146310.044C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*luj->do4022" - Source: "00000000-00008076.00000000.146310.044C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00008076.00000000.146310.044C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00008076.00000000.146310.044C0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00008076.00000000.146310.044C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00008076.00000000.146310.044C0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00008076.00000000.146310.044C0000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/self.events.data.microsoft.comgzup&drxgzuh" - Source: "00000000-00008076.00000000.146310.044C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20azure%20rsa%20tls%20issuing%20ca%2003%20-%20xsign.crt0-!http://oneocsp.microsoft.com/ocsp0*.events.data.microsoft.comevents.data.microsoft.com*.pipe.aria.microsoft.compipe.skype.com*.pipe.skype.com" - Source: "00000000-00008076.00000000.146310.044C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20azure%20rsa%20tls%20issuing%20ca%2003.crl0f_0]0q0a0?3http://www.microsoft.com/pkiops/docs/repository.htm0" - Source: "00000000-00008076.00000000.146310.044C0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0*+zen" - Source: "00000000-00008076.00000000.146310.044C0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0*+zen" - Source: "00000000-00008076.00000000.146310.04515000.00000004.mdmp") Found URL "https://config.edge.skype.com/config.edge.skype.comdesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:28c8:1bad:bf83:f35ddesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:28c8:1bad:bf83:f35di+ncalrpc:[ole188a2cbb4418ade7bfa143fb6cb2]t" - Source: "00000000-00008076.00000001.148232.005A0000.00000004.mdmp") Found URL "https://senfig.edge.skype.com/config.edge.skype.comdesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:28c8:1bad:bf83:f35ddesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:28c8:1bad:bf83:f35di+ncalrpc:[ole188a2cbb4418ade7bfa143fb6cb2]t" - Source: "00000000-00008076.00000001.148232.005A0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crldesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:28c8:1bad:bf83:f35dsoftware\microsoft\edgeupdate\clientstatemedium\" - Source: "00000000-00008076.00000001.148232.005A0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crlx-old-uid:" - Source: "00000000-00008076.00000001.148232.005A0000.00000004.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&experimentationmode=2clsid\" - Source: "00000000-00008076.00000001.148232.005A0000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/c:\windows\temp\af397ef28e484961ba48646a5d38cf54.db2or" - Source: "00000000-00008076.00000001.148232.005A0000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/xgzudeviceinfo.classminimumtracelevelcachememorysizelimitinbytesenablelifecyclesessionmultitenantenabledenabledbdropiffullmultitenantenableddeviceinfo.modeluserinfo.languageappinfo.languagemaxteardownuploadtimeinsecenabledbdropiffullmaxteardownuploadtimeinsecmaxpendinghttprequestsenablelifecyclesessionminimumtracelevelmaxdbflushqueuesdeviceinfo.osnameeventcollectorurideviceinfo.osbuildenablenetworkdetectorlargepayloadsenabledcachememorysizelimitinbytesclockskewenabledmicrosoftedgeupdateut7d4nyx1nufacturercachefilesizelimitinbytese,3000,300000,2,1cachefilesizelimitinbytesdeviceinfo.osversionminimumtracelevelenablenetworkdetectorenabledbdropiffullmaxteardownuploadtimeinsecclockskewenabledeventcollectoruricachefilesizelimitinbytese,3000,300000,2,1maxpendinghttprequestseventcollectoruricachememorysizelimitinbytesmaxdbflushqueuesmaxdbflushqueuesmultitenantenabledenablelifecyclesessionmaxpendinghttprequestslargepayloadsenabledenablenetworkdetector9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485ldapprovopenstores:d72ccd18-9555-46ce-be82-dd29eb26e920e920ldapprovopenstorefcd3d8ef-4aa5-467d-bd96-344f0433d16dokenintokenprod1.3.6.1.4.1.311.64.1.1tracelevelmaskbackoffconfigmaxretrycountletraceenabletraceaxblobsizeaxretrycountetrycountmaxblobsizeackoffconfigctivenprodplitsdkmoderovidergroupid4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-74858130ef8ff472405d89d6f420038927ea-0c0d561e-cca5-4c81-90ed-0aa9ad786a03-7166cachefilefullnotificationpercentagecachefullnotificationintervaltimecachefilefullnotificationpercentagecachefullnotificationintervaltime5781-895a-a690464fa89ccachememoryfullnotificationpercentagecachememoryfullnotificationpercentagecachefilefullnotificationpercentage780dddc8-18a1-5781-895a-a690464fa89c780dddc8-18a1-5781-895a-a690464fa89ccachefilefullnotificationpercentagecachefullnotificationintervaltimecachememoryfullnotificationpercentage780dddc8-18a1-5781-895a-a690464fa89cotificationpercentagecachefullnotificationintervaltimecachememoryfullnotificationpercentageu1.2.840.113549.3.4>pu,m@1" - Source: "00000000-00008076.00000001.148232.005A0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0grmmx7pgiy" - Source: "00000000-00008076.00000001.148232.005A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootg2.crt0b;09071http://crl3.digicert.com/digicertglobalrootg2.crl0c" - Source: "00000000-00008076.00000001.148232.005A0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0*+zen" - Source: "00000000-00008076.00000001.148232.005A0000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/eflateinueself.events.data.microsoft.comif-none-match" - Source: "00000000-00008076.00000001.148232.005A0000.00000004.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&experimentationmode=2reoo;2tp<2tmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008076.00000001.148232.005A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008076.00000001.148232.044C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*luj->do4022" - Source: "00000000-00008076.00000001.148232.044C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00008076.00000001.148232.044C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00008076.00000001.148232.044C0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00008076.00000001.148232.044C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00008076.00000001.148232.044C0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00008076.00000001.148232.044C0000.00000004.mdmp") Found URL "https://config.edge.skype.com/ttps://config.edge.skype.com/tsregistersessionnotificationpython\python38\python.exeelf.events.data.microsoft.com:\windows\system32\msiso.dllelf.events.data.microsoft.comelf.events.data.microsoft.com:\windows\system32\urlmon.dllelf.events.data.microsoft.comttps://config.edge.skype.com/ttps://config.edge.skype.com/elf.events.data.microsoft.comelf.events.data.microsoft.com:\windows\system32\jsproxy.dllttps://config.edge.skype.com/send" - Source: "00000000-00008076.00000001.148232.044F9000.00000004.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&experimentationmode=2trying" - Source: "00000000-00008076.00000001.148232.044F9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20azure%20rsa%20tls%20issuing%20ca%2003%20-%20xsign.crt0-!http://oneocsp.microsoft.com/ocsp0*.events.data.microsoft.comevents.data.microsoft.com*.pipe.aria.microsoft.compipe.skype.com*.pipe.skype.com" - Source: "00000000-00008076.00000001.148232.044F9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20azure%20rsa%20tls%20issuing%20ca%2003.crl0f_0]0q0a0?3http://www.microsoft.com/pkiops/docs/repository.htm0" - Source: "00000000-00008076.00000001.148232.044F9000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0*+zen" - Source: "00000000-00008076.00000001.148232.044F9000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crldesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:28c8:1bad:bf83:f35dsoftware\microsoft\edgeupdate\clientstatemedium\" - Source: "00000000-00008076.00000002.150149.005A0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crlx-old-uid:" - Source: "00000000-00008076.00000002.150149.005A0000.00000004.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&experimentationmode=2clsid\" - Source: "00000000-00008076.00000002.150149.005A0000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/c:\windows\temp\af397ef28e484961ba48646a5d38cf54.db2or" - Source: "00000000-00008076.00000002.150149.005A0000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/xgzudeviceinfo.classminimumtracelevelcachememorysizelimitinbytesenablelifecyclesessionmultitenantenabledenabledbdropiffullmultitenantenableddeviceinfo.modeluserinfo.languageappinfo.languagemaxteardownuploadtimeinsecenabledbdropiffullmaxteardownuploadtimeinsecmaxpendinghttprequestsenablelifecyclesessionminimumtracelevelmaxdbflushqueuesdeviceinfo.osnameeventcollectorurideviceinfo.osbuildenablenetworkdetectorlargepayloadsenabledcachememorysizelimitinbytesclockskewenabledmicrosoftedgeupdateut7d4nyx1nufacturercachefilesizelimitinbytese,3000,300000,2,1cachefilesizelimitinbytesdeviceinfo.osversionminimumtracelevelenablenetworkdetectorenabledbdropiffullmaxteardownuploadtimeinsecclockskewenabledeventcollectoruricachefilesizelimitinbytese,3000,300000,2,1maxpendinghttprequestseventcollectoruricachememorysizelimitinbytesmaxdbflushqueuesmaxdbflushqueuesmultitenantenabledenablelifecyclesessionmaxpendinghttprequestslargepayloadsenabledenablenetworkdetector9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485ldapprovopenstores:d72ccd18-9555-46ce-be82-dd29eb26e920e920ldapprovopenstorefcd3d8ef-4aa5-467d-bd96-344f0433d16dokenintokenprod1.3.6.1.4.1.311.64.1.1tracelevelmaskbackoffconfigmaxretrycountletraceenabletraceaxblobsizeaxretrycountetrycountmaxblobsizeackoffconfigctivenprodplitsdkmoderovidergroupid4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-74858130ef8ff472405d89d6f420038927ea-0c0d561e-cca5-4c81-90ed-0aa9ad786a03-7166cachefilefullnotificationpercentagecachefullnotificationintervaltimecachefilefullnotificationpercentagecachefullnotificationintervaltime5781-895a-a690464fa89ccachememoryfullnotificationpercentagecachememoryfullnotificationpercentagecachefilefullnotificationpercentage780dddc8-18a1-5781-895a-a690464fa89c780dddc8-18a1-5781-895a-a690464fa89ccachefilefullnotificationpercentagecachefullnotificationintervaltimecachememoryfullnotificationpercentage780dddc8-18a1-5781-895a-a690464fa89cotificationpercentagecachefullnotificationintervaltimecachememoryfullnotificationpercentageu1.2.840.113549.3.4>pu,m@1" - Source: "00000000-00008076.00000002.150149.005A0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0grmmx7pgiy" - Source: "00000000-00008076.00000002.150149.005A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootg2.crt0b;09071http://crl3.digicert.com/digicertglobalrootg2.crl0c" - Source: "00000000-00008076.00000002.150149.005A0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0*+zen" - Source: "00000000-00008076.00000002.150149.005A0000.00000004.mdmp") Found URL "https://self.events.data.microsoft.com/onecollector/1.0/eflateinueself.events.data.microsoft.comif-none-match" - Source: "00000000-00008076.00000002.150149.005A0000.00000004.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&experimentationmode=2reoo;2tp<2tmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008076.00000002.150149.005A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008076.00000002.150149.044C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*luj->do4022" - Source: "00000000-00008076.00000002.150149.044C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00008076.00000002.150149.044C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00008076.00000002.150149.044C0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00008076.00000002.150149.044C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00008076.00000002.150149.044C0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00008076.00000002.150149.044C0000.00000004.mdmp") Found URL "https://config.edge.skype.com/ttps://config.edge.skype.com/tsregistersessionnotificationpython\python38\python.exeelf.events.data.microsoft.com:\windows\system32\msiso.dllelf.events.data.microsoft.comelf.events.data.microsoft.com:\windows\system32\urlmon.dllelf.events.data.microsoft.comttps://config.edge.skype.com/ttps://config.edge.skype.com/elf.events.data.microsoft.comelf.events.data.microsoft.com:\windows\system32\jsproxy.dllttps://config.edge.skype.com/send" - Source: "00000000-00008076.00000002.150149.044F9000.00000004.mdmp") Found URL "https://config.edge.skype.com/config/v1/edgeupdate/1.3.273.21?clientid=s:d72ccd18-9555-46ce-be82-dd29eb26e920&experimentationmode=2trying" - Source: "00000000-00008076.00000002.150149.044F9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20azure%20rsa%20tls%20issuing%20ca%2003%20-%20xsign.crt0-!http://oneocsp.microsoft.com/ocsp0*.events.data.microsoft.comevents.data.microsoft.com*.pipe.aria.microsoft.compipe.skype.com*.pipe.skype.com" - Source: "00000000-00008076.00000002.150149.044F9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20azure%20rsa%20tls%20issuing%20ca%2003.crl0f_0]0q0a0?3http://www.microsoft.com/pkiops/docs/repository.htm0" - Source: "00000000-00008076.00000002.150149.044F9000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0*+zen" - Source: "00000000-00008076.00000002.150149.044F9000.00000004.mdmp")59:T984,Found registry query API: "RegEnumValueW" in file "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" Found registry query API: "RegEnumKeyW" in file "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" Found registry query API: "RegQueryValueExW" in file "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" Found registry query API: "RegOpenKeyExW" in file "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" Found registry query API: "RegQueryValueExA" in file "00000000-00000064.00000001.145460.0040A000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in file "00000000-00000064.00000001.145460.0040A000.00000004.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00000064.00000001.145460.00408000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00000064.00000001.145460.00408000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00000064.00000001.145460.0040A000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00000064.00000001.145460.0040A000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00000064.00000001.145460.73657000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00000064.00000001.145460.73657000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00000064.00000001.145460.73657000.00000002.mdmp" Found registry query API: "sWinPEHost: Cannot open reg key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNT. Assuming the host is NOT WinPE. RegOpenKeyExW err" in "00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp"5a:T79f,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "FindFirstFileW" with parameter %TEMP%\nse29AC.tmp (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Posline (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "FindFirstFileW" with parameter C:\Users\%OSUSER% (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "FindFirstFileW" with parameter C:\Users (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "FindFirstFileW" with parameter %TEMP%\MicrosoftEdgeWebview2Setup.exe (UID: 00000000-00000064) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00000064) "MicrosoftEdgeUpdate.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\*.* (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter 1.3.221.3 (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.221.3\* (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter CopilotUpdate.exe (UID: 00000000-00002636) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter EdgeUpdate.dat (UID: 00000000-00002636)5b:Tb40,Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00000064.00000001.145460.054E0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00000064.00000001.145460.054E0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00000064.00000001.145460.054E0000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00000064.00000001.145460.054E0000.00000002.mdmp") Found string "=aaes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "5\aes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "5XaesP" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "=haes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "5PaesW" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "haesf" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "Phhaes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "haes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "\aes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "Xaes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "Taes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "Paes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "hhaes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "QRPh(Aes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "QRPhHAes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "QRPhhAes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "`aes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "aaes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "=`aes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "5Taes" (Indicator: "aes"; Source: "00000000-00000064.00000001.145460.735F1000.00000020.mdmp") Found string "IPF_Base64InkSerializedFormatWWW" (Indicator: "base64"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp")5c:T448,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp")5d:T991,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "System.dll") Found reference to API "kernel32::GetCurrentProcess()p.s" (Indicator: "GetCurrentProcess"; Source: "00000000-00000064.00000000.143538.033D0000.00000004.mdmp, 00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp")5e:T4c6,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "System.dll") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp")5f:T124e,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "00000000-00001892.00000000.144050.00EF1000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000064.00000001.145460.73657000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp")60:T417,Found registry deletion API: "RegDeleteValueW" in file "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" Found registry deletion API: "RegDeleteKeyW" in file "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" Found registry deletion API: "RegDeleteKeyExW" in file "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.735F1000.00000020.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.735F1000.00000020.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp"61:T43c,Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000064.00000000.143538.033D0000.00000004.mdmp, 00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000064.00000000.143538.033D0000.00000004.mdmp, 00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}" (Indicator: "\Device\"; Source: "00000000-00000064.00000000.143538.033D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateComRegisterShell64.exe" (Indicator: "\Device\"; Source: "00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp")62:T638,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; File: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; File: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00000064.00000000.143538.0040A000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000064.00000001.145460.00408000.00000002.mdmp")63:Tc4d,Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001892.00000000.144050.00F0C000.00000002.mdmp")64:Te11,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "")65:T16b34,"MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "%TEMP%\CopilotUpdate.exe.old{27FFF535-7E49-4412-BF2D-621DDF0E1AD2}") "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "PATH"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "COPILOTUPDATEPATH"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "UNINSTALLCMDLINE"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTS\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}"; Key: "PV"; Value: "1.3.273.21"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTS\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}"; Key: "NAME"; Value: "Microsoft Edge Update"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}"; Key: "PV"; Value: "1.3.273.21"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MICROSOFTEDGEUPDATE.EXE"; Key: "DISABLEEXCEPTIONCHAINVALIDATION"; Value: "0000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "LASTOSVERSION"; Value: "1C0100000A00000000000000AB3F00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001010000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "LASTOSVERSIONPATCHNUMBER"; Value: "F800000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "VERSION"; Value: "1.3.273.21"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MICROSOFT EDGE UPDATE"; Key: "DISPLAYVERSION"; Value: "1.3.273.21"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MICROSOFT EDGE UPDATE"; Key: "VERSION"; Value: "1.3.273.21"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}"; Key: "INSTALLSOURCE"; Value: "otherinstallcmd"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\PERSISTEDPINGS\{A5E894FB-5768-4BEE-BBDF-127A0AE3C8A5}"; Key: "PERSISTEDPINGSTRING"; Value: ""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\PERSISTEDPINGS\{A5E894FB-5768-4BEE-BBDF-127A0AE3C8A5}"; Key: "PERSISTEDPINGTIME"; Value: "134353105692721647"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "(DEFAULT)"; Value: "ServiceModule"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\MICROSOFTEDGEUPDATE.EXE"; Key: "APPID"; Value: "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "LOCALSERVICE"; Value: "edgeupdate"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "SERVICEPARAMETERS"; Value: "/comsvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\EDGEUPDATE"; Key: "EVENTMESSAGEFILE"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE.1.0"; Key: "(DEFAULT)"; Value: "Update3COMClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE"; Key: "(DEFAULT)"; Value: "Update3COMClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE\CLSID"; Key: "(DEFAULT)"; Value: "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3COMClassService.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "(DEFAULT)"; Value: "Update3COMClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3COMClassService.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3COMClassService"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "APPID"; Value: "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "(DEFAULT)"; Value: "ServiceModule"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\MICROSOFTEDGEUPDATE.EXE"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "LOCALSERVICE"; Value: "edgeupdatem"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "SERVICEPARAMETERS"; Value: "/comsvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\EDGEUPDATEM"; Key: "EVENTMESSAGEFILE"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC\CLSID"; Key: "(DEFAULT)"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassSvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC\CLSID"; Key: "(DEFAULT)"; Value: "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebSvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC.1.0"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC\CLSID"; Key: "(DEFAULT)"; Value: "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusSvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS.1"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS.1\CLSID"; Key: "(DEFAULT)"; Value: "{8F09CD6C-5964-4573-82E3-EBFF7702865B}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS\CLSID"; Key: "(DEFAULT)"; Value: "{8F09CD6C-5964-4573-82E3-EBFF7702865B}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreClass.1"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreClass.1"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\psmachine.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\psmachine.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{86FA2729-397E-41E1-95BB-4F18BEBD5CD3}\INPROCHANDLER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\psmachine.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{86FA2729-397E-41E1-95BB-4F18BEBD5CD3}\INPROCHANDLER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59DD293F-6B10-49A7-B566-504B2EF90A43}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\psmachine.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59DD293F-6B10-49A7-B566-504B2EF90A43}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59DD293F-6B10-49A7-B566-504B2EF90A43}"; Key: "(DEFAULT)"; Value: "PSFactoryBuffer"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}"; Key: "(DEFAULT)"; Value: "IPolicyStatus5"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003700000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}"; Key: "(DEFAULT)"; Value: "IAppSideBySide"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}"; Key: "(DEFAULT)"; Value: "IPackage"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}"; Key: "(DEFAULT)"; Value: "IPolicyStatus3"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}"; Key: "(DEFAULT)"; Value: "IPolicyStatusValue"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003200000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}"; Key: "(DEFAULT)"; Value: "IPolicyStatus6"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003800000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}"; Key: "(DEFAULT)"; Value: "IApp2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003300000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}"; Key: "(DEFAULT)"; Value: "IProcessLauncher"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3600000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}"; Key: "(DEFAULT)"; Value: "IAppCommand2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003200000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}"; Key: "(DEFAULT)"; Value: "IPolicyStatus7"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003900000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}"; Key: "(DEFAULT)"; Value: "IAppVersion"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}"; Key: "(DEFAULT)"; Value: "IBrowserHttpRequest2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}"; Key: "(DEFAULT)"; Value: "IGoogleUpdateCore"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}"; Key: "(DEFAULT)"; Value: "ICoCreateAsyncStatus"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}"; Key: "(DEFAULT)"; Value: "IAppBundle"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}"; Key: "(DEFAULT)"; Value: "IAppWeb"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003700000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}"; Key: "(DEFAULT)"; Value: "IJobObserver2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}"; Key: "(DEFAULT)"; Value: "ICurrentState"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}"; Key: "(DEFAULT)"; Value: "ICredentialDialog"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}"; Key: "(DEFAULT)"; Value: "IPolicyStatus4"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003600000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}"; Key: "(DEFAULT)"; Value: "IPolicyStatus"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003600000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}"; Key: "(DEFAULT)"; Value: "IJobObserver"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003300000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}"; Key: "(DEFAULT)"; Value: "IApp"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}"; Key: "(DEFAULT)"; Value: "ICoCreateAsync"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}"; Key: "(DEFAULT)"; Value: "IAppCommand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}"; Key: "(DEFAULT)"; Value: "IRegistrationUpdateHook"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3800000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}"; Key: "(DEFAULT)"; Value: "IAppCommandWeb"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}"; Key: "(DEFAULT)"; Value: "IAppBundleWeb"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}"; Key: "(DEFAULT)"; Value: "IAppUnified"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3WebSecurity"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}"; Key: "(DEFAULT)"; Value: "IProgressWndEvents"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3900000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}"; Key: "(DEFAULT)"; Value: "IPolicyStatus2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003300000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3800000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}"; Key: "(DEFAULT)"; Value: "IProcessLauncher2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3700000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}"; Key: "(DEFAULT)"; Value: "IAppVersionWeb"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE\CLSID"; Key: "(DEFAULT)"; Value: "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachine"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateBroker.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE\CLSID"; Key: "(DEFAULT)"; Value: "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachine"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateBroker.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{B5977F34-9264-4AC3-9B31-1224827FF6E8}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE\CLSID"; Key: "(DEFAULT)"; Value: "{B5977F34-9264-4AC3-9B31-1224827FF6E8}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachine"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateBroker.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Process Launcher Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{08D832B9-D2FD-481F-98CF-904D00DF63CC}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Process Launcher Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER\CLSID"; Key: "(DEFAULT)"; Value: "{08D832B9-D2FD-481F-98CF-904D00DF63CC}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.ProcessLauncher.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Process Launcher Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.ProcessLauncher.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.ProcessLauncher"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS.1"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS.1\CLSID"; Key: "(DEFAULT)"; Value: "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS\CLSID"; Key: "(DEFAULT)"; Value: "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreMachineClass.1"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreMachineClass.1"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreMachineClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK\CLSID"; Key: "(DEFAULT)"; Value: "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK\CLSID"; Key: "(DEFAULT)"; Value: "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachineFallback"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK.1.0"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{77857D02-7A25-4B67-9266-3E122A8F39E4}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK\CLSID"; Key: "(DEFAULT)"; Value: "{77857D02-7A25-4B67-9266-3E122A8F39E4}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachineFallback"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update CredentialDialog"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update CredentialDialog"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE\CLSID"; Key: "(DEFAULT)"; Value: "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CredentialDialogMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update CredentialDialog"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CredentialDialogMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CredentialDialogMachine"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\psmachine_64.dll"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\psmachine_64.dll"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{86FA2729-397E-41E1-95BB-4F18BEBD5CD3}\INPROCHANDLER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\psmachine_64.dll"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{86FA2729-397E-41E1-95BB-4F18BEBD5CD3}\INPROCHANDLER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{59DD293F-6B10-49A7-B566-504B2EF90A43}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.273.21\psmachine_64.dll"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{59DD293F-6B10-49A7-B566-504B2EF90A43}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{59DD293F-6B10-49A7-B566-504B2EF90A43}"; Key: "(DEFAULT)"; Value: "PSFactoryBuffer"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}"; Key: "(DEFAULT)"; Value: "IPolicyStatus5"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003700000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}"; Key: "(DEFAULT)"; Value: "IAppSideBySide"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}"; Key: "(DEFAULT)"; Value: "IPackage"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}"; Key: "(DEFAULT)"; Value: "IPolicyStatus3"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}"; Key: "(DEFAULT)"; Value: "IPolicyStatusValue"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003200000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}"; Key: "(DEFAULT)"; Value: "IPolicyStatus6"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003800000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}"; Key: "(DEFAULT)"; Value: "IApp2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003300000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}"; Key: "(DEFAULT)"; Value: "IProcessLauncher"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3600000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}"; Key: "(DEFAULT)"; Value: "IAppCommand2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003200000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}"; Key: "(DEFAULT)"; Value: "IPolicyStatus7"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003900000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}"; Key: "(DEFAULT)"; Value: "IAppVersion"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}"; Key: "(DEFAULT)"; Value: "IBrowserHttpRequest2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}"; Key: "(DEFAULT)"; Value: "IGoogleUpdateCore"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}"; Key: "(DEFAULT)"; Value: "ICoCreateAsyncStatus"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}"; Key: "(DEFAULT)"; Value: "IAppBundle"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003100000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}"; Key: "(DEFAULT)"; Value: "IAppWeb"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003700000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}"; Key: "(DEFAULT)"; Value: "IJobObserver2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}"; Key: "(DEFAULT)"; Value: "ICurrentState"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}"; Key: "(DEFAULT)"; Value: "ICredentialDialog"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}"; Key: "(DEFAULT)"; Value: "IPolicyStatus4"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003600000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}"; Key: "(DEFAULT)"; Value: "IPolicyStatus"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003600000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}"; Key: "(DEFAULT)"; Value: "IJobObserver"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003300000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}"; Key: "(DEFAULT)"; Value: "IApp"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003100000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}"; Key: "(DEFAULT)"; Value: "ICoCreateAsync"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}"; Key: "(DEFAULT)"; Value: "IAppCommand"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003100000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}"; Key: "(DEFAULT)"; Value: "IRegistrationUpdateHook"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3800000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}"; Key: "(DEFAULT)"; Value: "IAppCommandWeb"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003100000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}"; Key: "(DEFAULT)"; Value: "IAppBundleWeb"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}"; Key: "(DEFAULT)"; Value: "IAppUnified"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3WebSecurity"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}"; Key: "(DEFAULT)"; Value: "IProgressWndEvents"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3900000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}"; Key: "(DEFAULT)"; Value: "IPolicyStatus2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003300000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3Web"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3800000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}"; Key: "(DEFAULT)"; Value: "IProcessLauncher2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3700000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{59DD293F-6B10-49A7-B566-504B2EF90A43}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}"; Key: "(DEFAULT)"; Value: "IAppVersionWeb"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEUPDATE\PROXY"; Key: "SOURCE"; Value: "direct"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}"; Key: "EXPERIMENT_CONTROL_LABELS"; Value: "000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "LASTECSETAG"; Value: ""I0Eahb6vIPpgGgsEo5/z7CmIlO3qcEVrRky9oP2+WOE=""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "ECSEXPIRYCONFIG"; Value: "https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.273.21?clientId=s:D72CCD18-9555-46CE-BE82-DD29EB26E920&appChannel_edgeupdate=6&appConsentState_edgeupdate=0&appDayOfInstall_edgeupdate=0&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeDuration_edgeupdate=0&appInstallTimeDiffSec_edgeupdate=0&appIsPinnedSystem_edgeupdate=false&appLastLaunchCount_edgeupdate=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appVersion_edgeupdate=1.3.273.21&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=8&hwPhysmemory=8&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=Ut7d4Nyx1&oemProductName=8au4Bc4m5r&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.16299.248&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=otherinstallcmd&requestIsMachine=true&requestOmahaShellVersion=1.3.273.21&requestOmahaVersion=1.3.273.21&experimentationmode=2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "ECSEXPIRYTIME"; Value: "FE0EBE6A00"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CURRENTSTATE"; Key: "STATEVALUE"; Value: "0200000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\PERSISTEDPINGS\{5A350602-0A60-4AB8-B983-D217EB4B2817}"; Key: "PERSISTEDPINGSTRING"; Value: ""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\PERSISTEDPINGS\{5A350602-0A60-4AB8-B983-D217EB4B2817}"; Key: "PERSISTEDPINGTIME"; Value: "134353105749906753"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\PERSISTEDPINGS\{6ADC3954-E443-4917-BEE8-27CE73F4E5BB}"; Key: "PERSISTEDPINGSTRING"; Value: ""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\PERSISTEDPINGS\{6ADC3954-E443-4917-BEE8-27CE73F4E5BB}"; Key: "PERSISTEDPINGTIME"; Value: "134353105755375562"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")66:Te64,Found string "RegEnumValueW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: ADVAPI32.DLL) Found string "RegEnumKeyW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: ADVAPI32.DLL) Found string "RegQueryValueExW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: ADVAPI32.DLL) Found string "RegSetValueExW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: ADVAPI32.DLL) Found string "RegCloseKey" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: ADVAPI32.DLL) Found string "RegDeleteValueW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: ADVAPI32.DLL) Found string "RegDeleteKeyW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: ADVAPI32.DLL) Found string "AdjustTokenPrivileges" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: ADVAPI32.DLL) Found string "LookupPrivilegeValueW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: ADVAPI32.DLL) Found string "OpenProcessToken" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: ADVAPI32.DLL) Found string "RegOpenKeyExW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: ADVAPI32.DLL) Found string "RegCreateKeyExW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: ADVAPI32.DLL) Found string "SHFileOperationW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: SHELL32.DLL) Found string "SHGetFileInfoW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: WINDOWS.STORAGE.DLL) Found string "SHBrowseForFolderW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: SHELL32.DLL) Found string "SHGetPathFromIDListW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: WINDOWS.STORAGE.DLL) Found string "ShellExecuteExW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: WINDOWS.STORAGE.DLL) Found string "CoTaskMemFree" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: COMBASE.DLL) Found string "IIDFromString" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: COMBASE.DLL) Found string "CoCreateInstance" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: COMBASE.DLL) Found string "OleUninitialize" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: OLE32.DLL) Found string "OleInitialize" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: OLE32.DLL) Found string "EndPaint" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: USER32.DLL) Found string "DrawTextW" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: USER32.DLL) Found string "FillRect" (Source: 429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe, API is part of module: USER32.DLL)67:T583,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "MicrosoftEdgeUpdate.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "MicrosoftEdgeUpdate.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "MicrosoftEdgeUpdate.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "MicrosoftEdgeUpdate.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "MicrosoftEdgeUpdate.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "MicrosoftEdgeUpdate.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "MicrosoftEdgeUpdate.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini"68:T5abf,"msedgeupdate.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdate.dll]- [targetUID: 00000000-00007188] "MicrosoftEdgeUpdateSetup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateSetup.exe]- [targetUID: 00000000-00002636] "Muca.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\Muca.dll]- [targetUID: 00000000-00002636] "psuser_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psuser_64.dll]- [targetUID: 00000000-00002636] "psmachine_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psmachine_64.dll]- [targetUID: 00000000-00001148] "psmachine_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psmachine_arm64.dll]- [targetUID: 00000000-00002636] "psuser_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psuser_arm64.dll]- [targetUID: 00000000-00002636] "psuser.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psuser.dll]- [targetUID: 00000000-00002636] "psmachine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\psmachine.dll]- [targetUID: 00000000-00002636] "MicrosoftEdgeUpdateCore.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateCore.exe]- [targetUID: 00000000-00002636] "MicrosoftEdgeUpdateComRegisterShell64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe]- [targetUID: 00000000-00002636] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00007188] "MicrosoftEdgeComRegisterShellARM64.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) ARM64 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeComRegisterShellARM64.exe]- [targetUID: 00000000-00002636] "MicrosoftEdgeUpdateOnDemand.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateOnDemand.exe]- [targetUID: 00000000-00002636] "MicrosoftEdgeUpdateBroker.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateBroker.exe]- [targetUID: 00000000-00002636] "msedgeupdateres_de.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_de.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_el.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_el.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ml.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ml.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_lb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_lb.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_it.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_it.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ca.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ca.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_fr-CA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fr-CA.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_gd.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_gd.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_fr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fr.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_pl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_pl.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ca-Es-VALENCIA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ca-Es-VALENCIA.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_nl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_nl.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ka.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ka.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_kn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_kn.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_bn-IN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bn-IN.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_mk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_mk.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sr-Cyrl-BA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sr-Cyrl-BA.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ro.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ro.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_bg.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bg.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_bn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bn.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_or.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_or.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_az.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_az.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_hu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_hu.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_fil.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fil.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_mt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_mt.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_hr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_hr.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_es-419.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_es-419.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_af.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_af.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sl.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sr.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_as.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_as.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_pa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_pa.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_pt-PT.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_pt-PT.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sv.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_eu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_eu.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_lv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_lv.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_nn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_nn.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_pt-BR.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_pt-BR.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_uk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_uk.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_gu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_gu.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ga.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ga.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_gl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_gl.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_bs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bs.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_hi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_hi.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ne.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ne.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ta.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ta.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_te.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_te.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_es.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_es.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sr-Cyrl-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sr-Cyrl-RS.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ur.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ur.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sr-Latn-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sr-Latn-RS.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_da.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_da.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sk.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_quz.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_quz.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_vi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_vi.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ms.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ms.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_cs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_cs.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_id.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_id.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_lt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_lt.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_fi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fi.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_is.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_is.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_cy.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_cy.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_sq.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sq.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_mr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_mr.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_et.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_et.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ru.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ru.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_nb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_nb.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_tr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_tr.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_kk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_kk.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_mi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_mi.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_tt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_tt.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_kok.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_kok.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_th.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_th.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_fa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fa.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_lo.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_lo.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_en-GB.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_en-GB.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_en.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_en.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_km.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_km.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ug.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ug.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ar.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ar.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_iw.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_iw.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ja.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ja.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_am.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_am.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_ko.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ko.dll]- [targetUID: 00000000-00002636] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe]- [targetUID: 00000000-00002636] "msedgeupdateres_zh-CN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_zh-CN.dll]- [targetUID: 00000000-00002636] "msedgeupdateres_zh-TW.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_zh-TW.dll]- [targetUID: 00000000-00002636] "NSISdl.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nse29AC.tmp\NSISdl.dll]- [targetUID: 00000000-00000064] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nse29AC.tmp\System.dll]- [targetUID: 00000000-00000064] "nsDialogs.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nse29AC.tmp\nsDialogs.dll]- [targetUID: 00000000-00000064] "MicrosoftEdgeWebview2Setup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%TEMP%\MicrosoftEdgeWebview2Setup.exe]- [targetUID: 00000000-00000064] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00007188] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EU4725.tmp\CopilotUpdate.exe]- [targetUID: 00000000-00002636]69:Tb238,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" wrote 12288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp\System.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" wrote 9728 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp\nsDialogs.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" wrote 15360 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp\NSISdl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdate.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\CopilotUpdate.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdate.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\Muca.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateBroker.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateOnDemand.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeComRegisterShellARM64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\psmachine.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\psmachine_64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\psmachine_arm64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\psuser.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\psuser_64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\psuser_arm64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateCore.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_am.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ar.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bg.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bn.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ca.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_cs.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_da.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_de.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_el.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_en.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_en-GB.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_es.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_es-419.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_et.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fa.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fil.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_gu.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_hi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_hr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_hu.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_id.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_is.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_it.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_iw.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ja.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_kn.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ko.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_lt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_lv.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ml.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_mr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ms.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_nb.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_nl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_pl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_pt-BR.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_pt-PT.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ro.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ru.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sv.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ta.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_te.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_th.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_tr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_uk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ur.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_vi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_zh-CN.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_zh-TW.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_af.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_as.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_az.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bn-IN.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bs.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ca-Es-VALENCIA.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_cy.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_eu.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_fr-CA.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ga.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_gd.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_gl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ka.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_kk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_km.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_kok.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_lb.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_lo.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_mi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_mk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_mt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ne.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_nn.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_or.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_pa.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_quz.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sq.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sr-Cyrl-BA.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sr-Cyrl-RS.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_sr-Latn-RS.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_tt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ug.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeUpdate.exe" wrote 22872 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...6a:Tc94,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsj297B.tmp" for deletion "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp" for deletion "MicrosoftEdgeWebview2Setup.exe" marked "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\CopilotUpdate.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\EdgeUpdate.dat" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeComRegisterShellARM64.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdate.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateBroker.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateComRegisterShell64.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateCore.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateOnDemand.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateSetup.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdate.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_af.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_am.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_ar.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_as.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_az.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_bg.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_bn-IN.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_bn.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_bs.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_ca-Es-VALENCIA.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_ca.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_cs.dll" for deletion6b:Tc8c,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsj297B.tmp" with delete access "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nse29AC.tmp" with delete access "MicrosoftEdgeWebview2Setup.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdate.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\CopilotUpdate.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdate.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\Muca.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateCore.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeComRegisterShellARM64.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\NOTICE.TXT" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\EdgeUpdate.dat" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_af.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_am.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ar.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_as.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_az.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bg.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bn.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bn-IN.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_bs.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ca.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_ca-Es-VALENCIA.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_cs.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\msedgeupdateres_cy.dll" with delete access6c:Td04,"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" (Handle: 1072) "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" (Handle: 1072) "MicrosoftEdgeWebview2Setup.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdate.exe" (Handle: 564) "MicrosoftEdgeWebview2Setup.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\Temp\EU4725.tmp\MicrosoftEdgeUpdate.exe" (Handle: 564) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 836) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 836) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 876) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 876) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 764) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 764) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 1200) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 1200) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 576) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 576) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 772) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 772) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 768) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.273.21\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 768) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 1004) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 1004)6d:T1047,Spawned process "429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe" (UID: 00000000-00000064) Spawned process "MicrosoftEdgeWebview2Setup.exe" with commandline "/silent /install" (UID: 00000000-00001892) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"" (UID: 00000000-00002636) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regsvc" (UID: 00000000-00006444) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regserver" (UID: 00000000-00006072) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00007124) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00002004) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00001148) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNzMuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4yNzMuMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkQ4N0Q0MzItNDJCQy00RDNELTk1MkQtODIxOTA2MzdBOTZEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBNUU4OTRGQi01NzY4LTRCRUUtQkJERi0xMjdBMEFFM0M4QTV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE2Mjk5LjI0OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJVdDdkNE55eDEiIHByb2R1Y3RfbmFtZT0iOGF1NEJjNG01ciIvPjxleHAgZXRhZz0iJnF1b3Q7K1pGQWozU09JSTVCSnpvR3V6OE9wcjBoWjhIL3JEenFiL1FWcjNQWWg0ST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIyMS4zIiBuZXh0dmVyc2lvbj0iMS4zLjI3My4yMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM2ODUxNzQ0MDIiIGluc3RhbGxfdGltZV9tcz0iMjUwMzIiLz48L2FwcD48L3JlcXVlc3Q-" (UID: 00000000-00007188) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{6D87D432-42BC-4D3D-952D-82190637A96D}" /silent" (UID: 00000000-00005256) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/svc" (UID: 00000000-00007376) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNzMuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4yNzMuMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkQ4N0Q0MzItNDJCQy00RDNELTk1MkQtODIxOTA2MzdBOTZEfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NkFEQzM5NTQtRTQ0My00OTE3LUJFRTgtMjdDRTczRjRFNUJCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNjI5OS4yNDgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iVXQ3ZDROeXgxIiBwcm9kdWN0X25hbWU9IjhhdTRCYzRtNXIiLz48ZXhwIGV0YWc9IiZxdW90O0kwRWFoYjZ2SVBwZ0dnc0VvNS96N0NtSWxPM3FjRVZyUmt5OW9QMitXT0U9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjE0NC4wLjc1NTkuMTMzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkhLRkwiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyNDEiIGluc3RhbGxkYXRldGltZT0iMTc2OTk1MzYxMyIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMTY0NzQwNDY3NDQ3MDAwMCIgZmlyc3RfZnJlX3NlZW5fdGltZT0iMTMyOTU2NDA4MTYyMjk2NTQwIiBmaXJzdF9mcmVfc2Vlbl92ZXJzaW9uPSIxMDAuMC4xMTg1LjUwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTUxMDc4MTY3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzc0NzIwNTg1OSIvPjwvYXBwPjwvcmVxdWVzdD4" (UID: 00000000-00008076)6e:T400,AAABAAEAICAQTAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAA/4iIiIiI8AAAAAAAAAAA+Id3d3d3d4j/AAAAAAAAD4d3d4iIiId3ePAAAAAAAPh3eIiIiIiIh3ePAAAAAAiHd4iI/4eIiIiHeIAAAAD4d3iIj/hmCPiIiHePAAAPh3d4iI+H5maIiIh3ePAACHd3iIiIbu7mCIiIh3eAAPh3d4iIh+7u5meIiIh3jwCHd3iIiIiIiOZ4iIiId3gPh3d4iIiIiIiGeIiIiHd4+Hd3eIiIiIiIhniIiIiHd4h3d3iIiIh4iIeIiIiIh3eId3d4iIiIiIiIiIiIiHd3iHd3iIiIiIiIiIiIiIiHd4h3d4iIiIiIiIiIiIiId3eId3d4iIiIiIiId3d3d3d2iHd3eIiIiIiIiId3d3d3d4h3d3eIiIiIiIiId3d3d2eId3d4iI+IiIiIiIiIh3d3j3d3iI///4iI////+IiIh4+HeIj/////iP/////4iHjwh3eI+Ih4h3eHh3d/+Ih4APh3iPiHGHeBgYeHP/+HjwAId3j4h4iIiIeIiI/4h48AD4d4iIiIiIiI+IiP+HjwAAD4d4iP/////////4ePAAAAD4d4iP////////h4gAAAAAD4d3eIiP///4iHjwAAAAAAD4h3d4iIiIh3iPAAAAAAAAAPiHd3d3d3iPAAAAAAAAAAAA/4iIiIiPAAAAAAD/gAP//gAAf/wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAABwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==6f:T4ea,/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNzMuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4yNzMuMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkQ4N0Q0MzItNDJCQy00RDNELTk1MkQtODIxOTA2MzdBOTZEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBNUU4OTRGQi01NzY4LTRCRUUtQkJERi0xMjdBMEFFM0M4QTV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE2Mjk5LjI0OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJVdDdkNE55eDEiIHByb2R1Y3RfbmFtZT0iOGF1NEJjNG01ciIvPjxleHAgZXRhZz0iJnF1b3Q7K1pGQWozU09JSTVCSnpvR3V6OE9wcjBoWjhIL3JEenFiL1FWcjNQWWg0ST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIyMS4zIiBuZXh0dmVyc2lvbj0iMS4zLjI3My4yMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM2ODUxNzQ0MDIiIGluc3RhbGxfdGltZV9tcz0iMjUwMzIiLz48L2FwcD48L3JlcXVlc3Q-70:T400,AAABAAEAICAQTAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAA/4iIiIiI8AAAAAAAAAAA+Id3d3d3d4j/AAAAAAAAD4d3d4iIiId3ePAAAAAAAPh3eIiIiIiIh3ePAAAAAAiHd4iI/4eIiIiHeIAAAAD4d3iIj/hmCPiIiHePAAAPh3d4iI+H5maIiIh3ePAACHd3iIiIbu7mCIiIh3eAAPh3d4iIh+7u5meIiIh3jwCHd3iIiIiIiOZ4iIiId3gPh3d4iIiIiIiGeIiIiHd4+Hd3eIiIiIiIhniIiIiHd4h3d3iIiIh4iIeIiIiIh3eId3d4iIiIiIiIiIiIiHd3iHd3iIiIiIiIiIiIiIiHd4h3d4iIiIiIiIiIiIiId3eId3d4iIiIiIiId3d3d3d2iHd3eIiIiIiIiId3d3d3d4h3d3eIiIiIiIiId3d3d2eId3d4iI+IiIiIiIiIh3d3j3d3iI///4iI////+IiIh4+HeIj/////iP/////4iHjwh3eI+Ih4h3eHh3d/+Ih4APh3iPiHGHeBgYeHP/+HjwAId3j4h4iIiIeIiI/4h48AD4d4iIiIiIiI+IiP+HjwAAD4d4iP/////////4ePAAAAD4d4iP////////h4gAAAAAD4d3eIiP///4iHjwAAAAAAD4h3d4iIiIh3iPAAAAAAAAAPiHd3d3d3iPAAAAAAAAAAAA/4iIiIiPAAAAAAD/gAP//gAAf/wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAABwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==71:T5a9,/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNzMuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4yNzMuMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkQ4N0Q0MzItNDJCQy00RDNELTk1MkQtODIxOTA2MzdBOTZEfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NkFEQzM5NTQtRTQ0My00OTE3LUJFRTgtMjdDRTczRjRFNUJCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNjI5OS4yNDgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iVXQ3ZDROeXgxIiBwcm9kdWN0X25hbWU9IjhhdTRCYzRtNXIiLz48ZXhwIGV0YWc9IiZxdW90O0kwRWFoYjZ2SVBwZ0dnc0VvNS96N0NtSWxPM3FjRVZyUmt5OW9QMitXT0U9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjE0NC4wLjc1NTkuMTMzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkhLRkwiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyNDEiIGluc3RhbGxkYXRldGltZT0iMTc2OTk1MzYxMyIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMTY0NzQwNDY3NDQ3MDAwMCIgZmlyc3RfZnJlX3NlZW5fdGltZT0iMTMyOTU2NDA4MTYyMjk2NTQwIiBmaXJzdF9mcmVfc2Vlbl92ZXJzaW9uPSIxMDAuMC4xMTg1LjUwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTUxMDc4MTY3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzc0NzIwNTg1OSIvPjwvYXBwPjwvcmVxdWVzdD41b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791026285621,"unified_at":"2026-10-03T11:18:05.621Z","metadata":{"hashes":{"sha256":"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","sha1":"77943fe46e4ec3b0f8dcedfdbab9f37bafce5f5b","md5":"1e0ca36e6bf474e88b6864aa25c6a34c","sha512":"9fd6ae72615b8ce296d18b808fc2c16c37693201af0a9126f8ad186f5366c3f4c646e1c4a0fff86fd2eb123f04f9c65df805445f9e77cd9a80354ccb3f82fb22","ssdeep":"98304:MY3DV97R/5TmrS4nyJ6rBlDdbZEmpMqTFevMbcUiu257BB:MYR8+QKiBlhtpLFzbtJqr","ssdeep_chunks":["98304:MY3DV97","98304:Y3DV97R","98304:3DV97R/","98304:DV97R/5","98304:V97R/5T","98304:97R/5Tm","98304:7R/5Tmr","98304:R/5TmrS","98304:/5TmrS4","98304:5TmrS4n","98304:TmrS4ny","98304:mrS4nyJ","98304:rS4nyJ6","98304:S4nyJ6r","98304:4nyJ6rB","98304:nyJ6rBl","98304:yJ6rBlD","98304:J6rBlDd","98304:6rBlDdb","98304:rBlDdbZ","98304:BlDdbZE","98304:lDdbZEm","98304:DdbZEmp","98304:dbZEmpM","98304:bZEmpMq","98304:ZEmpMqT","98304:EmpMqTF","98304:mpMqTFe","98304:pMqTFev","98304:MqTFevM","98304:qTFevMb","98304:TFevMbc","98304:FevMbcU","98304:evMbcUi","98304:vMbcUiu","98304:MbcUiu2","98304:bcUiu25","98304:cUiu257","98304:Uiu257B","98304:iu257BB","196608:MY3DV97","196608:Y3DV97R","196608:3DV97R/","196608:DV97R/5","196608:V97R/5T","196608:97R/5Tm","196608:7R/5Tmr","196608:R/5TmrS","196608:/5TmrS4","196608:5TmrS4n","196608:TmrS4ny","196608:mrS4nyJ","196608:rS4nyJ6","196608:S4nyJ6r","196608:4nyJ6rB","196608:nyJ6rBl","196608:yJ6rBlD","196608:J6rBlDd","196608:6rBlDdb","196608:rBlDdbZ","196608:BlDdbZE","196608:lDdbZEm","196608:DdbZEmp","196608:dbZEmpM","196608:bZEmpMq","196608:ZEmpMqT","196608:EmpMqTF","196608:mpMqTFe","196608:pMqTFev","196608:MqTFevM","196608:qTFevMb","196608:TFevMbc","196608:FevMbcU","196608:evMbcUi","196608:vMbcUiu","196608:MbcUiu2","196608:bcUiu25","196608:cUiu257","196608:Uiu257B","196608:iu257BB","98304:MYR8+QK","98304:YR8+QKi","98304:R8+QKiB","98304:8+QKiBl","98304:+QKiBlh","98304:QKiBlht","98304:KiBlhtp","98304:iBlhtpL","98304:BlhtpLF","98304:lhtpLFz","98304:htpLFzb","98304:tpLFzbt","98304:pLFzbtJ","98304:LFzbtJq","98304:FzbtJqr"],"imphash":"46ce5c12b293febbeb513b196aa7f843","pehash":"77ca41dc63006ce2c5506d7a8519554f605ae0f4"},"file_info":{"file_name":"Posline_0.1.1_x64-setup.exe","file_type":["compressed","7zip"],"file_type_id":"7zip nsis","file_size":4032993,"entropy":8,"compile_timestamp":"2026-09-27T15:28:48","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790830943000,"last_seen":1790836912000,"last_multi_scan":1790836912000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":26398,"raw_size":26624},{"name":".rdata","virtual_address":"0x8000","virtual_size":4952,"raw_size":5120},{"name":".data","virtual_address":"0xa000","virtual_size":129912,"raw_size":1536},{"name":".ndata","virtual_address":"0x2a000","virtual_size":188416},{"name":".rsrc","virtual_address":"0x58000","virtual_size":18008,"raw_size":18432}],"section_names":[".text",".rdata",".data",".ndata",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["urlscanio"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":80},"sandbox_signatures":{"informative_count":205,"suspicious_count":13,"malicious_count":3,"total":221},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware_","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Accesses software policy settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Identified known pipe name"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Copy files into temp folder"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"suspicious","value":"Command line contains long Base64-encoded string"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"MicrosoftEdgeWebview2Setup.exe\" called \"FindResourceW\" with parameter \"102\" - (UID: 00000000-00001892)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"188\" - (UID: 00000000-00002636)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"190\" - (UID: 00000000-00002636)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"189\" - (UID: 00000000-00002636)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"188\" - (UID: 00000000-00006444)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"189\" - (UID: 00000000-00006444)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"2009\" - (UID: 00000000-00006444)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"2008\" - (UID: 00000000-00006444)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"MicrosoftEdgeWebview2Setup.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '15832288'}\" (UID: 00000000-00001892)\n \"MicrosoftEdgeUpdate.exe\" called \"LoadResource with parameter {'hModule': '82575361', 'hResInfo': '82579096'}\" (UID: 00000000-00002636)\n \"MicrosoftEdgeUpdate.exe\" called \"LoadResource with parameter {'hModule': '82575361', 'hResInfo': '82579128'}\" (UID: 00000000-00002636)\n \"MicrosoftEdgeUpdate.exe\" called \"LoadResource with parameter {'hModule': '82575361', 'hResInfo': '82579160'}\" (UID: 00000000-00002636)\n \"MicrosoftEdgeUpdate.exe\" called \"LoadResource with parameter {'hModule': '82575361', 'hResInfo': '82579112'}\" (UID: 00000000-00002636)\n \"MicrosoftEdgeUpdate.exe\" called \"LoadResource with parameter {'hModule': '84410369', 'hResInfo': '84414104'}\" (UID: 00000000-00006444)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"MicrosoftEdgeUpdate.exe\" called \"RemoveDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.221.3 (UID: 00000000-00002636)\n \"MicrosoftEdgeUpdate.exe\" called \"RemoveDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\Offline (UID: 00000000-00002636)\n \"MicrosoftEdgeUpdate.exe\" called \"RemoveDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\Install\\{2C5E8545-77C5-41DE-896B-7EA8CF456EE4} (UID: 00000000-00007376)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"NSISdl.dll\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"NSISdl.dll\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"QRPh(Aes\" (Indicator: \"Aes\"; Source: \"00000000-00000064.00000001.145460.735F1000.00000020.mdmp\")\n Found reference to \"QRPhHAes\" (Indicator: \"Aes\"; Source: \"00000000-00000064.00000001.145460.735F1000.00000020.mdmp\")\n Found reference to \"QRPhhAes\" (Indicator: \"Aes\"; Source: \"00000000-00000064.00000001.145460.735F1000.00000020.mdmp\")\n Found reference to \"CertificatesByOidVal\" (Indicator: \"Oid\"; Source: \"00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp\")\n Found reference to \"Oid>(\" (Indicator: \"Oid\"; Source: \"00000000-00001892.00000000.144050.00F18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000064.00000000.143538.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002636.00000002.148032.04EC0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"MicrosoftEdgeWebview2Setup.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"MicrosoftEdgeWebview2Setup.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"MicrosoftEdgeUpdate.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"MicrosoftEdgeUpdate.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2a","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"MicrosoftEdgeUpdate.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001892-58013-41-00EFEA7A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001892-58013-43-00EF8C13\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001892-58013-50-00EF877F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001892-58013-241-00EF8912\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002636-59209-67-011EDD28\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002636-59209-69-011EB466\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002636-59209-202-011EBF68\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002636-59209-208-011EBDD5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000064.00000000.143538.033D0000.00000004.mdmp, 00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99826","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Command line contains long Base64-encoded string\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00000064.00000000.143538.033D0000.00000004.mdmp, 00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00000064.00000000.143538.033D0000.00000004.mdmp, 00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Posline\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00000064.00000000.143538.033D0000.00000004.mdmp, 00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"psmachine_arm64.dll\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"psuser_arm64.dll\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"MicrosoftEdgeUpdateCore.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002636-00000C2C-1241769747\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002636-00000C2C-1241770106\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002636-00000C2C-1241770521\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosErrorNoTeb\" in \"00000000-00000064.00000001.145460.735F1000.00000020.mdmp\"\n Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000064)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00000064)\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00000064)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000064)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000064)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" called \"IsWow64Process\" with parameter \"64\" - (UID: 00000000-00000064)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$30","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000064)\n \"MicrosoftEdgeWebview2Setup.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001892)\n \"MicrosoftEdgeUpdate.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002636)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000000b310352fb6544c0ef2f015916937701000000080000000100000000003d0300000000100000000000000000000000020000000200000000003d03010000000800000006ec0874e0ef2f01ee13937701000000ee139377080000000000000008000000c687463118f22f01ad9cb77300003d030800000001000000 (UID: 00000000-00000064)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"MicrosoftEdgeUpdate.exe\" called \"LookupAccountSidW\" with param Name LOCAL SERVICE (UID: 00000000-00007376)\n \"MicrosoftEdgeUpdate.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007376)\n \"MicrosoftEdgeUpdate.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00007376)\n \"MicrosoftEdgeUpdate.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007376)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"MicrosoftEdgeUpdate.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00007376)\n \"MicrosoftEdgeUpdate.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00008076)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"kernel32::IsWow64Process2(ps,*i0s,*i)\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000064.00000000.143538.033D0000.00000004.mdmp, 00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp\")\n Found reference to API \"kernel32::IsWow64Process(p-1,*i0s)\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000064.00000000.143538.033D0000.00000004.mdmp, 00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000064.00000000.143538.033D0000.00000004.mdmp, 00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.DLL at 00000000-00001892-58013-515-00EF2329\n FindFirstFileW@KERNEL32.DLL at 00000000-00001892-58013-516-00EF2088\n FindFirstFileExW@KERNEL32.DLL at 00000000-00001892-58013-635-00EFF1E6\n FindFirstFileExW@KERNEL32.DLL at 00000000-00002636-59209-229-011F03D4\n FindNextFileW@KERNEL32.DLL at 00000000-00002636-59209-442-011EC75C\n FindFirstFileExW@KERNEL32.DLL at 00000000-00002636-59209-444-011EC79D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001892-58013-515-00EF2329\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001892-58013-516-00EF2088\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001892-58013-583-00EF865B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002636-59209-530-011EBCB3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001892-58013-515-00EF2329\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001892-58013-516-00EF2088\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001892-58013-583-00EF865B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002636-59209-530-011EBCB3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00001892-58013-525-00EF1F61","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"MicrosoftEdgeWebview2Setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"MicrosoftEdgeWebview2Setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00001892-58013-741-00F0B9B9\n GetSystemInfo@KERNEL32.DLL at 00000000-00002636-59209-499-011EB031","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver Windows 2000 Service Pack 4 eller nyere.\" (Indicator: \"ver \") in Source: 00000000-00001892.00000000.144050.00F18000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00001892-58013-306-00EF132B\n GetProcessHeap@KERNEL32.DLL at 00000000-00002636-59209-55-011F20B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSE29AC.TMP\\NSDIALOGS.DLL\n %PROGRAMFILES%\\(X86)\\MICROSOFT\\EDGEUPDATE\\1.3.273.21\\PSMACHINE.DLL\n %TEMP%\\NSE29AC.TMP\\NSISDL.DLL\n %TEMP%\\NSE29AC.TMP\\SYSTEM.DLL\n %PROGRAMFILES%\\(X86)\\MICROSOFT\\TEMP\\EU4725.TMP\\MSEDGEUPDATE.DLL\n %PROGRAMFILES%\\(X86)\\MICROSOFT\\EDGEUPDATE\\1.3.273.21\\MSEDGEUPDATE.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"\"MicrosoftEdgeUpdate.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\"; Key: \"\"; Value: \"\")\n \"MicrosoftEdgeUpdate.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"MicrosoftEdgeUpdate.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"MicrosoftEdgeUpdate.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\0\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$35","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Packed Executable Download\" (SID: 2014819, Rev: 5, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"SURICATA HTTP unable to match response to request\" (SID: 2221010, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"psmachine_arm64.dll\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"psuser_arm64.dll\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"MicrosoftEdgeUpdateComRegisterShell64.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdate.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeComRegisterShellARM64.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdateOnDemand.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdateBroker.exe\")\n file/memory contains long string(File: \"CopilotUpdate.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$36","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Accesses software policy settings","description":"\"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"F9388EA2C9B7D632B66A2B0B406DF1D37D3901F6\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"F9388EA2C9B7D632B66A2B0B406DF1D37D3901F6\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"MicrosoftEdgeWebview2Setup.exe\" called \"CopyFileW\" to copy %TEMP%\\MicrosoftEdgeWebview2Setup.exe to new location %PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\MicrosoftEdgeUpdateSetup.exe (UID: 00000000-00001892)\n \"MicrosoftEdgeUpdate.exe\" called \"CopyFileW\" to copy %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.273.21\\MicrosoftEdgeUpdate.exe to new location %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe (UID: 00000000-00002636)\n \"MicrosoftEdgeUpdate.exe\" called \"CopyFileW\" to copy %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.273.21\\CopilotUpdate.exe to new location %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\CopilotUpdate.exe (UID: 00000000-00002636)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$37","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"52.123.255.135:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"MicrosoftEdgeUpdate_unsigned.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00001892-58013-309-00F0969E\n WaitForSingleObject@KERNEL32.DLL at 00000000-00001892-58013-478-00EF4873\n WaitForSingleObject@KERNEL32.DLL at 00000000-00001892-58013-540-00EF42F8\n WaitForSingleObject@KERNEL32.DLL at 00000000-00001892-58013-561-00EF4350","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00001892-58013-513-00EF26D3\n LoadLibraryExA@KERNEL32.DLL at 00000000-00001892-58013-751-00F0BB73\n LoadLibraryExW@KERNEL32.DLL at 00000000-00002636-59209-482-011E97EA\n LoadLibraryExA@KERNEL32.DLL at 00000000-00002636-59209-509-011EB1EB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n file/memory contains long string with (Indicator: \"GetLastError\"; File: \"System.dll\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73AA3000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Copy files into temp folder","description":"\"MicrosoftEdgeWebview2Setup.exe\" copies %TEMP%\\MicrosoftEdgeWebview2Setup.exe to temp folder %PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\MicrosoftEdgeUpdateSetup.exe (UID: 00000000-00001892)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-268","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3d","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$3e","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$3f","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: NSISDL/1.2 (Mozilla)\" (Indicator: \"user-agent: \"; Source: \"00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$40","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$41","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73B10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74A80000\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 733C0000\n \"MicrosoftEdgeWebview2Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74A80000\n \"MicrosoftEdgeUpdate.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74A80000\n \"MicrosoftEdgeUpdate.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 733C0000\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 49390000\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 48B90000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 774C0000\n \"MicrosoftEdgeWebview2Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 774C0000\n \"MicrosoftEdgeUpdate.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 774C0000\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 4C8F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$42","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$43","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$44","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"MicrosoftEdgeUpdate.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$45","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" searching for class \"#32770\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$47","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$48","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 661963)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$49","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsp299C.tmp\"\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nse29AC.tmp\\System.dll\"\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nse29AC.tmp\\modern-wizard.bmp\"\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nse29AC.tmp\\nsDialogs.dll\"\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nse29AC.tmp\\NSISdl.dll\"\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MicrosoftEdgeWebview2Setup.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"System.dll\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"MicrosoftEdgeWebview2Setup.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"MicrosoftEdgeUpdate.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"$4a","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"nsp299C.tmp\" has type \"Unknown\" - Location: [%TEMP%\\nsp299C.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$4d","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$4e","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"MicrosoftEdgeUpdate.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007188)\n \"MicrosoftEdgeUpdate.exe\" called \"NtQueueApcThread\" (UID: 00000000-00008076)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" reads file \"c:\\429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$50","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$54","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$55","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsp299c.tmp\"\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nse29ac.tmp\\system.dll\"\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nse29ac.tmp\\modern-wizard.bmp\"\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nse29ac.tmp\\nsdialogs.dll\"\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nse29ac.tmp\\nsisdl.dll\"\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\microsoftedgewebview2setup.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"MicrosoftEdgeWebview2Setup.exe\" writes a file \"C:\\Program Files (x86)\\Microsoft\\Temp\\EU4725.tmp\\EdgeUpdate.dat\"\n \"MicrosoftEdgeWebview2Setup.exe\" writes a file \"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\EdgeUpdate.dat\"\n \"MicrosoftEdgeUpdate.exe\" writes a file \"C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"MicrosoftEdgeUpdate.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /OneCollector/1.0/\" - (UID: 00000000-00007188), \"MicrosoftEdgeUpdate.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /OneCollector/1.0/\" - (UID: 00000000-00008076)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"MicrosoftEdgeUpdate.exe\" called \"InternetReadFile\" with parameter 1024 (UID: 00000000-00007188)\n \"MicrosoftEdgeUpdate.exe\" called \"InternetReadFile\" with parameter 1024 (UID: 00000000-00008076)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"MicrosoftEdgeUpdate.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"30c96f8\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"51269224\"}\n \"MicrosoftEdgeUpdate.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"623a10\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"6346912\"}\n \"MicrosoftEdgeUpdate.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"451b4c0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"MicrosoftEdgeUpdate.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"64b4b8\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"72342688\"}\n \"MicrosoftEdgeUpdate.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"64b4b8\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"72342920\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"MicrosoftEdgeUpdate.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"30c96f8\"\n \"lpReserved\": \"0\"}\n \"MicrosoftEdgeUpdate.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"451b4c0\"\n \"lpReserved\": \"0\"}\n \"MicrosoftEdgeUpdate.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"623a10\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"MicrosoftEdgeUpdate.exe\" called \"InternetOpenA\" (UID: 00000000-00007188)\n \"MicrosoftEdgeUpdate.exe\" called \"InternetOpenW\" (UID: 00000000-00007188)\n \"MicrosoftEdgeUpdate.exe\" called \"InternetOpenA\" (UID: 00000000-00008076)\n \"MicrosoftEdgeUpdate.exe\" called \"InternetOpenW\" (UID: 00000000-00008076)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.3.99.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$57","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$58","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET %s HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")\n Found string \"HTTP/1.0 301 Moved Permanently\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00002636-00000CCE-1241492065\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":3,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec\n Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"52.123.255.135\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00001892-58013-486-00EF28E4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00001148.00000000.145525.E8EF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"GetDCOrgEx\" (Indicator: \"GetDC\"; Source: \"00000000-00000064.00000001.145460.735F1000.00000020.mdmp\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"32074,1516,3025,,RtlGetNtProductType,NTDLL.dll,\"00:37:20.937\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00000064.00000000.143538.033D0000.00000004.mdmp\")\n Found reference to API \"5,,RtlGetNtProductType,NTDLL.dll,\"00:37:24.0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00000064.00000001.145460.033D0000.00000004.mdmp\n 00000000-00000064.00000002.147378.033D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \",,GetKeyState,user32.dll,\"00:37:24.296\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp\")\n Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"MicrosoftEdgeUpdate.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 73520000\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 43C40000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$5a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"MicrosoftEdgeWebview2Setup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"MicrosoftEdgeUpdate.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate logical drives on the computer","description":"\"MicrosoftEdgeUpdate.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"260\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1680","relevance":6,"id":"api-326","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"MicrosoftEdgeUpdate.exe\" called \"GetComputerNameW\" (UID: 00000000-00002636)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"MicrosoftEdgeUpdate.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"MicrosoftEdgeUpdate.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"System.dll\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"IsUserAnAdmin@SHELL32.DLL at 00000000-00001892-58013-522-00EF25E3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00000064.00000001.145460.735F1000.00000020.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp\n 00000000-00000064.00000001.145460.033D0000.00000004.mdmp\n 00000000-00000064.00000002.147378.033D0000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp\n 00000000-00000064.00000001.145460.033D0000.00000004.mdmp\n 00000000-00000064.00000002.147378.033D0000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Posline\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00000064.00000000.143538.033D0000.00000004.mdmp\n 00000000-00000064.00000001.145460.033D0000.00000004.mdmp\n 00000000-00000064.00000002.147378.033D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"empty hostname\" (Indicator: \"hostname\"; File: \"00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")\n Found string \"resolving hostname\" (Indicator: \"hostname\"; File: \"00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")\n Found string \"empty hostname\" (Indicator: \"hostname\"; Source: \"00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")\n Found string \"resolving hostname\" (Indicator: \"hostname\"; Source: \"00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00006444-00000C2C-1244406158\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"MicrosoftEdgeUpdate.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002636)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$61","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; File: \"00000000-00002636.00000002.148032.011E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"USER32::SystemParametersInfo(i0x42,i12,pss,i0)\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000064.00000000.143538.033D0000.00000004.mdmp, 00000000-00000064.00000001.145460.033D0000.00000004.mdmp, 00000000-00000064.00000002.147378.033D0000.00000004.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.73657000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00001892.00000000.144050.00EF1000.00000020.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"MicrosoftEdgeUpdate.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\EDGEUPDATE\")\n \"MicrosoftEdgeUpdate.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\EDGEUPDATE\"; Key: \"EVENTMESSAGEFILE\"; Value: \"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.273.21\\msedgeupdate.dll\"), \"MicrosoftEdgeUpdate.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\EDGEUPDATEM\"), \"MicrosoftEdgeUpdate.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\EDGEUPDATEM\"; Key: \"EVENTMESSAGEFILE\"; Value: \"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.273.21\\msedgeupdate.dll\"), \"MicrosoftEdgeUpdate.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" opened \"\\Device\\KsecDD\"\n \"MicrosoftEdgeUpdate.exe\" opened \"\\Device\\KsecDD\"\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$64","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$65","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; File: \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\")\n Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; Source: \"00000000-00000064.00000000.143538.0040A000.00000004.mdmp, 00000000-00000064.00000001.145460.0040A000.00000004.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00000064.00000001.145460.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000064.00000001.145460.73657000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001892.00000000.144050.00F0C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"NSISdl.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nse29AC.tmp\\NSISdl.dll]- [targetUID: 00000000-00000064]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nse29AC.tmp\\System.dll]- [targetUID: 00000000-00000064]\n \"nsDialogs.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\nse29AC.tmp\\nsDialogs.dll]- [targetUID: 00000000-00000064]\n \"MicrosoftEdgeWebview2Setup.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections\"- Location: [%TEMP%\\MicrosoftEdgeWebview2Setup.exe]- [targetUID: 00000000-00000064]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"modern-wizard.bmp\" has type \"PC bitmap Windows 3.x format 164 x 314 x 4 image size 26376 resolution 2834 x 2834 px/m cbSize 26494 bits offset 118\" and extension \"bmp\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"MicrosoftEdgeWebview2Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/27 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"SizeofResource@KERNEL32.DLL at 00000000-00001892-58013-271-00EF5220\n SizeofResource@KERNEL32.DLL at 00000000-00001892-58013-274-00EF50C0\n SizeofResource@KERNEL32.DLL at 00000000-00001892-58013-276-00EF5010\n SizeofResource@KERNEL32.DLL at 00000000-00001892-58013-278-00EF4FA0\n FindResourceExW@KERNEL32.DLL at 00000000-00001892-58013-313-00EF3484\n FindResourceW@KERNEL32.DLL at 00000000-00001892-58013-314-00EF3794\n LoadResource@KERNEL32.DLL at 00000000-00001892-58013-317-00EF1195\n FindResourceW@KERNEL32.DLL at 00000000-00001892-58013-475-00EF1A73\n FindResourceW@KERNEL32.DLL at 00000000-00001892-58013-498-00EF27AB\n LoadResource@KERNEL32.DLL at 00000000-00001892-58013-511-00EF43D1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$68","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"MicrosoftEdgeUpdate.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\MICROSOFTEDGEUPDATE.EXE\")\n \"MicrosoftEdgeUpdate.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\MICROSOFTEDGEUPDATE.EXE\"; Key: \"DISABLEEXCEPTIONCHAINVALIDATION\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$69","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 52.123.255.135 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"MicrosoftEdgeUpdate.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$6a","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$6b","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"MicrosoftEdgeUpdate.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Command line contains long Base64-encoded string","description":"Commandline contains long base64 encoded string \"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFo.......\" in [Source : MicrosoftEdgeUpdate.exe]\n Commandline contains long base64 encoded string \"PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEi.......\" in [Source : MicrosoftEdgeUpdate.exe]\n Commandline contains long base64 encoded string \"PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjE0NC4wLjc1NTkuMTMz.......\" in [Source : MicrosoftEdgeUpdate.exe]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":5,"id":"string-509","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.273.21\\MicrosoftEdgeUpdateComRegisterShell64.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"MicrosoftEdgeUpdate.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /handoff \"appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&app\" - (UID: 00000000-00002636)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$6c","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$6d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]}],"intel_graph":{"map":{"File:038bc589cad1fbd6943e21ab27153b73ec6251b32f7d82e640ea9a9e701ee653":{"type":"File","value":"038bc589cad1fbd6943e21ab27153b73ec6251b32f7d82e640ea9a9e701ee653"},"File:057573ae322fcc5990c43802bc0c8d62d2e26ad9cd4e126d5a28c6ec50a3acc6":{"type":"File","value":"057573ae322fcc5990c43802bc0c8d62d2e26ad9cd4e126d5a28c6ec50a3acc6"},"File:09fb4a0580446d63626dcbfa78e9ec23bacb05ef16f565570136651480c8aa07":{"type":"File","value":"09fb4a0580446d63626dcbfa78e9ec23bacb05ef16f565570136651480c8aa07"},"File:0a00b9e49a3708c09fa919461b40ebae1842a2a647cbfc2b7566b17d7b178151":{"type":"File","value":"0a00b9e49a3708c09fa919461b40ebae1842a2a647cbfc2b7566b17d7b178151"},"File:0e82034abd5c05b1512f1f7f5f54b59a6f8560aa2c4f53f6dcb6b89de5597ba5":{"type":"File","value":"0e82034abd5c05b1512f1f7f5f54b59a6f8560aa2c4f53f6dcb6b89de5597ba5"},"File:0fed6f784ed06e1998b57b80944efa5c224089eb384ee90197f7aea9af4020bd":{"type":"File","value":"0fed6f784ed06e1998b57b80944efa5c224089eb384ee90197f7aea9af4020bd"},"File:10ec97f777f4d2e919fb0c30fb50906c613ff6b068d3b487aa7c06902d668f4b":{"type":"File","value":"10ec97f777f4d2e919fb0c30fb50906c613ff6b068d3b487aa7c06902d668f4b"},"File:1cf548ce9813a5c2fa877129e07c31ede4eb0636d1bc7c8d51139841012e53ff":{"type":"File","value":"1cf548ce9813a5c2fa877129e07c31ede4eb0636d1bc7c8d51139841012e53ff"},"File:1d597e070228341a1ef4f01c9c43f052c616f33d0ee3c6e329613ecf06611101":{"type":"File","value":"1d597e070228341a1ef4f01c9c43f052c616f33d0ee3c6e329613ecf06611101"},"File:1e3f03e1d22635fab20a4833a1fd783992791de5691ad22f652eea067dbee7da":{"type":"File","value":"1e3f03e1d22635fab20a4833a1fd783992791de5691ad22f652eea067dbee7da"},"File:21ef3ef513de4820d81fc929f4b9fdad8370f7a527c6cd504c74101e1241740d":{"type":"File","value":"21ef3ef513de4820d81fc929f4b9fdad8370f7a527c6cd504c74101e1241740d"},"File:23797a0883bce5aadd214ba2c9e25c9faeeadccc44331f71e674c4498dd8f5e8":{"type":"File","value":"23797a0883bce5aadd214ba2c9e25c9faeeadccc44331f71e674c4498dd8f5e8"},"File:23b13f2af66c35cfa4794fa8aba15026d9aa870b24bf692bd1430345a7dc8885":{"type":"File","value":"23b13f2af66c35cfa4794fa8aba15026d9aa870b24bf692bd1430345a7dc8885"},"File:241c58fc9689de700b93204e4726c8288a35acdc2f887914c8237a9282445e18":{"type":"File","value":"241c58fc9689de700b93204e4726c8288a35acdc2f887914c8237a9282445e18"},"File:25e80eba83fbcde50538e73fd8c91da9afc9e5555b40328c1bc9736c27e093e8":{"type":"File","value":"25e80eba83fbcde50538e73fd8c91da9afc9e5555b40328c1bc9736c27e093e8"},"File:26447ee180ae59da579b1a2397cb2acdc55cf27af0470fbd688e60e6b063ebf6":{"type":"File","value":"26447ee180ae59da579b1a2397cb2acdc55cf27af0470fbd688e60e6b063ebf6"},"File:298e4a080809193cebb91c1272972d6183bd89df4389a904127c4615e1ae03f8":{"type":"File","value":"298e4a080809193cebb91c1272972d6183bd89df4389a904127c4615e1ae03f8"},"File:2c914aff7325a845a34e26af84f40a0bdb3d8a420bac791bd0d0a5a6fce1e3e3":{"type":"File","value":"2c914aff7325a845a34e26af84f40a0bdb3d8a420bac791bd0d0a5a6fce1e3e3"},"File:2cc740ec2415133c375995b3addefd9187a5500c09c165cb90d0da17d0cf68f8":{"type":"File","value":"2cc740ec2415133c375995b3addefd9187a5500c09c165cb90d0da17d0cf68f8"},"File:2d106c2cf145114480af7e746c9ad0a95acade327b3a1ff6fab073488a025a51":{"type":"File","value":"2d106c2cf145114480af7e746c9ad0a95acade327b3a1ff6fab073488a025a51"},"File:3448cdfb65813ace41c2faa8f7431a22848b348d86225cf789bdc62378afaf7d":{"type":"File","value":"3448cdfb65813ace41c2faa8f7431a22848b348d86225cf789bdc62378afaf7d"},"File:37a942badb881296f1ab6b7f5a8c5b4af26852cc0dae6989f7cde307fc35b9e3":{"type":"File","value":"37a942badb881296f1ab6b7f5a8c5b4af26852cc0dae6989f7cde307fc35b9e3"},"File:39870682e7d1c026cd2b33ca25591db28250dde17de7eb1feec404222d534ffc":{"type":"File","value":"39870682e7d1c026cd2b33ca25591db28250dde17de7eb1feec404222d534ffc","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:39a37ad5b20dc8cde98e6db5159bab36df0493742426e16a7baf85069fc0f2c6":{"type":"File","value":"39a37ad5b20dc8cde98e6db5159bab36df0493742426e16a7baf85069fc0f2c6"},"File:3aad48f8a2e8a134bd28bb0bac0249421060c33c02dd497f05289725774871fa":{"type":"File","value":"3aad48f8a2e8a134bd28bb0bac0249421060c33c02dd497f05289725774871fa"},"File:3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2":{"type":"File","value":"3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118","filetype_short":"BMP","mime_type":"image/bmp"},"File:3b345282c85dc1a420f3e7235a33c7e6e7e7b1650fe240bb6c47a4028f1c3016":{"type":"File","value":"3b345282c85dc1a420f3e7235a33c7e6e7e7b1650fe240bb6c47a4028f1c3016"},"File:3d6999726ea3ea5536725d8d3aac4fdcc82a4ebd2647dabb10f18d3bdab3538c":{"type":"File","value":"3d6999726ea3ea5536725d8d3aac4fdcc82a4ebd2647dabb10f18d3bdab3538c"},"File:3db4d1527e6661060d3a27fe4e334d422008e36d588518e59b852f40a54e5c6f":{"type":"File","value":"3db4d1527e6661060d3a27fe4e334d422008e36d588518e59b852f40a54e5c6f"},"File:3f110eca1f415d23408cfe2bace5cd1ccbc683d26491b67edf09d950734a7881":{"type":"File","value":"3f110eca1f415d23408cfe2bace5cd1ccbc683d26491b67edf09d950734a7881"},"File:4079e73d1c9e890fbcfd5ba3ed0c66d8f4685f653d8c330abf3b662a0ea2a0fa":{"type":"File","value":"4079e73d1c9e890fbcfd5ba3ed0c66d8f4685f653d8c330abf3b662a0ea2a0fa"},"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510":{"type":"File","value":"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:4356fb1b6bd3f05423a41b61d4f8e1cdddf310f1b28d6c3405ea516012b50fc2":{"type":"File","value":"4356fb1b6bd3f05423a41b61d4f8e1cdddf310f1b28d6c3405ea516012b50fc2"},"File:48a7b31419a8eb4fffdc7b6a02f6b4dfda60687fc897116be15370e10c2b66a7":{"type":"File","value":"48a7b31419a8eb4fffdc7b6a02f6b4dfda60687fc897116be15370e10c2b66a7"},"File:54195428a3296edea80e1590d9f3eeba59a730e08b5474e30b98804faadf200c":{"type":"File","value":"54195428a3296edea80e1590d9f3eeba59a730e08b5474e30b98804faadf200c"},"File:55a2d56896ba274d10d629a0cb01d94149f5c213ce9ccf9b2811358d1eeb19e7":{"type":"File","value":"55a2d56896ba274d10d629a0cb01d94149f5c213ce9ccf9b2811358d1eeb19e7"},"File:575dac2424106af5728032fe5a7b2271249fdde16f4d280c4e7f005d8e7ad787":{"type":"File","value":"575dac2424106af5728032fe5a7b2271249fdde16f4d280c4e7f005d8e7ad787"},"File:57c2103e33f101fa24c09eec651159c89804c7b272cfcb9e7bd543a82828d54e":{"type":"File","value":"57c2103e33f101fa24c09eec651159c89804c7b272cfcb9e7bd543a82828d54e"},"File:5834e08c71ca0fb9ed0d3a12603ddfcca1dc94d467e21282508d02ea522512d4":{"type":"File","value":"5834e08c71ca0fb9ed0d3a12603ddfcca1dc94d467e21282508d02ea522512d4"},"File:586f51086e86db23a6c6a76bb5a54ad5a4dacf42326f5f1ba6bc4f5b4a36fb74":{"type":"File","value":"586f51086e86db23a6c6a76bb5a54ad5a4dacf42326f5f1ba6bc4f5b4a36fb74"},"File:59276e78b985afe1efdeb25f6ddeba8d2465f4d3ce5afce71d290b713f8b85a7":{"type":"File","value":"59276e78b985afe1efdeb25f6ddeba8d2465f4d3ce5afce71d290b713f8b85a7"},"File:5adada69b4dfb307ad101361fff6d4fa28db2cf6b14f9e24b0311559b48d3d78":{"type":"File","value":"5adada69b4dfb307ad101361fff6d4fa28db2cf6b14f9e24b0311559b48d3d78"},"File:5c301f33b684a73d0d7cf4870d48ccf77293b1791b8e2bb0794e7792b7311760":{"type":"File","value":"5c301f33b684a73d0d7cf4870d48ccf77293b1791b8e2bb0794e7792b7311760"},"File:613e8e8ecc239919dc4ec299eae3941a1d288410fd6e8db48f5cc8ec76225b2e":{"type":"File","value":"613e8e8ecc239919dc4ec299eae3941a1d288410fd6e8db48f5cc8ec76225b2e"},"File:65fbec1b3edf7c5730002b2e4bccf88ef578dbda2ad206dd9695567180e61c22":{"type":"File","value":"65fbec1b3edf7c5730002b2e4bccf88ef578dbda2ad206dd9695567180e61c22"},"File:69662869ed1c32f181e79e40fd557d96e6fbaa6e645664c783215a124b02c2e3":{"type":"File","value":"69662869ed1c32f181e79e40fd557d96e6fbaa6e645664c783215a124b02c2e3"},"File:6a3dd957aae4f6cdc0e175c57bdb62aacdb6683c09c123ee0dcae9f11224f3d3":{"type":"File","value":"6a3dd957aae4f6cdc0e175c57bdb62aacdb6683c09c123ee0dcae9f11224f3d3"},"File:6a9947600efb9bab9aa04905308dcedf273a76330b4d77592c4dd40fc6bea9b0":{"type":"File","value":"6a9947600efb9bab9aa04905308dcedf273a76330b4d77592c4dd40fc6bea9b0"},"File:6b3494af1f35f004a36fdb4a619f406c52ea16d976f063117066e2992bd889dc":{"type":"File","value":"6b3494af1f35f004a36fdb4a619f406c52ea16d976f063117066e2992bd889dc"},"File:6caf89d2b49d54b0354e9b6188235c16c4c5f6102598e3f5fab0c38e51eef8c2":{"type":"File","value":"6caf89d2b49d54b0354e9b6188235c16c4c5f6102598e3f5fab0c38e51eef8c2"},"File:7721edd3e5672b9a3a28f1f5648fb315942d83cef3537750004bda956b86e5de":{"type":"File","value":"7721edd3e5672b9a3a28f1f5648fb315942d83cef3537750004bda956b86e5de"},"File:7f1713a4bcc1b2a9f2ad27e6ff1b06833a5576064db5516569e9292d136fba31":{"type":"File","value":"7f1713a4bcc1b2a9f2ad27e6ff1b06833a5576064db5516569e9292d136fba31"},"File:81f4ada0ade87b84fddcf8d2a965b2b6d9f6b014b0dddf9843ab5f492231cdd5":{"type":"File","value":"81f4ada0ade87b84fddcf8d2a965b2b6d9f6b014b0dddf9843ab5f492231cdd5"},"File:83d7e337c0cbbf3584f097537f9c88b4ed59503da91e2ec97e9304358ca11f88":{"type":"File","value":"83d7e337c0cbbf3584f097537f9c88b4ed59503da91e2ec97e9304358ca11f88"},"File:85369ca677bca4586eb6ebc1e644a29dd495b9270f6d2a96bfabf9938fc49d85":{"type":"File","value":"85369ca677bca4586eb6ebc1e644a29dd495b9270f6d2a96bfabf9938fc49d85"},"File:87de0b32ff42dcf40ab0249fe4afdbe247805ef626f94758c207098df7dcb413":{"type":"File","value":"87de0b32ff42dcf40ab0249fe4afdbe247805ef626f94758c207098df7dcb413"},"File:89432d0428817701b09e5c8c2572f8950c4e9b7829e06ab337818cc8a295d9f0":{"type":"File","value":"89432d0428817701b09e5c8c2572f8950c4e9b7829e06ab337818cc8a295d9f0"},"File:8acabe18a2fb276fa0f263ca2370a5a26f6c9c67e70c2656dcdce428b7c4f8b2":{"type":"File","value":"8acabe18a2fb276fa0f263ca2370a5a26f6c9c67e70c2656dcdce428b7c4f8b2"},"File:915de620e1ebb726cebe4f4a7d6fac9819e6178726d7998e571ad84f9e3e33d2":{"type":"File","value":"915de620e1ebb726cebe4f4a7d6fac9819e6178726d7998e571ad84f9e3e33d2"},"File:932a48911da78cc9eb8aa600ca3d64dc1987d885a26a0bca0a4dd20030c1d5cb":{"type":"File","value":"932a48911da78cc9eb8aa600ca3d64dc1987d885a26a0bca0a4dd20030c1d5cb"},"File:95d78758cb03094b9bd259e80a64795306c9404e19aec67e6f0beb2e6cd70aa9":{"type":"File","value":"95d78758cb03094b9bd259e80a64795306c9404e19aec67e6f0beb2e6cd70aa9"},"File:9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb":{"type":"File","value":"9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:9f5259dbc5e1d1873ea9a935eef6c2e0b33c25c053a65de42921145c96214820":{"type":"File","value":"9f5259dbc5e1d1873ea9a935eef6c2e0b33c25c053a65de42921145c96214820"},"File:a5234ab08099e4866850b7bb516d238aa02b8e3a09c03ce838b3f269cafa43a0":{"type":"File","value":"a5234ab08099e4866850b7bb516d238aa02b8e3a09c03ce838b3f269cafa43a0"},"File:a68eb6767b99f0ffc971a7aab91feda6ff96012b0808f7cda31bd1822dcec761":{"type":"File","value":"a68eb6767b99f0ffc971a7aab91feda6ff96012b0808f7cda31bd1822dcec761"},"File:a8ea38889a8f198d23b913ea8523f4e4776e65748df4cb29960b78943141dc42":{"type":"File","value":"a8ea38889a8f198d23b913ea8523f4e4776e65748df4cb29960b78943141dc42"},"File:afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432":{"type":"File","value":"afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]},"filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:b14d7f263df666399242bfb5c127e8b3814cd7c6f2df216eb532e7928ad85b31":{"type":"File","value":"b14d7f263df666399242bfb5c127e8b3814cd7c6f2df216eb532e7928ad85b31"},"File:b1ef179d25d6199f4d8984044ac46586da5812621969d3771aecc7cb9b20b77c":{"type":"File","value":"b1ef179d25d6199f4d8984044ac46586da5812621969d3771aecc7cb9b20b77c"},"File:b2b7b9f716c2e08236f5f370fc785b111c6341c6ece96cdb7a274e04e0ec8740":{"type":"File","value":"b2b7b9f716c2e08236f5f370fc785b111c6341c6ece96cdb7a274e04e0ec8740"},"File:b3124378502c728fed05ddc4e137891470d78514b0d8b796eabb47d6d6b2284b":{"type":"File","value":"b3124378502c728fed05ddc4e137891470d78514b0d8b796eabb47d6d6b2284b"},"File:b48ff6effdb0c584629f80c4dbe0c172239ae46f8d78503dd618b946b363aad4":{"type":"File","value":"b48ff6effdb0c584629f80c4dbe0c172239ae46f8d78503dd618b946b363aad4"},"File:b8fa50122923464e233f5217cabd79c6c46ee1697247954c8c3d1ecdf41aa4a6":{"type":"File","value":"b8fa50122923464e233f5217cabd79c6c46ee1697247954c8c3d1ecdf41aa4a6"},"File:be6518b6c063a5be153aeed34d65307f304edad472f8846cff57acb34194d91a":{"type":"File","value":"be6518b6c063a5be153aeed34d65307f304edad472f8846cff57acb34194d91a"},"File:c1ef1af8dc0993179e7eef093e2a87fbc31288b3d2b8406f0154ea374e536b01":{"type":"File","value":"c1ef1af8dc0993179e7eef093e2a87fbc31288b3d2b8406f0154ea374e536b01"},"File:c346dcfb2571765d50f1ec8ef69447bc204fba96d7ed249acd918f981107ed5b":{"type":"File","value":"c346dcfb2571765d50f1ec8ef69447bc204fba96d7ed249acd918f981107ed5b"},"File:c93b69c1ac55546692201f614b9269eb61e3f7fcd50c0271dd89bc3d73c80fb1":{"type":"File","value":"c93b69c1ac55546692201f614b9269eb61e3f7fcd50c0271dd89bc3d73c80fb1"},"File:c94729d93c8cc911c4d22a182544b8a1cf5c29a0ef312ab9e7c43f34c7b987e5":{"type":"File","value":"c94729d93c8cc911c4d22a182544b8a1cf5c29a0ef312ab9e7c43f34c7b987e5"},"File:c9ee6f480889753867efc73d72dae77d8a9a51a4e968e8793f80b53db2fa57e9":{"type":"File","value":"c9ee6f480889753867efc73d72dae77d8a9a51a4e968e8793f80b53db2fa57e9"},"File:cc2986a393c9e756810c2fd99af7e81086a541cb91004969a537b26ec8f01bc9":{"type":"File","value":"cc2986a393c9e756810c2fd99af7e81086a541cb91004969a537b26ec8f01bc9"},"File:cccb698aedb08f1173bdc3333a3c35d08d0a043ad1b3ba6cf21cfa9a673561b9":{"type":"File","value":"cccb698aedb08f1173bdc3333a3c35d08d0a043ad1b3ba6cf21cfa9a673561b9"},"File:d3e61c4df837625ac0503cea5b6765a04d37fc35399899a5503b53a3108bfbf6":{"type":"File","value":"d3e61c4df837625ac0503cea5b6765a04d37fc35399899a5503b53a3108bfbf6"},"File:d427b0a2ae666a475698cc8576294671646f7c4f4d2f5d3dff5b20c7e267de2c":{"type":"File","value":"d427b0a2ae666a475698cc8576294671646f7c4f4d2f5d3dff5b20c7e267de2c"},"File:d56f7b3e0f115f5e54f531188664949edd042c0e6f40746e9e7d80b2dee7c6fb":{"type":"File","value":"d56f7b3e0f115f5e54f531188664949edd042c0e6f40746e9e7d80b2dee7c6fb"},"File:d5b3e5fb7de31717aff4f17efc6cd64cf5e931a76fa1f0a8172268a660703548":{"type":"File","value":"d5b3e5fb7de31717aff4f17efc6cd64cf5e931a76fa1f0a8172268a660703548"},"File:d929d82e2b8644d91577d2656008e25b5a390b9b0ce40cd9d082a09bec424097":{"type":"File","value":"d929d82e2b8644d91577d2656008e25b5a390b9b0ce40cd9d082a09bec424097"},"File:d9f924ebfece8173d7bdb6c1965f23be56d9240a35507425f260f8319eab8c4a":{"type":"File","value":"d9f924ebfece8173d7bdb6c1965f23be56d9240a35507425f260f8319eab8c4a"},"File:da1669853c2cdc20323e5717e6f8f8119c437808f18aee9a5dd078894caa9f56":{"type":"File","value":"da1669853c2cdc20323e5717e6f8f8119c437808f18aee9a5dd078894caa9f56"},"File:dac02e38feebfd9ff3010284afe506f5610c62875204f5f23daccf4d5689eac5":{"type":"File","value":"dac02e38feebfd9ff3010284afe506f5610c62875204f5f23daccf4d5689eac5"},"File:db61d6d3b0c3de9481b822193cb572837f5f141193c238fd3ad27277b81b6fd4":{"type":"File","value":"db61d6d3b0c3de9481b822193cb572837f5f141193c238fd3ad27277b81b6fd4"},"File:db9d8181035969bcff1a33bed213c2aae9e5b13359a3973a391744daa2d3bc88":{"type":"File","value":"db9d8181035969bcff1a33bed213c2aae9e5b13359a3973a391744daa2d3bc88"},"File:de941fb09b0a26aa5d9c1d81f5d5dcd9c9303c75397bb35e2923eff041bb7fbc":{"type":"File","value":"de941fb09b0a26aa5d9c1d81f5d5dcd9c9303c75397bb35e2923eff041bb7fbc"},"File:dff4ffc550d481851df746a7c642d0f63a55d3bb5e3aad22b81ee04cc0ad65f1":{"type":"File","value":"dff4ffc550d481851df746a7c642d0f63a55d3bb5e3aad22b81ee04cc0ad65f1"},"File:e00c39afb7fd949c556791f68d5a0c874ad03ff1f7c056874a3fd6d6a44cebb5":{"type":"File","value":"e00c39afb7fd949c556791f68d5a0c874ad03ff1f7c056874a3fd6d6a44cebb5"},"File:e0a1284784b105b871c5cb6af01ca2893845e96248ddf9cbbfb1046da3522b30":{"type":"File","value":"e0a1284784b105b871c5cb6af01ca2893845e96248ddf9cbbfb1046da3522b30"},"File:e0fe8fa935171856e635921931406bb2edc0a0ee2eb8134619eaa3ee18459bae":{"type":"File","value":"e0fe8fa935171856e635921931406bb2edc0a0ee2eb8134619eaa3ee18459bae"},"File:e1a6abd984a9a276108fe5a647fe3612b6b3bac5a6796b47f269f46ae954ff97":{"type":"File","value":"e1a6abd984a9a276108fe5a647fe3612b6b3bac5a6796b47f269f46ae954ff97"},"File:e31f8ad9a8b527445b5d108d1940a619a3d68c0771b944cb8d166a70549deaed":{"type":"File","value":"e31f8ad9a8b527445b5d108d1940a619a3d68c0771b944cb8d166a70549deaed"},"File:e3a0c7e7f34504cf135b1b77cf4f19f800165536172726d7a2f3ef604bf6b2a2":{"type":"File","value":"e3a0c7e7f34504cf135b1b77cf4f19f800165536172726d7a2f3ef604bf6b2a2"},"File:e3ee25fc6f02e7551aafa8620d2ec1eac696933e771cf9b83cfbb06ef644a307":{"type":"File","value":"e3ee25fc6f02e7551aafa8620d2ec1eac696933e771cf9b83cfbb06ef644a307"},"File:e60d9236514bcc0f4af4e8cf16874e55c6ad64e94f041541f3f0ddc5625c3abb":{"type":"File","value":"e60d9236514bcc0f4af4e8cf16874e55c6ad64e94f041541f3f0ddc5625c3abb"},"File:e91cdf6b1fc312882ee2838bf1e24f5a9b6bf4ecfd9c59901928af29cad01102":{"type":"File","value":"e91cdf6b1fc312882ee2838bf1e24f5a9b6bf4ecfd9c59901928af29cad01102"},"File:ee2ac6237989bd98fa7d1cac88dba6f37dcf4b7603a5cdc4e7242fdea4b7f7c4":{"type":"File","value":"ee2ac6237989bd98fa7d1cac88dba6f37dcf4b7603a5cdc4e7242fdea4b7f7c4"},"File:ef1f755bdc18b5966dd74cc87b2f1d4436aef22e05059d9934adf5e968e90d9e":{"type":"File","value":"ef1f755bdc18b5966dd74cc87b2f1d4436aef22e05059d9934adf5e968e90d9e"},"File:f0ff309cd6a71f978d68bc4bd144a7a3927f021f2b3f3fb860a39923294fb604":{"type":"File","value":"f0ff309cd6a71f978d68bc4bd144a7a3927f021f2b3f3fb860a39923294fb604"},"File:f2dcd763a4e8ba40c70c4f33977ef29a809d7ee6fed29c3d3fb3a9638d013122":{"type":"File","value":"f2dcd763a4e8ba40c70c4f33977ef29a809d7ee6fed29c3d3fb3a9638d013122"},"File:f9432354b9e6c1f00a560bdba65124264a552caee5abffcffb94f883cb7c6997":{"type":"File","value":"f9432354b9e6c1f00a560bdba65124264a552caee5abffcffb94f883cb7c6997"},"File:fbc6e37f4333771a464262f3bcb2334330902ff22c04972ae82e1478f4d6f301":{"type":"File","value":"fbc6e37f4333771a464262f3bcb2334330902ff22c04972ae82e1478f4d6f301"},"File:fefb15dcc8849ba4cca4a089bb881a273e21b563975a19d29bbbd97455c89518":{"type":"File","value":"fefb15dcc8849ba4cca4a089bb881a273e21b563975a19d29bbbd97455c89518"},"Ip:52.123.255.135":{"type":"Ip","value":"52.123.255.135"}},"chains":[{"id":"1555107477992226377","root":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:39870682e7d1c026cd2b33ca25591db28250dde17de7eb1feec404222d534ffc"}],"verdict":{"verdict":"unknown"}},{"id":"1555107478340353612","root":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1555107477983837748","root":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb"}],"verdict":{"verdict":"unknown"}},{"id":"1555107485686368947","root":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432"}],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"sandbox_network","root":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","edges":[{"edge_kind":"contacted_ip","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"Ip:52.123.255.135"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","edges":[{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:85369ca677bca4586eb6ebc1e644a29dd495b9270f6d2a96bfabf9938fc49d85"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:6caf89d2b49d54b0354e9b6188235c16c4c5f6102598e3f5fab0c38e51eef8c2"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:1cf548ce9813a5c2fa877129e07c31ede4eb0636d1bc7c8d51139841012e53ff"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:3448cdfb65813ace41c2faa8f7431a22848b348d86225cf789bdc62378afaf7d"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:0e82034abd5c05b1512f1f7f5f54b59a6f8560aa2c4f53f6dcb6b89de5597ba5"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:5adada69b4dfb307ad101361fff6d4fa28db2cf6b14f9e24b0311559b48d3d78"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:038bc589cad1fbd6943e21ab27153b73ec6251b32f7d82e640ea9a9e701ee653"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:c94729d93c8cc911c4d22a182544b8a1cf5c29a0ef312ab9e7c43f34c7b987e5"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:48a7b31419a8eb4fffdc7b6a02f6b4dfda60687fc897116be15370e10c2b66a7"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:fbc6e37f4333771a464262f3bcb2334330902ff22c04972ae82e1478f4d6f301"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:6b3494af1f35f004a36fdb4a619f406c52ea16d976f063117066e2992bd889dc"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:6a3dd957aae4f6cdc0e175c57bdb62aacdb6683c09c123ee0dcae9f11224f3d3"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:e00c39afb7fd949c556791f68d5a0c874ad03ff1f7c056874a3fd6d6a44cebb5"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:23b13f2af66c35cfa4794fa8aba15026d9aa870b24bf692bd1430345a7dc8885"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:932a48911da78cc9eb8aa600ca3d64dc1987d885a26a0bca0a4dd20030c1d5cb"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:dac02e38feebfd9ff3010284afe506f5610c62875204f5f23daccf4d5689eac5"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:37a942badb881296f1ab6b7f5a8c5b4af26852cc0dae6989f7cde307fc35b9e3"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:db9d8181035969bcff1a33bed213c2aae9e5b13359a3973a391744daa2d3bc88"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:59276e78b985afe1efdeb25f6ddeba8d2465f4d3ce5afce71d290b713f8b85a7"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:3b345282c85dc1a420f3e7235a33c7e6e7e7b1650fe240bb6c47a4028f1c3016"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:f0ff309cd6a71f978d68bc4bd144a7a3927f021f2b3f3fb860a39923294fb604"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:a8ea38889a8f198d23b913ea8523f4e4776e65748df4cb29960b78943141dc42"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:4079e73d1c9e890fbcfd5ba3ed0c66d8f4685f653d8c330abf3b662a0ea2a0fa"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:c9ee6f480889753867efc73d72dae77d8a9a51a4e968e8793f80b53db2fa57e9"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:54195428a3296edea80e1590d9f3eeba59a730e08b5474e30b98804faadf200c"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:575dac2424106af5728032fe5a7b2271249fdde16f4d280c4e7f005d8e7ad787"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:e31f8ad9a8b527445b5d108d1940a619a3d68c0771b944cb8d166a70549deaed"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:e0a1284784b105b871c5cb6af01ca2893845e96248ddf9cbbfb1046da3522b30"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:39870682e7d1c026cd2b33ca25591db28250dde17de7eb1feec404222d534ffc"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:26447ee180ae59da579b1a2397cb2acdc55cf27af0470fbd688e60e6b063ebf6"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:8acabe18a2fb276fa0f263ca2370a5a26f6c9c67e70c2656dcdce428b7c4f8b2"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:69662869ed1c32f181e79e40fd557d96e6fbaa6e645664c783215a124b02c2e3"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:e3a0c7e7f34504cf135b1b77cf4f19f800165536172726d7a2f3ef604bf6b2a2"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:dff4ffc550d481851df746a7c642d0f63a55d3bb5e3aad22b81ee04cc0ad65f1"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:db61d6d3b0c3de9481b822193cb572837f5f141193c238fd3ad27277b81b6fd4"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:b8fa50122923464e233f5217cabd79c6c46ee1697247954c8c3d1ecdf41aa4a6"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:23797a0883bce5aadd214ba2c9e25c9faeeadccc44331f71e674c4498dd8f5e8"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:7721edd3e5672b9a3a28f1f5648fb315942d83cef3537750004bda956b86e5de"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:d9f924ebfece8173d7bdb6c1965f23be56d9240a35507425f260f8319eab8c4a"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:586f51086e86db23a6c6a76bb5a54ad5a4dacf42326f5f1ba6bc4f5b4a36fb74"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:e91cdf6b1fc312882ee2838bf1e24f5a9b6bf4ecfd9c59901928af29cad01102"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:de941fb09b0a26aa5d9c1d81f5d5dcd9c9303c75397bb35e2923eff041bb7fbc"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:21ef3ef513de4820d81fc929f4b9fdad8370f7a527c6cd504c74101e1241740d"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:be6518b6c063a5be153aeed34d65307f304edad472f8846cff57acb34194d91a"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:25e80eba83fbcde50538e73fd8c91da9afc9e5555b40328c1bc9736c27e093e8"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:057573ae322fcc5990c43802bc0c8d62d2e26ad9cd4e126d5a28c6ec50a3acc6"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:c346dcfb2571765d50f1ec8ef69447bc204fba96d7ed249acd918f981107ed5b"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:3f110eca1f415d23408cfe2bace5cd1ccbc683d26491b67edf09d950734a7881"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:b2b7b9f716c2e08236f5f370fc785b111c6341c6ece96cdb7a274e04e0ec8740"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:0fed6f784ed06e1998b57b80944efa5c224089eb384ee90197f7aea9af4020bd"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:b3124378502c728fed05ddc4e137891470d78514b0d8b796eabb47d6d6b2284b"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:5834e08c71ca0fb9ed0d3a12603ddfcca1dc94d467e21282508d02ea522512d4"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:ee2ac6237989bd98fa7d1cac88dba6f37dcf4b7603a5cdc4e7242fdea4b7f7c4"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:613e8e8ecc239919dc4ec299eae3941a1d288410fd6e8db48f5cc8ec76225b2e"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:87de0b32ff42dcf40ab0249fe4afdbe247805ef626f94758c207098df7dcb413"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:2c914aff7325a845a34e26af84f40a0bdb3d8a420bac791bd0d0a5a6fce1e3e3"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:fefb15dcc8849ba4cca4a089bb881a273e21b563975a19d29bbbd97455c89518"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:2cc740ec2415133c375995b3addefd9187a5500c09c165cb90d0da17d0cf68f8"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:3aad48f8a2e8a134bd28bb0bac0249421060c33c02dd497f05289725774871fa"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:d427b0a2ae666a475698cc8576294671646f7c4f4d2f5d3dff5b20c7e267de2c"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:ef1f755bdc18b5966dd74cc87b2f1d4436aef22e05059d9934adf5e968e90d9e"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:95d78758cb03094b9bd259e80a64795306c9404e19aec67e6f0beb2e6cd70aa9"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:57c2103e33f101fa24c09eec651159c89804c7b272cfcb9e7bd543a82828d54e"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:915de620e1ebb726cebe4f4a7d6fac9819e6178726d7998e571ad84f9e3e33d2"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:a68eb6767b99f0ffc971a7aab91feda6ff96012b0808f7cda31bd1822dcec761"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:3db4d1527e6661060d3a27fe4e334d422008e36d588518e59b852f40a54e5c6f"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:3d6999726ea3ea5536725d8d3aac4fdcc82a4ebd2647dabb10f18d3bdab3538c"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:c93b69c1ac55546692201f614b9269eb61e3f7fcd50c0271dd89bc3d73c80fb1"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:e0fe8fa935171856e635921931406bb2edc0a0ee2eb8134619eaa3ee18459bae"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:39a37ad5b20dc8cde98e6db5159bab36df0493742426e16a7baf85069fc0f2c6"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:e3ee25fc6f02e7551aafa8620d2ec1eac696933e771cf9b83cfbb06ef644a307"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:0a00b9e49a3708c09fa919461b40ebae1842a2a647cbfc2b7566b17d7b178151"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:e60d9236514bcc0f4af4e8cf16874e55c6ad64e94f041541f3f0ddc5625c3abb"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:da1669853c2cdc20323e5717e6f8f8119c437808f18aee9a5dd078894caa9f56"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:a5234ab08099e4866850b7bb516d238aa02b8e3a09c03ce838b3f269cafa43a0"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:5c301f33b684a73d0d7cf4870d48ccf77293b1791b8e2bb0794e7792b7311760"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:d3e61c4df837625ac0503cea5b6765a04d37fc35399899a5503b53a3108bfbf6"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:241c58fc9689de700b93204e4726c8288a35acdc2f887914c8237a9282445e18"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:10ec97f777f4d2e919fb0c30fb50906c613ff6b068d3b487aa7c06902d668f4b"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:55a2d56896ba274d10d629a0cb01d94149f5c213ce9ccf9b2811358d1eeb19e7"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:09fb4a0580446d63626dcbfa78e9ec23bacb05ef16f565570136651480c8aa07"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:cc2986a393c9e756810c2fd99af7e81086a541cb91004969a537b26ec8f01bc9"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:6a9947600efb9bab9aa04905308dcedf273a76330b4d77592c4dd40fc6bea9b0"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:89432d0428817701b09e5c8c2572f8950c4e9b7829e06ab337818cc8a295d9f0"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:65fbec1b3edf7c5730002b2e4bccf88ef578dbda2ad206dd9695567180e61c22"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:f9432354b9e6c1f00a560bdba65124264a552caee5abffcffb94f883cb7c6997"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:d5b3e5fb7de31717aff4f17efc6cd64cf5e931a76fa1f0a8172268a660703548"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:f2dcd763a4e8ba40c70c4f33977ef29a809d7ee6fed29c3d3fb3a9638d013122"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:2d106c2cf145114480af7e746c9ad0a95acade327b3a1ff6fab073488a025a51"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:b1ef179d25d6199f4d8984044ac46586da5812621969d3771aecc7cb9b20b77c"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:1e3f03e1d22635fab20a4833a1fd783992791de5691ad22f652eea067dbee7da"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:d56f7b3e0f115f5e54f531188664949edd042c0e6f40746e9e7d80b2dee7c6fb"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:b48ff6effdb0c584629f80c4dbe0c172239ae46f8d78503dd618b946b363aad4"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:9f5259dbc5e1d1873ea9a935eef6c2e0b33c25c053a65de42921145c96214820"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:b14d7f263df666399242bfb5c127e8b3814cd7c6f2df216eb532e7928ad85b31"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:298e4a080809193cebb91c1272972d6183bd89df4389a904127c4615e1ae03f8"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:7f1713a4bcc1b2a9f2ad27e6ff1b06833a5576064db5516569e9292d136fba31"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:cccb698aedb08f1173bdc3333a3c35d08d0a043ad1b3ba6cf21cfa9a673561b9"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:83d7e337c0cbbf3584f097537f9c88b4ed59503da91e2ec97e9304358ca11f88"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:d929d82e2b8644d91577d2656008e25b5a390b9b0ce40cd9d082a09bec424097"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:1d597e070228341a1ef4f01c9c43f052c616f33d0ee3c6e329613ecf06611101"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:4356fb1b6bd3f05423a41b61d4f8e1cdddf310f1b28d6c3405ea516012b50fc2"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:e1a6abd984a9a276108fe5a647fe3612b6b3bac5a6796b47f269f46ae954ff97"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:81f4ada0ade87b84fddcf8d2a965b2b6d9f6b014b0dddf9843ab5f492231cdd5"},{"edge_kind":"extracted","from_key":"File:429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","to_key":"File:c1ef1af8dc0993179e7eef093e2a87fbc31288b3d2b8406f0154ea374e536b01"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":12,"spawned_processes_count":12,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":70,"imported_dlls_count":125,"dropped_files_count":0,"extracted_files_count":108,"files_written_count":142,"files_deleted_count":0,"registry_keys_created_count":43,"registry_keys_modified_count":0,"registry_keys_deleted_count":6,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":49,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["urlscanio"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"6abe00afacf0d5ea930d761d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Malware_","contacted_countries":["USA"],"submit_name":"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe","analysis_start_time":"2026-10-01T06:41:52+00:00","indicators_count":{"informative":205,"suspicious":72,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"52.123.255.135","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}],"processes":[{"pid":64,"ppid":0,"name":"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe","command_line":"","sha256":"429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510","normalized_path":"C:\\429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510.exe","uid":"00000000-00000064","icon":"$6e"},{"pid":1892,"ppid":64,"name":"MicrosoftEdgeWebview2Setup.exe","command_line":"/silent /install","sha256":"48a7b31419a8eb4fffdc7b6a02f6b4dfda60687fc897116be15370e10c2b66a7","normalized_path":"%TEMP%\\MicrosoftEdgeWebview2Setup.exe","parent_uid":"00000000-00000064","uid":"00000000-00001892"},{"pid":2636,"ppid":1892,"name":"MicrosoftEdgeUpdate.exe","command_line":"/silent /install \"appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers\"","sha256":"4356fb1b6bd3f05423a41b61d4f8e1cdddf310f1b28d6c3405ea516012b50fc2","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00001892","uid":"00000000-00002636"},{"pid":6444,"ppid":2636,"name":"MicrosoftEdgeUpdate.exe","command_line":"/regsvc","sha256":"4356fb1b6bd3f05423a41b61d4f8e1cdddf310f1b28d6c3405ea516012b50fc2","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00002636","uid":"00000000-00006444"},{"pid":6072,"ppid":2636,"name":"MicrosoftEdgeUpdate.exe","command_line":"/regserver","sha256":"4356fb1b6bd3f05423a41b61d4f8e1cdddf310f1b28d6c3405ea516012b50fc2","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00002636","uid":"00000000-00006072"},{"pid":7124,"ppid":6072,"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","command_line":"","sha256":"89432d0428817701b09e5c8c2572f8950c4e9b7829e06ab337818cc8a295d9f0","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.273.21\\MicrosoftEdgeUpdateComRegisterShell64.exe","parent_uid":"00000000-00006072","uid":"00000000-00007124"},{"pid":2004,"ppid":6072,"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","command_line":"","sha256":"89432d0428817701b09e5c8c2572f8950c4e9b7829e06ab337818cc8a295d9f0","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.273.21\\MicrosoftEdgeUpdateComRegisterShell64.exe","parent_uid":"00000000-00006072","uid":"00000000-00002004"},{"pid":1148,"ppid":6072,"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","command_line":"","sha256":"89432d0428817701b09e5c8c2572f8950c4e9b7829e06ab337818cc8a295d9f0","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.273.21\\MicrosoftEdgeUpdateComRegisterShell64.exe","parent_uid":"00000000-00006072","uid":"00000000-00001148"},{"pid":7188,"ppid":2636,"name":"MicrosoftEdgeUpdate.exe","command_line":"$6f","sha256":"4356fb1b6bd3f05423a41b61d4f8e1cdddf310f1b28d6c3405ea516012b50fc2","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00002636","uid":"00000000-00007188"},{"pid":5256,"ppid":2636,"name":"MicrosoftEdgeUpdate.exe","command_line":"/handoff \"appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers\" /installsource otherinstallcmd /sessionid \"{6D87D432-42BC-4D3D-952D-82190637A96D}\" /silent","sha256":"4356fb1b6bd3f05423a41b61d4f8e1cdddf310f1b28d6c3405ea516012b50fc2","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00002636","uid":"00000000-00005256"},{"pid":7376,"ppid":0,"name":"MicrosoftEdgeUpdate.exe","command_line":"/svc","sha256":"4356fb1b6bd3f05423a41b61d4f8e1cdddf310f1b28d6c3405ea516012b50fc2","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","uid":"00000000-00007376","icon":"$70"},{"pid":8076,"ppid":7376,"name":"MicrosoftEdgeUpdate.exe","command_line":"$71","sha256":"4356fb1b6bd3f05423a41b61d4f8e1cdddf310f1b28d6c3405ea516012b50fc2","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00007376","uid":"00000000-00008076"}],"all_imported_dlls":["bcryptprimitives.dll","comctl32.dll","oleaut32.dll","Windows.StateRepositoryPS.dll","setupapi.dll","propsys.dll","clbcatq.dll","winhttp.dll","tiptsf.dll","pnrpnsp.dll","winsta.dll","cfgmgr32.dll","gdi32.dll","psmachine.dll","VxSSL64.dll","winnsi.dll","VxSSL32.dll","IPHLPAPI.DLL","mdmregistration.dll","devobj.dll","slwga.dll","apphelp.dll","wkscli.dll","CoreUIComponents.dll","wintrust.dll","riched20.dll","cldapi.dll","imagehlp.dll","msIso.dll","msls31.dll","ole32.dll","nsi.dll","imm32.dll","netapi32.dll","sechost.dll","version.dll","bcrypt.dll","dsreg.dll","sppc.dll","win32u.dll","msedgeupdate.dll","msvcp110_win.dll","atlthunk.dll","NapiNSP.dll","taskschd.dll","schannel.dll","wldp.dll","combase.dll","shlwapi.dll","dnsapi.dll","wtsapi32.dll","crypt32.dll","edputil.dll","nlaapi.dll","winrnr.dll","mskeyprotect.dll","ntdll.dll","rasadhlp.dll","msxml6.dll","dhcpcsvc6.dll","webio.dll","user32.dll","usp10.dll","npmproxy.dll","wow64.dll","msvcrt.dll","ucrtbase.dll","windows.storage.dll","dwmapi.dll","oleacc.dll","rpcrt4.dll","sspicli.dll","comdlg32.dll","mswsock.dll","dpapi.dll","SHCore.dll","uxtheme.dll","ncrypt.dll","msasn1.dll","ncryptsslp.dll","gdi32full.dll","cryptbase.dll","advapi32.dll","WinTypes.dll","ntasn1.dll","wow64cpu.dll","ws2_32.dll","cryptsp.dll","ntmarta.dll","System.dll","gpapi.dll","kernel32.dll","msvcp140.dll","netprofm.dll","KernelBase.dll","shell32.dll","urlmon.dll","dhcpcsvc.dll","OnDemandConnRouteHelper.dll","powrprof.dll","profapi.dll","rsaenh.dll","msvcp_win.dll","TextInputFramework.dll","CoreMessaging.dll","samcli.dll","psmachine_64.dll","vcruntime140_1.dll","wow64win.dll","fltLib.dll","vcruntime140.dll","msctf.dll","nsDialogs.dll","NSISdl.dll","wsock32.dll","FWPUCLNT.DLL","kernel.appcore.dll","shfolder.dll","netutils.dll","iertutil.dll","wininet.dll","cryptnet.dll","userenv.dll","aepic.dll","dmcmnutils.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"msedgeupdateres_tr.dll","sha256":"85369ca677bca4586eb6ebc1e644a29dd495b9270f6d2a96bfabf9938fc49d85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"$$PLUGINSDIR/modern-wizard.bmp","sha256":"3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2","verdict":"clean","sources":[{"report_type":"qsp","report_id":""}]},{"name":"msedgeupdateres_kok.dll","sha256":"6caf89d2b49d54b0354e9b6188235c16c4c5f6102598e3f5fab0c38e51eef8c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ja.dll","sha256":"1cf548ce9813a5c2fa877129e07c31ede4eb0636d1bc7c8d51139841012e53ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_zh-TW.dll","sha256":"3448cdfb65813ace41c2faa8f7431a22848b348d86225cf789bdc62378afaf7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ca.dll","sha256":"0e82034abd5c05b1512f1f7f5f54b59a6f8560aa2c4f53f6dcb6b89de5597ba5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_id.dll","sha256":"5adada69b4dfb307ad101361fff6d4fa28db2cf6b14f9e24b0311559b48d3d78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ru.dll","sha256":"038bc589cad1fbd6943e21ab27153b73ec6251b32f7d82e640ea9a9e701ee653","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_lo.dll","sha256":"c94729d93c8cc911c4d22a182544b8a1cf5c29a0ef312ab9e7c43f34c7b987e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"MicrosoftEdgeUpdateSetup.exe","sha256":"48a7b31419a8eb4fffdc7b6a02f6b4dfda60687fc897116be15370e10c2b66a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_es-419.dll","sha256":"fbc6e37f4333771a464262f3bcb2334330902ff22c04972ae82e1478f4d6f301","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ko.dll","sha256":"6b3494af1f35f004a36fdb4a619f406c52ea16d976f063117066e2992bd889dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"MicrosoftEdgeUpdateCore.exe","sha256":"6a3dd957aae4f6cdc0e175c57bdb62aacdb6683c09c123ee0dcae9f11224f3d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_pa.dll","sha256":"e00c39afb7fd949c556791f68d5a0c874ad03ff1f7c056874a3fd6d6a44cebb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_sr-Latn-RS.dll","sha256":"23b13f2af66c35cfa4794fa8aba15026d9aa870b24bf692bd1430345a7dc8885","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_vi.dll","sha256":"932a48911da78cc9eb8aa600ca3d64dc1987d885a26a0bca0a4dd20030c1d5cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ug.dll","sha256":"dac02e38feebfd9ff3010284afe506f5610c62875204f5f23daccf4d5689eac5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_es.dll","sha256":"37a942badb881296f1ab6b7f5a8c5b4af26852cc0dae6989f7cde307fc35b9e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_sk.dll","sha256":"db9d8181035969bcff1a33bed213c2aae9e5b13359a3973a391744daa2d3bc88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ka.dll","sha256":"59276e78b985afe1efdeb25f6ddeba8d2465f4d3ce5afce71d290b713f8b85a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_fr.dll","sha256":"3b345282c85dc1a420f3e7235a33c7e6e7e7b1650fe240bb6c47a4028f1c3016","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_fi.dll","sha256":"f0ff309cd6a71f978d68bc4bd144a7a3927f021f2b3f3fb860a39923294fb604","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_sr-Cyrl-RS.dll","sha256":"a8ea38889a8f198d23b913ea8523f4e4776e65748df4cb29960b78943141dc42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_mk.dll","sha256":"4079e73d1c9e890fbcfd5ba3ed0c66d8f4685f653d8c330abf3b662a0ea2a0fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ur.dll","sha256":"c9ee6f480889753867efc73d72dae77d8a9a51a4e968e8793f80b53db2fa57e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ms.dll","sha256":"54195428a3296edea80e1590d9f3eeba59a730e08b5474e30b98804faadf200c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_bn.dll","sha256":"575dac2424106af5728032fe5a7b2271249fdde16f4d280c4e7f005d8e7ad787","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ga.dll","sha256":"e31f8ad9a8b527445b5d108d1940a619a3d68c0771b944cb8d166a70549deaed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_or.dll","sha256":"e0a1284784b105b871c5cb6af01ca2893845e96248ddf9cbbfb1046da3522b30","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"$$PLUGINSDIR/StartMenu.dll","sha256":"39870682e7d1c026cd2b33ca25591db28250dde17de7eb1feec404222d534ffc","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"msedgeupdateres_bn-IN.dll","sha256":"26447ee180ae59da579b1a2397cb2acdc55cf27af0470fbd688e60e6b063ebf6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_hu.dll","sha256":"8acabe18a2fb276fa0f263ca2370a5a26f6c9c67e70c2656dcdce428b7c4f8b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_sq.dll","sha256":"69662869ed1c32f181e79e40fd557d96e6fbaa6e645664c783215a124b02c2e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_nn.dll","sha256":"e3a0c7e7f34504cf135b1b77cf4f19f800165536172726d7a2f3ef604bf6b2a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_af.dll","sha256":"dff4ffc550d481851df746a7c642d0f63a55d3bb5e3aad22b81ee04cc0ad65f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_kk.dll","sha256":"db61d6d3b0c3de9481b822193cb572837f5f141193c238fd3ad27277b81b6fd4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"MicrosoftEdgeUpdateOnDemand.exe","sha256":"b8fa50122923464e233f5217cabd79c6c46ee1697247954c8c3d1ecdf41aa4a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_bs.dll","sha256":"23797a0883bce5aadd214ba2c9e25c9faeeadccc44331f71e674c4498dd8f5e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_sr.dll","sha256":"7721edd3e5672b9a3a28f1f5648fb315942d83cef3537750004bda956b86e5de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"nsDialogs.dll","sha256":"9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"},{"report_type":"qsp","report_id":""}]},{"name":"msedgeupdateres_lv.dll","sha256":"d9f924ebfece8173d7bdb6c1965f23be56d9240a35507425f260f8319eab8c4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_pt-PT.dll","sha256":"586f51086e86db23a6c6a76bb5a54ad5a4dacf42326f5f1ba6bc4f5b4a36fb74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_hr.dll","sha256":"e91cdf6b1fc312882ee2838bf1e24f5a9b6bf4ecfd9c59901928af29cad01102","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_sv.dll","sha256":"de941fb09b0a26aa5d9c1d81f5d5dcd9c9303c75397bb35e2923eff041bb7fbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_mi.dll","sha256":"21ef3ef513de4820d81fc929f4b9fdad8370f7a527c6cd504c74101e1241740d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_pl.dll","sha256":"be6518b6c063a5be153aeed34d65307f304edad472f8846cff57acb34194d91a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_sr-Cyrl-BA.dll","sha256":"25e80eba83fbcde50538e73fd8c91da9afc9e5555b40328c1bc9736c27e093e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_uk.dll","sha256":"057573ae322fcc5990c43802bc0c8d62d2e26ad9cd4e126d5a28c6ec50a3acc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ne.dll","sha256":"c346dcfb2571765d50f1ec8ef69447bc204fba96d7ed249acd918f981107ed5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"MicrosoftEdgeUpdateBroker.exe","sha256":"3f110eca1f415d23408cfe2bace5cd1ccbc683d26491b67edf09d950734a7881","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"psuser.dll","sha256":"b2b7b9f716c2e08236f5f370fc785b111c6341c6ece96cdb7a274e04e0ec8740","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_nb.dll","sha256":"0fed6f784ed06e1998b57b80944efa5c224089eb384ee90197f7aea9af4020bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_it.dll","sha256":"b3124378502c728fed05ddc4e137891470d78514b0d8b796eabb47d6d6b2284b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_hi.dll","sha256":"5834e08c71ca0fb9ed0d3a12603ddfcca1dc94d467e21282508d02ea522512d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"psuser_arm64.dll","sha256":"ee2ac6237989bd98fa7d1cac88dba6f37dcf4b7603a5cdc4e7242fdea4b7f7c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ar.dll","sha256":"613e8e8ecc239919dc4ec299eae3941a1d288410fd6e8db48f5cc8ec76225b2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_as.dll","sha256":"87de0b32ff42dcf40ab0249fe4afdbe247805ef626f94758c207098df7dcb413","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_lt.dll","sha256":"2c914aff7325a845a34e26af84f40a0bdb3d8a420bac791bd0d0a5a6fce1e3e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_mt.dll","sha256":"fefb15dcc8849ba4cca4a089bb881a273e21b563975a19d29bbbd97455c89518","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_eu.dll","sha256":"2cc740ec2415133c375995b3addefd9187a5500c09c165cb90d0da17d0cf68f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_de.dll","sha256":"3aad48f8a2e8a134bd28bb0bac0249421060c33c02dd497f05289725774871fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_gu.dll","sha256":"d427b0a2ae666a475698cc8576294671646f7c4f4d2f5d3dff5b20c7e267de2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_fr-CA.dll","sha256":"ef1f755bdc18b5966dd74cc87b2f1d4436aef22e05059d9934adf5e968e90d9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ml.dll","sha256":"95d78758cb03094b9bd259e80a64795306c9404e19aec67e6f0beb2e6cd70aa9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_km.dll","sha256":"57c2103e33f101fa24c09eec651159c89804c7b272cfcb9e7bd543a82828d54e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_zh-CN.dll","sha256":"915de620e1ebb726cebe4f4a7d6fac9819e6178726d7998e571ad84f9e3e33d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"MicrosoftEdgeUpdate.log","sha256":"a68eb6767b99f0ffc971a7aab91feda6ff96012b0808f7cda31bd1822dcec761","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_am.dll","sha256":"3db4d1527e6661060d3a27fe4e334d422008e36d588518e59b852f40a54e5c6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_kn.dll","sha256":"3d6999726ea3ea5536725d8d3aac4fdcc82a4ebd2647dabb10f18d3bdab3538c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_az.dll","sha256":"c93b69c1ac55546692201f614b9269eb61e3f7fcd50c0271dd89bc3d73c80fb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_bg.dll","sha256":"e0fe8fa935171856e635921931406bb2edc0a0ee2eb8134619eaa3ee18459bae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"psmachine_arm64.dll","sha256":"39a37ad5b20dc8cde98e6db5159bab36df0493742426e16a7baf85069fc0f2c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_th.dll","sha256":"e3ee25fc6f02e7551aafa8620d2ec1eac696933e771cf9b83cfbb06ef644a307","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ta.dll","sha256":"0a00b9e49a3708c09fa919461b40ebae1842a2a647cbfc2b7566b17d7b178151","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_nl.dll","sha256":"e60d9236514bcc0f4af4e8cf16874e55c6ad64e94f041541f3f0ddc5625c3abb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_el.dll","sha256":"da1669853c2cdc20323e5717e6f8f8119c437808f18aee9a5dd078894caa9f56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_fa.dll","sha256":"a5234ab08099e4866850b7bb516d238aa02b8e3a09c03ce838b3f269cafa43a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"MicrosoftEdgeComRegisterShellARM64.exe","sha256":"5c301f33b684a73d0d7cf4870d48ccf77293b1791b8e2bb0794e7792b7311760","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"NSISdl.dll","sha256":"d3e61c4df837625ac0503cea5b6765a04d37fc35399899a5503b53a3108bfbf6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_en.dll","sha256":"241c58fc9689de700b93204e4726c8288a35acdc2f887914c8237a9282445e18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdate.dll","sha256":"10ec97f777f4d2e919fb0c30fb50906c613ff6b068d3b487aa7c06902d668f4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Muca.dll","sha256":"55a2d56896ba274d10d629a0cb01d94149f5c213ce9ccf9b2811358d1eeb19e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"CopilotUpdate.exe","sha256":"09fb4a0580446d63626dcbfa78e9ec23bacb05ef16f565570136651480c8aa07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_mr.dll","sha256":"cc2986a393c9e756810c2fd99af7e81086a541cb91004969a537b26ec8f01bc9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_gd.dll","sha256":"6a9947600efb9bab9aa04905308dcedf273a76330b4d77592c4dd40fc6bea9b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","sha256":"89432d0428817701b09e5c8c2572f8950c4e9b7829e06ab337818cc8a295d9f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_lb.dll","sha256":"65fbec1b3edf7c5730002b2e4bccf88ef578dbda2ad206dd9695567180e61c22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"psmachine.dll","sha256":"f9432354b9e6c1f00a560bdba65124264a552caee5abffcffb94f883cb7c6997","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"System.dll","sha256":"afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432","verdict":"likely_benign","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"},{"report_type":"qsp","report_id":""}]},{"name":"msedgeupdateres_sl.dll","sha256":"d5b3e5fb7de31717aff4f17efc6cd64cf5e931a76fa1f0a8172268a660703548","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_pt-BR.dll","sha256":"f2dcd763a4e8ba40c70c4f33977ef29a809d7ee6fed29c3d3fb3a9638d013122","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ro.dll","sha256":"2d106c2cf145114480af7e746c9ad0a95acade327b3a1ff6fab073488a025a51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_iw.dll","sha256":"b1ef179d25d6199f4d8984044ac46586da5812621969d3771aecc7cb9b20b77c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_quz.dll","sha256":"1e3f03e1d22635fab20a4833a1fd783992791de5691ad22f652eea067dbee7da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"psuser_64.dll","sha256":"d56f7b3e0f115f5e54f531188664949edd042c0e6f40746e9e7d80b2dee7c6fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_te.dll","sha256":"b48ff6effdb0c584629f80c4dbe0c172239ae46f8d78503dd618b946b363aad4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_ca-Es-VALENCIA.dll","sha256":"9f5259dbc5e1d1873ea9a935eef6c2e0b33c25c053a65de42921145c96214820","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_et.dll","sha256":"b14d7f263df666399242bfb5c127e8b3814cd7c6f2df216eb532e7928ad85b31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_fil.dll","sha256":"298e4a080809193cebb91c1272972d6183bd89df4389a904127c4615e1ae03f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_da.dll","sha256":"7f1713a4bcc1b2a9f2ad27e6ff1b06833a5576064db5516569e9292d136fba31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_en-GB.dll","sha256":"cccb698aedb08f1173bdc3333a3c35d08d0a043ad1b3ba6cf21cfa9a673561b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_gl.dll","sha256":"83d7e337c0cbbf3584f097537f9c88b4ed59503da91e2ec97e9304358ca11f88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_cs.dll","sha256":"d929d82e2b8644d91577d2656008e25b5a390b9b0ce40cd9d082a09bec424097","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"psmachine_64.dll","sha256":"1d597e070228341a1ef4f01c9c43f052c616f33d0ee3c6e329613ecf06611101","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"MicrosoftEdgeUpdate.exe","sha256":"4356fb1b6bd3f05423a41b61d4f8e1cdddf310f1b28d6c3405ea516012b50fc2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_is.dll","sha256":"e1a6abd984a9a276108fe5a647fe3612b6b3bac5a6796b47f269f46ae954ff97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_tt.dll","sha256":"81f4ada0ade87b84fddcf8d2a965b2b6d9f6b014b0dddf9843ab5f492231cdd5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"msedgeupdateres_cy.dll","sha256":"c1ef1af8dc0993179e7eef093e2a87fbc31288b3d2b8406f0154ea374e536b01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%TEMP%\\nsj297B.tmp","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%TEMP%\\nsp299C.tmp","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%TEMP%\\nse29AC.tmp","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%TEMP%\\nse29AC.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%TEMP%\\nse29AC.tmp\\modern-wizard.bmp","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%TEMP%\\nse29AC.tmp\\nsDialogs.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%TEMP%\\nse29AC.tmp\\NSISdl.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%TEMP%\\MicrosoftEdgeWebview2Setup.exe","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\MicrosoftEdgeUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\CopilotUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdate.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\Muca.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\MicrosoftEdgeUpdateBroker.exe","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\MicrosoftEdgeUpdateOnDemand.exe","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\MicrosoftEdgeUpdateComRegisterShell64.exe","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\MicrosoftEdgeComRegisterShellARM64.exe","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\psmachine.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\psmachine_64.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\psmachine_arm64.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\psuser.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\psuser_64.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\psuser_arm64.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\NOTICE.TXT","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\EdgeUpdate.dat","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\MicrosoftEdgeUpdateCore.exe","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_am.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ar.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_bg.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_bn.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ca.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_cs.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_da.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_de.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_el.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_en.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_en-GB.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_es.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_es-419.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_et.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_fa.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_fi.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_fil.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_fr.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_gu.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_hi.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_hr.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_hu.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_id.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_is.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_it.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_iw.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ja.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_kn.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ko.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_lt.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_lv.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ml.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_mr.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ms.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_nb.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_nl.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_pl.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_pt-BR.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_pt-PT.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ro.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ru.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_sk.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_sl.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_sr.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_sv.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ta.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_te.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_th.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_tr.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_uk.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ur.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_vi.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_zh-CN.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_zh-TW.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_af.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_as.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_az.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_bn-IN.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_bs.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ca-Es-VALENCIA.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_cy.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_eu.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_fr-CA.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ga.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_gd.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_gl.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ka.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_kk.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_km.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_kok.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_lb.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_lo.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_mi.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_mk.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_mt.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ne.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_nn.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_or.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_pa.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_quz.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_sq.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_sr-Cyrl-BA.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_sr-Cyrl-RS.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_sr-Latn-RS.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_tt.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\msedgeupdateres_ug.dll","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU4725.tmp\\MicrosoftEdgeUpdateSetup.exe","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\CopilotUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%TEMP%\\af397ef28e484961ba48646a5d38cf54.db.ses","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%WINDIR%\\Temp\\af397ef28e484961ba48646a5d38cf54.db.ses","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7A19A3F6AFF08A3C532EF8C78F47948C","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7A19A3F6AFF08A3C532EF8C78F47948C","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{86FA2729-397E-41E1-95BB-4F18BEBD5CD3}\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{86FA2729-397E-41E1-95BB-4F18BEBD5CD3}\\INPROCHANDLER32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{59DD293F-6B10-49A7-B566-504B2EF90A43}\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{59DD293F-6B10-49A7-B566-504B2EF90A43}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C853632E-36CA-4999-B992-EC0D408CF5AB}\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C853632E-36CA-4999-B992-EC0D408CF5AB}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C853632E-36CA-4999-B992-EC0D408CF5AB}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{60355531-5BFD-45AB-942C-7912628752C7}\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{60355531-5BFD-45AB-942C-7912628752C7}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{60355531-5BFD-45AB-942C-7912628752C7}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A5135E58-384F-4244-9A5F-30FA9259413C}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A5135E58-384F-4244-9A5F-30FA9259413C}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7E29BE61-5809-443F-9B5D-CF22156694EB}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7E29BE61-5809-443F-9B5D-CF22156694EB}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\EDGEUPDATE\\CLIENTSTATE\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\CURRENTSTATE\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{86FA2729-397E-41E1-95BB-4F18BEBD5CD3}\\INPROCHANDLER32\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{86FA2729-397E-41E1-95BB-4F18BEBD5CD3}\\","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:64:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:64:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:64:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Local\\SM0:64:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"SM0:64:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"SM0:64:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1892:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1892:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Local\\SM0:1892:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"SM0:1892:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{F340B839-380B-4AA9-BA6F-B83F23E2DD05}","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{DDDDEAEB-04CC-4BAA-9C63-CCA5FE38F688}","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2636:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2636:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Local\\SM0:2636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"SM0:2636:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Local\\SM0:2636:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"SM0:2636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6444:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6444:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Local\\SM0:6444:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"SM0:6444:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6072:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6072:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"SM0:6072:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Local\\SM0:6072:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Local\\SM0:7124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"SM0:7124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"SM0:2004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Local\\SM0:2004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Local\\SM0:1148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"SM0:1148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7188:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7188:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"SM0:7188:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Local\\SM0:7188:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"SM0:7188:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7188:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5256:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"SM0:5256:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"SM0:5256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"Local\\SM0:5256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:7376:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\BaseNamedObjects\\SM0:7376:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\BaseNamedObjects\\_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{76524F9B-42D7-48C8-B7DF-FAB9E93834BF}","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{9FE41F29-8211-488D-B96A-81FCD0A8ACE3}","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{8A5FF6DC-FF03-4CB3-8834-D3AD1DE301DF}","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:8076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\BaseNamedObjects\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\BaseNamedObjects\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\BaseNamedObjects\\SM0:8076:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]},{"name":"\\BaseNamedObjects\\SM0:8076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abe00afacf0d5ea930d761d"}]}]}},"report_ids":{"sandbox_job_ids":["6abe00afacf0d5ea930d761d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Malware_ Sample 429c792a9586… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 429c792a9586…. Malware family: Malware_. Threat score 100/100. 1/27 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware_ Sample 429c792a9586… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 429c792a9586…. Malware family: Malware_. Threat score 100/100. 1/27 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/429c792a9586ce9b77ea659d11c402d38307f89dcc42dd75dda2eaff68ae8510"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware_ Sample 429c792a9586… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 429c792a9586…. Malware family: Malware_. Threat score 100/100. 1/27 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L72","11",{}]]