2009f1915acdf9cc26e509a0df595a6e4e3a8b55d82d2beac9cc0872d6c6bde9

Analysis

max time kernel
177s
max time network
169s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26-03-2023 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

microsoft-edge-110-0-1587-69.exe
Size

1.5MB
MD5

9d538327b08e6e91d98253288bbd776c
SHA1

2cf3d00969d3325fdea9bc08b4c8c6689469535f
SHA256

2009f1915acdf9cc26e509a0df595a6e4e3a8b55d82d2beac9cc0872d6c6bde9
SHA512

6e406d65eff7a48f0123abf70e81cc2d9527400b6103100cc21e72c7e0014f8d7c751dd46090aac9b023ad89917f3208c5f2dfdaa3ea57a1f6384585a6b342ef
SSDEEP

49152:gyf3v/qBUBe7oIlEnkxVB9oJyDXI9mK5D:gyjBELkQI0MD

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Executes dropped EXE 11 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_109.0.1518.95.exe

pid	process
1860	MicrosoftEdgeUpdate.exe
1492	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
1620	MicrosoftEdgeUpdateComRegisterShell64.exe
1544	MicrosoftEdgeUpdateComRegisterShell64.exe
740	MicrosoftEdgeUpdateComRegisterShell64.exe
1768	MicrosoftEdgeUpdate.exe
1796	MicrosoftEdgeUpdate.exe
1316	MicrosoftEdgeUpdate.exe
1624	MicrosoftEdgeUpdate.exe
976	MicrosoftEdge_X64_109.0.1518.95.exe

Loads dropped DLL 24 IoCs

Processes:

microsoft-edge-110-0-1587-69.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

pid	process
836	microsoft-edge-110-0-1587-69.exe
1860	MicrosoftEdgeUpdate.exe
1860	MicrosoftEdgeUpdate.exe
1860	MicrosoftEdgeUpdate.exe
1860	MicrosoftEdgeUpdate.exe
1860	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
1620	MicrosoftEdgeUpdateComRegisterShell64.exe
1528	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
1544	MicrosoftEdgeUpdateComRegisterShell64.exe
1528	MicrosoftEdgeUpdate.exe
1528	MicrosoftEdgeUpdate.exe
740	MicrosoftEdgeUpdateComRegisterShell64.exe
1528	MicrosoftEdgeUpdate.exe
1860	MicrosoftEdgeUpdate.exe
1860	MicrosoftEdgeUpdate.exe
1860	MicrosoftEdgeUpdate.exe
1860	MicrosoftEdgeUpdate.exe
1316	MicrosoftEdgeUpdate.exe
1796	MicrosoftEdgeUpdate.exe
1316	MicrosoftEdgeUpdate.exe
1316	MicrosoftEdgeUpdate.exe

Registers COM server for autorun 1 TTPs 31 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.49\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29E55439-0D40-4CA6-979E-606EA7A46AED}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29E55439-0D40-4CA6-979E-606EA7A46AED}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29E55439-0D40-4CA6-979E-606EA7A46AED}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.49\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29E55439-0D40-4CA6-979E-606EA7A46AED}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29E55439-0D40-4CA6-979E-606EA7A46AED}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.49\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29E55439-0D40-4CA6-979E-606EA7A46AED}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29E55439-0D40-4CA6-979E-606EA7A46AED}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.49\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.49\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29E55439-0D40-4CA6-979E-606EA7A46AED}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.49\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.49\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29E55439-0D40-4CA6-979E-606EA7A46AED}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.49\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.49\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 7 IoCs

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

Processes:

microsoft-edge-110-0-1587-69.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_109.0.1518.95.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_th.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ga.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_gd.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\psmachine_64.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_pt-BR.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_bs.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_fr-CA.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_sr-Cyrl-BA.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ar.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_lt.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_nl.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_vi.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_af.dll	microsoft-edge-110-0-1587-69.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_es.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_es-419.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ru.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ug.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{54506FE3-9D4A-48F2-A4DA-20B90DD2D66B}\EDGEMITMP_7E90B.tmp\setup.exe	MicrosoftEdge_X64_109.0.1518.95.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\MicrosoftEdgeUpdate.exe	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_gu.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ms.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_zh-CN.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\psmachine.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_am.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_de.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_el.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ml.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_sv.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ur.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_quz.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_sr-Latn-RS.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_tt.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_hr.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_az.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_lb.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_fa.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_nb.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_mr.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_sk.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_te.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\NOTICE.TXT	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_eu.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_gl.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_or.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_bn.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_en-GB.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_sr.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_bn-IN.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ca-Es-VALENCIA.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_mk.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\MicrosoftEdgeUpdateSetup.exe	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\EdgeUpdate.dat	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_cs.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_pl.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{54506FE3-9D4A-48F2-A4DA-20B90DD2D66B}\EDGEMITMP_7E90B.tmp\SETUP.EX_	MicrosoftEdge_X64_109.0.1518.95.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdate.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_fr.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ne.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_sr-Cyrl-RS.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\psmachine_arm64.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\psuser.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_iw.dll	microsoft-edge-110-0-1587-69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_cy.dll	microsoft-edge-110-0-1587-69.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-ff-27-5a-26-84\WpadDecisionTime = e0c202993060d901	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-ff-27-5a-26-84\WpadDecision = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{78F887A7-3DF8-4C10-99F1-3869F1CA35A5}\WpadDecisionTime = e0c202993060d901	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{78F887A7-3DF8-4C10-99F1-3869F1CA35A5}\WpadNetworkName = "Network 2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{78F887A7-3DF8-4C10-99F1-3869F1CA35A5}\WpadDecisionReason = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-ff-27-5a-26-84\WpadDetectedUrl	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{78F887A7-3DF8-4C10-99F1-3869F1CA35A5}\WpadDecision = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{29E55439-0D40-4CA6-979E-606EA7A46AED}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{29E55439-0D40-4CA6-979E-606EA7A46AED}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F5C8421F-74F1-47E2-989B-8AB7FD2DBB00}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\CLSID\ = "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\CLSID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{29E55439-0D40-4CA6-979E-606EA7A46AED}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.49\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{29E55439-0D40-4CA6-979E-606EA7A46AED}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29E55439-0D40-4CA6-979E-606EA7A46AED}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29E55439-0D40-4CA6-979E-606EA7A46AED}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\LocalService = "edgeupdatem"	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MicrosoftEdgeUpdate.exe

pid process

1860 MicrosoftEdgeUpdate.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MicrosoftEdgeUpdate.exe

description pid process

Token: SeDebugPrivilege 1860 MicrosoftEdgeUpdate.exe

description	pid	process
Token: SeDebugPrivilege	1860	MicrosoftEdgeUpdate.exe

Suspicious use of WriteProcessMemory 58 IoCs

Processes:

microsoft-edge-110-0-1587-69.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	pid	process	target process
PID 836 wrote to memory of 1860	836	microsoft-edge-110-0-1587-69.exe	MicrosoftEdgeUpdate.exe
PID 836 wrote to memory of 1860	836	microsoft-edge-110-0-1587-69.exe	MicrosoftEdgeUpdate.exe
PID 836 wrote to memory of 1860	836	microsoft-edge-110-0-1587-69.exe	MicrosoftEdgeUpdate.exe
PID 836 wrote to memory of 1860	836	microsoft-edge-110-0-1587-69.exe	MicrosoftEdgeUpdate.exe
PID 836 wrote to memory of 1860	836	microsoft-edge-110-0-1587-69.exe	MicrosoftEdgeUpdate.exe
PID 836 wrote to memory of 1860	836	microsoft-edge-110-0-1587-69.exe	MicrosoftEdgeUpdate.exe
PID 836 wrote to memory of 1860	836	microsoft-edge-110-0-1587-69.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1492	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1492	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1492	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1492	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1492	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1492	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1492	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1528	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1528	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1528	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1528	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1528	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1528	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1528	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1528 wrote to memory of 1620	1528	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 1528 wrote to memory of 1620	1528	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 1528 wrote to memory of 1620	1528	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 1528 wrote to memory of 1620	1528	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 1528 wrote to memory of 1544	1528	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 1528 wrote to memory of 1544	1528	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 1528 wrote to memory of 1544	1528	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 1528 wrote to memory of 1544	1528	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 1528 wrote to memory of 740	1528	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 1528 wrote to memory of 740	1528	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 1528 wrote to memory of 740	1528	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 1528 wrote to memory of 740	1528	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 1860 wrote to memory of 1768	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1768	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1768	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1768	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1768	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1768	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1768	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1796	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1796	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1796	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1796	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1796	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1796	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1860 wrote to memory of 1796	1860	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1316 wrote to memory of 1624	1316	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1316 wrote to memory of 1624	1316	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1316 wrote to memory of 1624	1316	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1316 wrote to memory of 1624	1316	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1316 wrote to memory of 1624	1316	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1316 wrote to memory of 1624	1316	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1316 wrote to memory of 1624	1316	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 1316 wrote to memory of 976	1316	MicrosoftEdgeUpdate.exe	MicrosoftEdge_X64_109.0.1518.95.exe
PID 1316 wrote to memory of 976	1316	MicrosoftEdgeUpdate.exe	MicrosoftEdge_X64_109.0.1518.95.exe
PID 1316 wrote to memory of 976	1316	MicrosoftEdgeUpdate.exe	MicrosoftEdge_X64_109.0.1518.95.exe
PID 1316 wrote to memory of 976	1316	MicrosoftEdgeUpdate.exe	MicrosoftEdge_X64_109.0.1518.95.exe

C:\Users\Admin\AppData\Local\Temp\microsoft-edge-110-0-1587-69.exe
"C:\Users\Admin\AppData\Local\Temp\microsoft-edge-110-0-1587-69.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:836

C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=en&brand=M100"
2⤵
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
3⤵
- Executes dropped EXE
- Modifies registry class
PID:1492

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1528

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.49\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.49\MicrosoftEdgeUpdateComRegisterShell64.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1620

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.49\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.49\MicrosoftEdgeUpdateComRegisterShell64.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1544

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.49\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.49\MicrosoftEdgeUpdateComRegisterShell64.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:740

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNDkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNDkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEQ0MDhCNDAtMkRCNC00NEM3LTgxNkEtOEM5NTMyMzI0MjY1fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezEwQUU1MTQ5LTJFRDAtNDkxOS05MEY1LUU4MjMxNkQ1QTA4Qn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI0IiBwaHlzbWVtb3J5PSIyIiBkaXNrX3R5cGU9IjAiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjAiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjEiIGlzX3dpcD0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE3My40OSIgbGFuZz0iZW4iIGJyYW5kPSJNMTAwIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjAzMTIzNzAwMCIgaW5zdGFsbF90aW1lX21zPSIyNTI4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
3⤵
- Executes dropped EXE
- Checks system information in the registry
PID:1768

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=en&brand=M100" /installsource taggedmi /sessionid "{0D408B40-2DB4-44C7-816A-8C9532324265}"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1316

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNDkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNDkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEQ0MDhCNDAtMkRCNC00NEM3LTgxNkEtOEM5NTMyMzI0MjY1fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezk3MUQ1MTQxLTM1RjItNDI3Qi1BMjQwLUI4MjlBOEQ2QkY5Qn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI0IiBwaHlzbWVtb3J5PSIyIiBkaXNrX3R5cGU9IjAiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjAiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjEiIGlzX3dpcD0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYwMzcxNjUwMDAiLz48L2FwcD48L3JlcXVlc3Q-
2⤵
- Executes dropped EXE
- Checks system information in the registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1624

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{54506FE3-9D4A-48F2-A4DA-20B90DD2D66B}\MicrosoftEdge_X64_109.0.1518.95.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{54506FE3-9D4A-48F2-A4DA-20B90DD2D66B}\MicrosoftEdge_X64_109.0.1518.95.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:976

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\109.0.1518.95\MicrosoftEdge_X64_109.0.1518.95.exe
Filesize
134.1MB

MD5
fb9403029d0ae74997d390b1cfb5a8b9

SHA1
f60dac76ef55475a031c80206da69c5e4d496767

SHA256
3a7d3a59a08e7121043e6b6c1c361b00eb01a8cf55d6c157b980447d0386858c

SHA512
213d253be1b05bbd8c7248a496bfe6ad0c6984ab1398107f7a30b63a62b557d8477dc94a56eb32142db74200537b8259ad6de71afd44e3d73d339d6835e1d716

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
Filesize
201KB

MD5
9789883e5166929441ea640b8809910e

SHA1
bc4d75ad286238eda2414f8da3dbaf7b727d0061

SHA256
737a36758795995066093c92c079501cea125c253a58b6062199607129a85f51

SHA512
ce73c9a473ad94d9eca8ef4c1e587190fe7cbfef100371984612f4f9144390c5eca9ba9ff976ddd457894df9b06048105673d580a0f2222ba76573b432885e13

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\EdgeUpdate.dat
Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\MicrosoftEdgeComRegisterShellARM64.exe
Filesize
179KB

MD5
3a53fdc9aa0bcf1701c3cd99c3189dd9

SHA1
0e91dc619c698c854c2de0a1aa58537455e46a9a

SHA256
533a1d64428f5dd86ef1e563be99980002ad592499362539117cf9d767c761cb

SHA512
625c0c3e6b9254fdb59ccb88c81296521abfafc75567d96fd226cffbe948b13eea10570f84211a682aea0bb60ee54749042d08f8c7cab8c7ad7797f448a30aa3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\MicrosoftEdgeUpdate.exe
Filesize
201KB

MD5
9789883e5166929441ea640b8809910e

SHA1
bc4d75ad286238eda2414f8da3dbaf7b727d0061

SHA256
737a36758795995066093c92c079501cea125c253a58b6062199607129a85f51

SHA512
ce73c9a473ad94d9eca8ef4c1e587190fe7cbfef100371984612f4f9144390c5eca9ba9ff976ddd457894df9b06048105673d580a0f2222ba76573b432885e13

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\MicrosoftEdgeUpdate.exe
Filesize
201KB

MD5
9789883e5166929441ea640b8809910e

SHA1
bc4d75ad286238eda2414f8da3dbaf7b727d0061

SHA256
737a36758795995066093c92c079501cea125c253a58b6062199607129a85f51

SHA512
ce73c9a473ad94d9eca8ef4c1e587190fe7cbfef100371984612f4f9144390c5eca9ba9ff976ddd457894df9b06048105673d580a0f2222ba76573b432885e13

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
Filesize
212KB

MD5
fd3fe4d0216fe11609f5662c516ed34c

SHA1
3031085b2caa419f967a231f75ff2ac75748ae63

SHA256
6023afc5a59b4888f75927865ab4b7f5b5f1a94e967f95dfb5d65f1f64e853dc

SHA512
7f545a7ef436d5949de66025d485c6f13558420a0962f15b774dc3eacf27141375d8bfe1fc5dfee5b5c403e680ebdc886316a2bfaa49d31e4a133df3a41f31f8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\MicrosoftEdgeUpdateCore.exe
Filesize
257KB

MD5
052602af17ed7ef496d2f322521e2976

SHA1
e17fbb262dc52f7e73cf7e8c5444957c6c315207

SHA256
4b8dab97046004348435c513d626468b1fd4e05893d365f0b26f5777c6e49443

SHA512
78c686e50bbd13a6e69c8fbd2116f7c781e837aafc2c5628cc5ec516d87f9290b24a703296eeaf93780532794a4a9eee5c190a6ab1354dfc7d79764e3cdb5d6f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\NOTICE.TXT
Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdate.dll
Filesize
2.1MB

MD5
a332a035f2de55630c1b2352728f9e7d

SHA1
471e922e64199e6f2be88f1d843cf0a4d7721d68

SHA256
621375559f7d7c13133c9b9117529d420991d3f09052e33052d4547d5f67c51b

SHA512
bd76164ff1e260eaf80f7963f178c646152e0cd69c1a30c3df55ad2a91dab5e8779a5f9cf325a696490dc8f637c45e5bd0cb3275511d31b92ecd52e873d74a25

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_af.dll
Filesize
28KB

MD5
cbe3970b40dcd0364a2ba9c17c6cad57

SHA1
3297b57e699d374ca750036ebeea30772ade1db2

SHA256
2504b1c74e182dc061aa3910ad0e1fa735dccf4c1f9cd1eb261fbcab7f1850e4

SHA512
1e168c1e594b99afba716f750d5ad89e2c4558ea7a3c548396c8c76efc9e23e306f12002b47730b55deb5a4b46f71b6c7f8883c1e02eb18c784f0151d490f9ab

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_am.dll
Filesize
24KB

MD5
e2e3f1b4951dafbd001a2a35b2bba3e4

SHA1
4cd9b3c8f61d800779952c0bf848d07fcb28c4cc

SHA256
a83f370ffd689a5fb284d3ce551637cc0762a03bbfbc5e2e7a94ee304973bedf

SHA512
13c9e55217e60ba27c00f7244d015b51b2acd8da32c04ac50c646f8bbe107f4ba1f993a8b4e581877017d9762d0361f5e8921d0bf0e96676086f2fbf83fe3d37

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ar.dll
Filesize
26KB

MD5
5c854cfbc9a24aced8f9eb218f6e32e1

SHA1
16fd2e71001bfe285a3da9e34610b6f49a304255

SHA256
05bf14bef13f60018a5bb999041f17c4696425c4aedd97909d82228cb700208a

SHA512
f93a4572be06ac0c6d78911b1a9d4272807c323b309a7c91de00395c8ce82c50648440f60d2a8f15dfb4c40b04fd56d8d4940d5e0c85386726287dc96e219e5f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_as.dll
Filesize
28KB

MD5
e0e32f1bb943243f6cb0f7770c7be682

SHA1
dcb63e1c22d0e21bc35b51877312541731a95f67

SHA256
d106b05274459bf092950e3ae8d222553f66839ef5de7557e144c7e374df44c2

SHA512
646bcda41279f64c2e3463ee53697ecf1e5acfe60bf8d037a2f8aa8a07fae1b714db058244e9d7485124b440dbe0bd0c44231956ce75231d6c47d195f5b5916f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_az.dll
Filesize
29KB

MD5
c776f87d63611f67862e6f9a352b14a7

SHA1
6651292c728978aa2e592ae773b9007e3ebeec07

SHA256
ebe48cff32d6f15c362dde9f12e21a0d05e1d197d68c064762785339605b1b70

SHA512
8ce138f28fb9aa5a218919469d7ccbd0d3f9f3554ea45e9947df18de6808baef49fa7ac120e3da106a5f3023af856f718a58e4454f0ca0d2865d4937d824ea52

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_bg.dll
Filesize
29KB

MD5
6b4fd52e4155079f8288ddc11dea29a2

SHA1
b739a14c7e15d27a99202993ff4b3356e507936f

SHA256
c7fafe1bf4bba349f1e98e3fe5e8e0b77df33f75ce4071fdd9fe771e191cdf37

SHA512
fff3e6ea1324e84515f66974cf828521ea343aa3f46a48a8c3ec2f3091b1371f626c8c56ed09e96142ead62b4bca92ee2317dbf3823b5d9f2f1a2bbf610d6a48

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_bn-IN.dll
Filesize
29KB

MD5
b8bc061461589f897c7085a4478812c5

SHA1
2a916fd5e133f7aece93780fd8c172dd76d6dd83

SHA256
30a3822f339bfc68291e02a19921b4254133e847826b8ae7efa56a5081594ae6

SHA512
93f7550c7e2458e664b595b2b161c38fbedd4defc8630483924c55ac1c424053d660c448a03933af73eff6674831baef5ad358dad7eb20e68bfba67a066a352e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_bn.dll
Filesize
29KB

MD5
5b20d0f58dc65e6cb66faef690b75d57

SHA1
b4ca1b64bb09bfa7e720a65d5bba74fa1049ba50

SHA256
9796cd6ab408b68f8c051c22e17ffc689fae979edd5fd2a17e320985fa7a0cf9

SHA512
51bff20b45b42a6abdcaf7c448a26242e3b8c8a28b057a7f5139aa71cbc05d417211b558c3b70eec21e4eb229ca1d93d7ea3d764b4bbdb92264807c235ddf707

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_bs.dll
Filesize
28KB

MD5
6f569efe60c22e332d277845848a6e5e

SHA1
6a4232b97b6644853da909f341c49874916cd453

SHA256
bc37979360b58e0937a91176674907840869e2470107c0045b58be36a9ad8e6a

SHA512
50fc3f7e6311fe1693c772092c11394f9d4ad2e020e2ee42cd919149013125af8aeeae69de8b5039951cee8b4df77e5cfdcf44d93a56561104df322c6dbf1a00

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
Filesize
29KB

MD5
3490841cdd84e846afb38a57e3448213

SHA1
1a6627a9fcef817729308acff6e35b30ce505f30

SHA256
750c2557dca1bcf5df7993b8afc1324f14bf6f49601cfdf871a795f02ad00562

SHA512
63b55c487afbeb162eeafad7626971550590556d6d97a5e09633f83438cb7f58f8ef0a9f2ed718740d1df18acc41fd35cb75380783f439460bdff31a685d792c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ca.dll
Filesize
30KB

MD5
a7a0a1c72a5c0278d971db344815c20e

SHA1
99be55e5e5ef021286a50dc4efafc7e121b0ac06

SHA256
2ed13e45541c6edfc57572a87b69e6ef9e3b3232d90e43f64f9eb841b1b62e8c

SHA512
6da336e1ba67f848a8a0ce3ab316d653123b3cb115fcf9ad645ffa7021f1ba20e8bec4e93c825ea48cfe21eec743b183f5e4d9a13a6f6a0d6237c46a8e7e3195

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_cs.dll
Filesize
28KB

MD5
ef9ca3c19d8190e305aa3bd4ca75af70

SHA1
fe555e8d57a3a7a7400767d32054d19aaf836760

SHA256
67f2c2176cded950913f234efaded1dc10b201d73bdf83597580f1b538d461d8

SHA512
9fdd02d3181ea285e03948a3b69d7218aff60534f7573613d31e49f15b4be55914d80e1e1b45dd6a31a41e203eb0dbe9e13e4db0a53be457583b760fc2a0aa56

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_cy.dll
Filesize
28KB

MD5
f5c51df53df8104e5812c23d85e77eca

SHA1
0ca2043a306fa0a303357dce973ce12c17d75dd7

SHA256
b9c72e030a2d560742f37c36c61d8a18f9445cfed077b0991a2b15bdb9980c52

SHA512
d807147f6155a3f6e75352756df24d752833321816c07161a598462bdbd274c0acfb115f04edfc266347af11ef51be89ecc372add2686ce3ae31bd4cf82fbe0a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_da.dll
Filesize
28KB

MD5
c7f227b03d2424937603c638019bf5fc

SHA1
abe983d60983b22288a80e7a8dd93bbbfd645b10

SHA256
6f378e6534c631f14920099797aadea4ed2f6e2c1f4e9ebbe89e925b5bd3d629

SHA512
101a1676dbc9f39c8be9c13a1db3ddda18fae1ae556df0ede16fd2240a14c1dc78e8424319ae8254c1b480809c421e289a6e4674e1f6a22b40409e72df931d3c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_de.dll
Filesize
30KB

MD5
f559c71fc2bdcb34f58d8fa3ad9cc419

SHA1
7430c5b48c2bc49b336c7338ee99f52ca125c2a3

SHA256
cd892255a44bb6f829cdecd045a72bf9834bbe3aec175d91440ef523c8c996dc

SHA512
6d7be536215966c53f38b62dcb2d32bc81d748fc48e241fc7f07a9892bf8d75b2cf7d70217a6b20cb03e1dcefdcdd35b20f019811543d74e7781bcf90fed4846

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_el.dll
Filesize
30KB

MD5
61f7c0faa3408b65847a874c59cc67de

SHA1
e89aa72782b5654fc182cde2e1e41c56e7460fc4

SHA256
7d7bee3ec4b93e7da97829f2c164778d29c6954454bb5658fd28afcf91edcb47

SHA512
ca8d48431baafbde24b6bcf60deecc219f66e61db1517c85324713dd878f1440c70bd877ab0c3701e1901f92f7a1baee75489a21f708c44d5a5fd263ed27f789

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_en-GB.dll
Filesize
27KB

MD5
ee2bf7e40570722582d25f9e2e14b6a3

SHA1
01dcd739b3a60d8169a7ecca643f5263323529ae

SHA256
33be4d1c28ab10934258becec27a47cd19f0928f5f3fbdf9de96da814ff06ea0

SHA512
32ee3a4feb46b1d199620488b1f2fbacb332cc6ad6d90bac19c633779066c9a454728b6d7a55bf7f9bbc442996e144885a38f7505227f3cf3b09f93a61f5ae5e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_en.dll
Filesize
27KB

MD5
abc8b49076448f73a726551689d5801d

SHA1
086a9ede0ea4bb5711e3432e1e2dbad058ee01c8

SHA256
d52e7b6406ec97278ccb51fb1750d88df372ecace9da409dbf0b228abac88730

SHA512
d129ad1f0a2503a9d654a595d167d1d87df71da1571038c3fa93d437ba4e59644a51ab6d008c48d7654e76e0187f121e49e324c2bbf63c80ba1482d8015a7763

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_es-419.dll
Filesize
29KB

MD5
a555aad50f93b63e062880ed4fb66b2c

SHA1
d0f35500d8950e0dcbd94aecaf1c101b28d05f7d

SHA256
c076c4ee8214ddea96b608bc112b54ea66fa9afe8abba75f6b784784f0093512

SHA512
e43441b850d1fccc249bfd8f012d7de2eff8671a42da68cdc22d9d4c0a54c766eb9a7e9d42e36becc36ebbd41bcdf13f15f4603b403e0de4fd6160c4928cdf27

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_es.dll
Filesize
28KB

MD5
ab8d4b6d245087399d95022002114e62

SHA1
ea410728253f39b5dae5b7b4460aba6f46deed99

SHA256
71a99a9742f741785c29ba9bde08ab98539730f5746aa8be38086bc4a1661276

SHA512
9c2c56567095c76991892731e08c5ff8d2821d4c84047656b0df0750f66feaf4ee12d7af47e9f208b3604ab37079954dd552efc4ee2a46ca98358c8dec8db8a3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_et.dll
Filesize
28KB

MD5
0839ff70f779dad520cce096f3739ce5

SHA1
a2138820b1874c538e6c1caae12c8ca43ac95178

SHA256
af0e3295db1d733d4f39b2d73c3a147bae8da9ee9550bfde7b87d7bb41c8d057

SHA512
21c89a71330318cf5fc517bbadc7300814420e059bd0978c603a0d96b89fce5adcd979ed31be7d4f67fb2047d9c2a3849d9899ff40fe2108ab3ee502983aaee8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_eu.dll
Filesize
28KB

MD5
7e03a0adbcdcac03e2d67dde4c5f9759

SHA1
0b9773a9ae432fb68e28e8f9ee521574d6a17fc2

SHA256
37a619e9361ec42c4a1a21918638b3c1688a2e5f54d9be3f86f88f99ec9d0584

SHA512
e6496ccfa7bd507e31bab866ea89c1b62e896dd6641e5060eecdd12fc9a398a0e8c1591c6c6e9332546852b7e07e2f48dcab24fb31dded866026589d7efd7f5e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_fa.dll
Filesize
27KB

MD5
d1bd56c12fff93aaee0636716d5ac684

SHA1
aa07a47d9d9773e125261a893610271d0fb74ad4

SHA256
2876d0ae2c08278f0a3a546b74f17f8b225a109634c3a41863d1aa85171351d3

SHA512
732eccb49dac67ad9e5a04f2c16a31d0b9f25d9437decb7e1d51aa0b92bfa98492676ff421a598b60ed21c8f496a2ce81aaecfc6da9b2c99917e8f6614bd8f28

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_fi.dll
Filesize
28KB

MD5
bcb2af1936fa18b0a61514177d7fd685

SHA1
37ad14c810ca03d15e55fc8d506ea795d72ed88c

SHA256
69182f6d4895434f5a6a9fc41d4e45987665596ff410c2a43bd3e062e0cfc916

SHA512
7994a20347776918b5f4ac57a40f96203be815e0b29483bd1ca5b0e59b04bfc9f8094791783a7cbf704e1bcd56efc2e4c2bbd21680e774ba585c4a78c6eb3e99

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_fil.dll
Filesize
29KB

MD5
ddfe5a1d109002824cdceae4b1905458

SHA1
d963a7e851c584e2ff9f8ecff4007e87aa89ea31

SHA256
d2426aee6dee9789b79586c9743a78e3e22cbc1b5e3dc71b268a01c74db80da6

SHA512
bf346dab42ccb07d5d3f34e7365d17dff8c2094fb84c94331b1c60d5383b92064b548967581b25be3ce746092d3aa4b91a0a985972d8de461cb3240923c4dcd1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_fr-CA.dll
Filesize
30KB

MD5
5252f1eb8582d9ddadea2dc5df79451b

SHA1
4907cd0745a89e03ec6838a3be2c8cd17ef3d25e

SHA256
80f64a46c3b39fb307222a3a0eb2ffa77e955fa5a027ced008f533502242fb52

SHA512
b493b3982775d02cda3f937769a53093f4e554a1763a9db0095e8e65f387019d310457a280e88716daca7222f06bb6b8c50e9cc10e80205f7dd87a2f9e7d1fa5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_fr.dll
Filesize
30KB

MD5
3df832daaee03e976246bb5976c54034

SHA1
49990544b931f09990ba4657e23d4311b4905cc8

SHA256
0e79e860649dd1184bbeddadc3115e55e22bb4776d4fb1da2783cc4958d55c8e

SHA512
d4e014b453cd74cc62fff960d643fadf26cc7700ea63c4ba5d6046584306ce98983c4b71526f84f26888114c6f5063634854648ec605f1ea475d976cf6ecca5f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ga.dll
Filesize
28KB

MD5
e73e5b7acf44f4823f56464ad536c1aa

SHA1
382d6adaa09548807e14c169e1dadbbfa19f6811

SHA256
31e82ed490647094238fef6ea6a59d32afa9bc21d86827489844bb1a421e8382

SHA512
139adde044011fbbc5a9f8d49f68c9d4781462f3bc448e8faa2dbc024310e015cd32ed62fdeaa6fda68b79a402fc4ebb14dcbec75599dd34752505dab957a0e4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_gd.dll
Filesize
30KB

MD5
56564c2b6351adfbc9751ab34767fe1b

SHA1
eecbc4ef374740181331e62a0bb8fec6196b7c91

SHA256
93a54bb6a32d75c93a88cf0442fa9571af3b75784cf4689bda06a5c54b016ce1

SHA512
fe37581300cc7ce752fe9b2bc9d9fa73c60398ec0302e3ffcd20a8aadfd9e5805b33afc9e8cd30fbe08bbbf6e826a87f3a823a24fc7c8f6751a9a18af8779ce4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_gl.dll
Filesize
28KB

MD5
31234ec1260cddfbf8a9fb2000e2d5d6

SHA1
904cef328697ace6bc6a1078abcf5dcdd9f6b591

SHA256
c203bf8be192545469223416252c54fae279ef89927b6b7a760b40c8cd054f6e

SHA512
b71ae536180f84ac116bee42f9ffded9c1328ce975a5b7170a332ca00498bd96f384f9afda76771f13e7d8f2aff31083f7769494fcfcb60e91d4f7f32c412107

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_gu.dll
Filesize
28KB

MD5
9e5af41375e59b2137254b97f2328937

SHA1
71368a812ddfde840ff29f26058c52e6ffb15da3

SHA256
828ddef41c09a2ad38881c3eec3f62bd0f43860389dd3a2dbd62dff50cc938e4

SHA512
f8507aafa9f4bdbf0d49388cbb8e5fcaf96571660ba008f5732ac3ca495ba8d79398c356829463e874120eac989334f56a09c86a464b2247dad4b1bef65a7d22

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_hi.dll
Filesize
28KB

MD5
3392b07a6bf522067dc462c3495f4190

SHA1
150769346378754bafa93efcdea7aa18154627e0

SHA256
d09a9335c4c506bdf242577da46dad30720da0e9245f63e92ff5168a577fbc80

SHA512
498c5a430814107564e223cb45ac5b046abdb3c08a5ebb9513676eaebed9f5966758f4fed203ee428339d95338c1b4d6dd08f00906687e4c430db93d336a7035

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_hr.dll
Filesize
29KB

MD5
785433cd28f779d75a6262e0c9631870

SHA1
aced79a4ff4c9a387dbf5ddb7064f6ee904b2f5f

SHA256
e9f5fea41357e87219593c1bdeb58711937c39571668eab49ecc3e32a3deca24

SHA512
81c02199b1627d2ff38160411f258c211bebd908affc815e7088f8e0d63c0681bfa5b87fd1464cbc3cd77d72517f495a77b37d219057ea608fe05d57a9727fe8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_hu.dll
Filesize
29KB

MD5
47943b80c538514cfd535f83ae9d1acf

SHA1
debd57f1485b72287f25269b63ad47ef7808e26d

SHA256
1955b045602fe5e99fd868100eb345540e26888fb35a9dfac73a6b965c614c69

SHA512
145da5312c9a81fe0daf9ff7688a6924330f4fb5232f466ad6251f87e8da578e7f78fbb614f0607793d44c403fca77d4305677387a6d1a2fb6ba476e293f2f9a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_id.dll
Filesize
27KB

MD5
d79f7e9299a15271e0d14f6303d61a94

SHA1
1dbdbf16e38aef3239b6dd9569d66b37e2a893d1

SHA256
be5df35fa9e6808938de4e6ba32436bcb9d955432618c247a708f4ed90b703a0

SHA512
1bbc242290884598e2c6b22b0f545b3da8357eaac6b4a6a46c83bbd2a6ee60fcd2d5cf1abb3b2cc870f1eef70cf6da4085e7d68a38f1a6a3fa89816fa3cd1bfd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_is.dll
Filesize
28KB

MD5
4ce04a16dc362290bfc5971baf3c7f26

SHA1
f2564d1bc30c0b5798811772f39f3c87e554838c

SHA256
398177b9a330d5ac920b81331f588276e0b49f0291859388cc91885df12df3d1

SHA512
a19b99638a7094a95e95800ef2be761319092756f3f6e07358e8df4656f2833ed5c23d810eb138c2c5b5b63c6a035231ed9e6847a7732777bf21137150002ff9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_it.dll
Filesize
30KB

MD5
54c4e06dae03cf944f77247f9631ea0d

SHA1
a67507366068cef65accd22d4fe88113245a6585

SHA256
f327dd41a607fceb1b281b11323987e8dca8b0913f9ffb6a3c2e79ee5a1ea77c

SHA512
79a3a27feb1521d16933bf188911924033ea7c4bb19bb6a34ad7aa20d82af0587685ae4b8d0b231dc5c63f8d6a6980101bbe94ce9418a47435ccec8442664aec

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_iw.dll
Filesize
25KB

MD5
3229836a05973023e97395223c90cf2b

SHA1
323a3bd6cc7ce238c2f2df61636725d026fd8aef

SHA256
4f707cb66000653593dc85cc8e216fa8fe98446b934366cd14374272cfa38ba6

SHA512
ec5240be52f4adfb8852ff37bc49aa23a800bd93df09d5d95cd68f1a8cacc6de7714c0338385301e20c30d853036c3d271d289424c54190c6112bf7955eaade1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ja.dll
Filesize
24KB

MD5
0f0dd10c2ce0813c52ad43122495bfb1

SHA1
77784a942f57631a6639b95beace4b7b0d8d0b4a

SHA256
15fe44aea135e4a6e5cc3cdced2cb1bdefb9dbe8695ae945be23f13d89cda28c

SHA512
d8060f24c4fda113cd36af4727b569405bc134f7aa5946045692ccaa4b708bf5c4e4afd20a85903a195c72d40fd2e927fc8ded185b5c6a5dbaeb7ab357169897

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ka.dll
Filesize
29KB

MD5
158760bd23846e7a4ad885865ced2d83

SHA1
bffe03d1d6bd84b6df0fb2d7713bce0730f114e5

SHA256
e364a82eea1604ea599de5b4268c4da39dc901f6d215c3e6a0b126c80cdd9504

SHA512
ec6c724145b0bdc19c94445ee26b0e785e11f5faf31e097fab5eccac5c4f5b57f8c245245c780865ca8a64207def43282f95aa97c1deca221c394851945cb142

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_kk.dll
Filesize
28KB

MD5
9a6f9b495e8ffec6d3a43d6de0d92f26

SHA1
bbef5158a7c3a7c94be2857a3cdf91c4dcb6bf12

SHA256
ff1f8d7d184a79384a6ef78358ad229938057f032fda4f39761ec12fd4b4c232

SHA512
f08fa285286d226d08f2c197baf06296676d6cabdf3ebd245e80204af7f86c8303d14b090830b9ef247db1c97c0bb64198ec0748d1c91cf43683e1fa1d5e8905

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_km.dll
Filesize
27KB

MD5
abe8057769a157f41d83b067ba0393fc

SHA1
73c4525407366653e2453199a7a552e040487c83

SHA256
dc81897919bbb226f4a3417668b5eb319873385dbb2a6db6285c80bec03028c4

SHA512
34b20b6fabbbf3a25bca8ddc6b698ef56584d529b24dbf77ba3c603c1b925aec1be3c7049692fc0d2a4742faf315a3956d04640b1c05603b860ef7d266795d73

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_kn.dll
Filesize
29KB

MD5
40eafca5c388a4fe9523d5323d054326

SHA1
09b55326df5beb9d0d1e3885f69b2c53c9c46e7d

SHA256
c851f202f692182ffb27a8b11094bed6f77da248a10f0594ef15fc700715c753

SHA512
c4a354b854d3e5b8b7d6208acfde5fbf2de3d94c9fbeb7ec54b8c4c670ed39d2843aed40a64570f80d019b7d87f31afd31f1f09fb80d6e9a5008fdc346c949e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ko.dll
Filesize
23KB

MD5
850f1a73cf2ae7797e0cbbf3c237f0f1

SHA1
638f5a1c4a55ef1f63da95396c1a5a8ca04c1fe4

SHA256
5c7f441805a435969221b661d75b38a5c6a1820c5ede2d46adcacde864f4b104

SHA512
7fe974c5aad32cc5bf378204f2c99398e6d8c8d62dd55285418a2759546c05afbb761b3905964966f075221e783426b02cea21a7b6e9d30c8236b53dcf5a47fd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_kok.dll
Filesize
28KB

MD5
67cd0ac43fd3a7f52867dfbb3f5cdbf7

SHA1
2dafbaa9f4921d3e2bff688add46af1a43ee4788

SHA256
dbc9c91475c37beeb3669dce683671ed70c1020f745005297fe03d7e77827a7e

SHA512
7135950721b6cee5f51be184ce2a49d52465e7e0cc88ed7cdd7f8358723305336469f8348281ea67ff1eef1711f31ee7f11fa8f0948629ea984baffca31bfb03

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_lb.dll
Filesize
30KB

MD5
61ab38b6ce8196e9b96c88db8744574b

SHA1
7baa2d62db454b82741c14190ac0350e2b2a55dc

SHA256
5d048e0c62150a214c5ee0bb198c69f6c28a6aee0d207ea2ab5168d5dd51166c

SHA512
8928c67c2938426bad3d655ddd1c986bdb1e3306af45963072260ff3ad5b5201e6cb05bc2b6e5c61ab027abc437b9a1d3f6978206e7a468601e986d78b66e02b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_lo.dll
Filesize
27KB

MD5
07ffbf147071d158750fd21c3780c7fe

SHA1
d079c2afe363a130bce6010ec834604812908605

SHA256
8f3046a86582541e30bdac56985a1a7de6c73e0b8c7d798df262af84e119212e

SHA512
10d074f671ef874b17a9120f229f5f56a78fa6b133f81171df931832fac0c037e3c9359dccb9e5b8961eed4ca26b7123c51e16b07d3d4e40d550e928d47e9343

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_lt.dll
Filesize
27KB

MD5
81536ae50a9a635f93b3abfab4f1737f

SHA1
66d176516fd6dd47fff8cadf49fba230b36ee00a

SHA256
ac03569cb056376e521f2d1b817345416a2a8e2862471b71ba2204b929387722

SHA512
501e6364b0dae9efa5f0fd5680623679eedd43b5babd63f60c9b8e8fb5fa832b6943a1f31d218552a5b176a9a1762362f859401107e14657158013327030d9dd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_lv.dll
Filesize
28KB

MD5
f5dcaa91404d49b72e3b516791f0b4b7

SHA1
ecfdcb3979874d4b2b849a9bca0465372b61a7c4

SHA256
3843f7c36283c6285befd7a80367b7ea6eb47696fa3964dbda6676069f4416d2

SHA512
f6c0e0a8a033102d9000fde3b8dd08136a426aaef6a2b26aa51b86e75f0bba066cd9bdfeeeb5d8cc8f26158721747ffff9fece3849600f927750ffcb8319e710

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_mi.dll
Filesize
28KB

MD5
ae3b4e0c869cadcce0f6164c21c18606

SHA1
2e9765832c1221c495462b23903e5e9edf5fd2ac

SHA256
83c4faa518f664b4b9554e104d029866eda6d14db3da3a32dfd267a0d1081689

SHA512
69ac39feb8d4475c65fc245946c4831ff604de673644444dc9d8531cd9cd11f8b46dd924155e4c2c56041f092f898f420aba3c84ab7f123a5f4e1e40b7cd0aba

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_mk.dll
Filesize
29KB

MD5
999dbac7f3fdd3eed5b1250b5911da07

SHA1
19e438c1e2cb4f6abab6bae078d20cdd23372e4b

SHA256
56845f8c2fd3ff14bbc611f62f5a682dfac430686f9ede2df47d57085778b489

SHA512
91159290ffdf53db14202d40f6998d0a54825d5445c0d1ebda46a86a3c8ec36bb7027d922a722131902b6956a49cd671b12a8fffb790b017abd5afdc80e9fc87

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_ml.dll
Filesize
30KB

MD5
64364f20f6819ccb4a6637009975a0dc

SHA1
025d246f877f9686893ca0eff3258fbd86cc24f9

SHA256
690420e1d748ad75e4ef745fab8c1c1a7b1f0fc0b655f8882658582afd49669d

SHA512
ddae483ed7715d7d2ec5b1e78f8eef6bb5a91643766b149636713a461727c0fb33c2d9b4c4bc418868ce0d3dd8dfbe640bd9c48d00119f159fa263a5d4ebd152

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
Filesize
14KB

MD5
33b555f33dd95b79b328fa675b17dc6f

SHA1
478b90e20bf8afaf556d0323dc2fe55d7ed3a2cd

SHA256
e35805f75a851a99648d305aabff11673ae6373e6c1b56a19e58fa00f72ada13

SHA512
1a588fe06483419c10b3204bf3a3ae570404ede750bba8622361275ee77035ab7ebdafedd2e7daf5dba7d4851629c6b79636da3ad69819a5168dae6e23f50c13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
ffb6d86af0531284e2555d44459ca1b7

SHA1
5ddf2a6a5144471c2132bb636f073456bfae6ffc

SHA256
5ed5b2a5821449a7ebaa60f89e5da32975ed269192a18c3495b53878ad968c8f

SHA512
8f830948ded57bfe0f4519e7c599f7864d5dc1dee9c61763961f005952f90ca32b7fd3bf50ce8b621916ebbbde04e2c8e161729dff21d79fcdb3e247d7976b14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
7c5937a27a581be9da0b504b6569729f

SHA1
9100af63e12ca78dac94ad2ce193d1285306bdc9

SHA256
6beac7e49aa0222cbee026c063fe356a54eda79ff4cc8acdcb7afc8b392dd8ec

SHA512
268c640338b18a583e92fd601b6badc0965efb6f388a8b47877055b06643b5da9b7eb49c8c0786ab9b23ddb3bbb4e58576d9d8fa0daa88e32dadaeea2f776834

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31A3.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
6c42ab320efc69f5237229834d5caa96

SHA1
402b401084d14fa4d669888fae79d7d90b0e8466

SHA256
f60da9e3d362e70412042f1b28b23ef5e7ff4889a395a327e9fd018b1938da74

SHA512
63bd19587a9c34f65c31eda87ad1dcacb60caa1df54534a62ed10044f5c611a40d7f50347022d36c5908d89c536c1b1cd5ba95d31ee0826dec18c94df4d76a75

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
a7209f28665e58e88db77a993ca81be0

SHA1
9ac3a35adf3dce6e2cd14a4e2e3bf64c4247dde2

SHA256
a645b901bb43cbe5af747979210810a807a3f8be01b6063570d176abb7ada201

SHA512
6e85f46eb964b8cd4d0cf3585f6a158be41178435cd189fc1a76db042bbb6fb430df6b8337e3dda52bd8456a3237cdfaf4e725cc3502d0791ea67b703103412b

Download Submit
\Program Files (x86)\Microsoft\Temp\EUB38.tmp\MicrosoftEdgeUpdate.exe
Filesize
201KB

MD5
9789883e5166929441ea640b8809910e

SHA1
bc4d75ad286238eda2414f8da3dbaf7b727d0061

SHA256
737a36758795995066093c92c079501cea125c253a58b6062199607129a85f51

SHA512
ce73c9a473ad94d9eca8ef4c1e587190fe7cbfef100371984612f4f9144390c5eca9ba9ff976ddd457894df9b06048105673d580a0f2222ba76573b432885e13

Download Submit
\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdate.dll
Filesize
2.1MB

MD5
a332a035f2de55630c1b2352728f9e7d

SHA1
471e922e64199e6f2be88f1d843cf0a4d7721d68

SHA256
621375559f7d7c13133c9b9117529d420991d3f09052e33052d4547d5f67c51b

SHA512
bd76164ff1e260eaf80f7963f178c646152e0cd69c1a30c3df55ad2a91dab5e8779a5f9cf325a696490dc8f637c45e5bd0cb3275511d31b92ecd52e873d74a25

Download Submit
\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_en.dll
Filesize
27KB

MD5
abc8b49076448f73a726551689d5801d

SHA1
086a9ede0ea4bb5711e3432e1e2dbad058ee01c8

SHA256
d52e7b6406ec97278ccb51fb1750d88df372ecace9da409dbf0b228abac88730

SHA512
d129ad1f0a2503a9d654a595d167d1d87df71da1571038c3fa93d437ba4e59644a51ab6d008c48d7654e76e0187f121e49e324c2bbf63c80ba1482d8015a7763

Download Submit
\Program Files (x86)\Microsoft\Temp\EUB38.tmp\msedgeupdateres_en.dll
Filesize
27KB

MD5
abc8b49076448f73a726551689d5801d

SHA1
086a9ede0ea4bb5711e3432e1e2dbad058ee01c8

SHA256
d52e7b6406ec97278ccb51fb1750d88df372ecace9da409dbf0b228abac88730

SHA512
d129ad1f0a2503a9d654a595d167d1d87df71da1571038c3fa93d437ba4e59644a51ab6d008c48d7654e76e0187f121e49e324c2bbf63c80ba1482d8015a7763

Download Submit
memory/1796-243-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1860-216-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download