New Expected Path

[mulder1]

Hello, I believe this path %system32%\wbem should be added as Expected Location for both DLLs. Seem false positives:
wbemprox.dll
wbemsvc.dll

[Cyb3r-Monk]

I haven't seen this libraries loaded by msedge in my lab. Could it be something custom to the environment?

[mulder1]

It's a known alternate location for the files. And judging by the logic of the query I think the reason it's listed Suspicious is because it's location is not added to Expected locations, not because it's unusual to be loaded by Edge.
https://www.file.net/process/wbemprox.dll.html

[mulder1]

I can see Edge is one of the expected programs listed as using this libraries (andalso possible target for hijacking)
Here:
https://hijacklibs.net/entries/microsoft/built-in/wbemprox.html

[Cyb3r-Monk]

I've synced the csf file. Let me know if it doesn't work.