120b1cefc94d76ec593a61d717bbb2e12af195d19e04c811f519d3f9b9b3b5c0

Resubmissions

28/02/2024, 03:17

240228-ds1rqshh8s 10

28/02/2024, 03:01

240228-dh1nzshf9x 4

28/02/2024, 02:39

240228-c5sq8ahd97 6

Analysis

max time kernel
155s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PowerToysUserSetup-0.78.0-x64.exe
Size

249.8MB
MD5

aa98e52c780c510c6d7a7eef1859cb4e
SHA1

da888750065c08be20312e643782a9b1255e7eb4
SHA256

120b1cefc94d76ec593a61d717bbb2e12af195d19e04c811f519d3f9b9b3b5c0
SHA512

1adee598c5c6ef32acfef1343e404dfe0f82fe7f02bde851236006748d9116e8e848e8ce120de811bf2085029635ffd8a70c923574666791f3ef6dc8010e85e3
SSDEEP

6291456:Yan+LwMs9L55ZETFxAVHpn0XXTC2XNBgRAEnY2pnHFQ8/C5kX3hXMXuMWA:Yls53uIVJn0XG28bYmn2ookXyoA

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{2229436b-e304-42ae-befd-275c080f99dd} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{2229436b-e304-42ae-befd-275c080f99dd}\\PowerToysUserSetup-0.78.0-x64.exe\" /burn.runonce"	PowerToysUserSetup-0.78.0-x64.exe

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Locales\id.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Locales\zh-TW.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\telclient.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\msvcp140.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Installer\msedge_7z.data	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\Locales\hi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_zh-CN.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\Locales\mt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\Locales\ug.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source224_1081269798\MSEDGE.7z	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\msedge_pwa_launcher.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\eventlog_provider.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\msedge_wer.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\identity_proxy\win10\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_kok.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Locales\pt-PT.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\VisualElements\SmallLogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Trust Protection Lists\Sigma\Staging	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\identity_proxy\win10\identity_helper.Sparse.Internal.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\VisualElements\SmallLogoCanary.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\VisualElements\LogoCanary.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\vcruntime140.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\microsoft_shell_integration.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Locales\lb.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\v8_context_snapshot.bin	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\Locales\th.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Locales\es.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_ca-Es-VALENCIA.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_kk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_as.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\vulkan-1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\ffmpeg.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\msedge_proxy.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\Trust Protection Lists\Mu\Social	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Locales\km.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\d3dcompiler_47.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\BHO\ie_to_edge_bho_64.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\msedgewebview2.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\vk_swiftshader_icd.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\Trust Protection Lists\Mu\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\Locales\ka.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_ro.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8805691C-BC1B-47C0-B4C0-047C3FE4EFC6}\EDGEMITMP_56754.tmp\MSEDGE.PACKED.7Z	MicrosoftEdge_X64_122.0.2365.59.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Locales\es.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Locales\sl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Trust Protection Lists\Sigma\Cryptomining	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_mr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_sq.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\Locales\he.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\Locales\zh-TW.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Locales\gl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\Locales\en-GB.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\Locales\lo.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\Locales\sr-Cyrl-BA.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdate.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Trust Protection Lists\Mu\Advertising	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Locales\ru.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\microsoft_shell_integration.dll	setup.exe

Executes dropped EXE 15 IoCs

pid	Process
3100	PowerToysUserSetup-0.78.0-x64.exe
3452	MicrosoftEdgeWebview2Setup.exe
4800	MicrosoftEdgeUpdate.exe
3456	MicrosoftEdgeUpdate.exe
4448	MicrosoftEdgeUpdate.exe
4520	MicrosoftEdgeUpdateComRegisterShell64.exe
2248	MicrosoftEdgeUpdateComRegisterShell64.exe
3636	MicrosoftEdgeUpdateComRegisterShell64.exe
1444	MicrosoftEdgeUpdate.exe
4496	MicrosoftEdgeUpdate.exe
2316	MicrosoftEdgeUpdate.exe
1908	MicrosoftEdgeUpdate.exe
1856	MicrosoftEdge_X64_122.0.2365.59.exe
224	setup.exe
3428	setup.exe

Loads dropped DLL 16 IoCs

pid	Process
3100	PowerToysUserSetup-0.78.0-x64.exe
4800	MicrosoftEdgeUpdate.exe
3456	MicrosoftEdgeUpdate.exe
4448	MicrosoftEdgeUpdate.exe
4520	MicrosoftEdgeUpdateComRegisterShell64.exe
4448	MicrosoftEdgeUpdate.exe
2248	MicrosoftEdgeUpdateComRegisterShell64.exe
4448	MicrosoftEdgeUpdate.exe
3636	MicrosoftEdgeUpdateComRegisterShell64.exe
4448	MicrosoftEdgeUpdate.exe
1444	MicrosoftEdgeUpdate.exe
4496	MicrosoftEdgeUpdate.exe
2316	MicrosoftEdgeUpdate.exe
2316	MicrosoftEdgeUpdate.exe
4496	MicrosoftEdgeUpdate.exe
1908	MicrosoftEdgeUpdate.exe

Registers COM server for autorun 1 TTPs 33 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2116	taskkill.exe

Modifies data under HKEY_USERS 47 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\lastrun = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D22D5B4-96F3-4061-8EE5-72D35A140205}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Installer	PowerToysUserSetup-0.78.0-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ProgID\ = "MicrosoftEdgeUpdate.CoreMachineClass.1"	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4800	MicrosoftEdgeUpdate.exe
4800	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	taskkill.exe
Token: SeDebugPrivilege	4800	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3100	PowerToysUserSetup-0.78.0-x64.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3100	5076	PowerToysUserSetup-0.78.0-x64.exe	97
PID 5076 wrote to memory of 3100	5076	PowerToysUserSetup-0.78.0-x64.exe	97
PID 5076 wrote to memory of 3100	5076	PowerToysUserSetup-0.78.0-x64.exe	97
PID 3100 wrote to memory of 2940	3100	PowerToysUserSetup-0.78.0-x64.exe	98
PID 3100 wrote to memory of 2940	3100	PowerToysUserSetup-0.78.0-x64.exe	98
PID 3100 wrote to memory of 2940	3100	PowerToysUserSetup-0.78.0-x64.exe	98
PID 2940 wrote to memory of 2116	2940	cmd.exe	100
PID 2940 wrote to memory of 2116	2940	cmd.exe	100
PID 2940 wrote to memory of 2116	2940	cmd.exe	100
PID 3100 wrote to memory of 3452	3100	PowerToysUserSetup-0.78.0-x64.exe	102
PID 3100 wrote to memory of 3452	3100	PowerToysUserSetup-0.78.0-x64.exe	102
PID 3100 wrote to memory of 3452	3100	PowerToysUserSetup-0.78.0-x64.exe	102
PID 3452 wrote to memory of 4800	3452	MicrosoftEdgeWebview2Setup.exe	103
PID 3452 wrote to memory of 4800	3452	MicrosoftEdgeWebview2Setup.exe	103
PID 3452 wrote to memory of 4800	3452	MicrosoftEdgeWebview2Setup.exe	103
PID 4800 wrote to memory of 3456	4800	MicrosoftEdgeUpdate.exe	104
PID 4800 wrote to memory of 3456	4800	MicrosoftEdgeUpdate.exe	104
PID 4800 wrote to memory of 3456	4800	MicrosoftEdgeUpdate.exe	104
PID 4800 wrote to memory of 4448	4800	MicrosoftEdgeUpdate.exe	105
PID 4800 wrote to memory of 4448	4800	MicrosoftEdgeUpdate.exe	105
PID 4800 wrote to memory of 4448	4800	MicrosoftEdgeUpdate.exe	105
PID 4448 wrote to memory of 4520	4448	MicrosoftEdgeUpdate.exe	106
PID 4448 wrote to memory of 4520	4448	MicrosoftEdgeUpdate.exe	106
PID 4448 wrote to memory of 2248	4448	MicrosoftEdgeUpdate.exe	107
PID 4448 wrote to memory of 2248	4448	MicrosoftEdgeUpdate.exe	107
PID 4448 wrote to memory of 3636	4448	MicrosoftEdgeUpdate.exe	108
PID 4448 wrote to memory of 3636	4448	MicrosoftEdgeUpdate.exe	108
PID 4800 wrote to memory of 1444	4800	MicrosoftEdgeUpdate.exe	109
PID 4800 wrote to memory of 1444	4800	MicrosoftEdgeUpdate.exe	109
PID 4800 wrote to memory of 1444	4800	MicrosoftEdgeUpdate.exe	109
PID 4800 wrote to memory of 4496	4800	MicrosoftEdgeUpdate.exe	110
PID 4800 wrote to memory of 4496	4800	MicrosoftEdgeUpdate.exe	110
PID 4800 wrote to memory of 4496	4800	MicrosoftEdgeUpdate.exe	110
PID 2316 wrote to memory of 1908	2316	MicrosoftEdgeUpdate.exe	113
PID 2316 wrote to memory of 1908	2316	MicrosoftEdgeUpdate.exe	113
PID 2316 wrote to memory of 1908	2316	MicrosoftEdgeUpdate.exe	113
PID 2316 wrote to memory of 1856	2316	MicrosoftEdgeUpdate.exe	123
PID 2316 wrote to memory of 1856	2316	MicrosoftEdgeUpdate.exe	123
PID 1856 wrote to memory of 224	1856	MicrosoftEdge_X64_122.0.2365.59.exe	124
PID 1856 wrote to memory of 224	1856	MicrosoftEdge_X64_122.0.2365.59.exe	124
PID 224 wrote to memory of 3428	224	setup.exe	125
PID 224 wrote to memory of 3428	224	setup.exe	125

C:\Users\Admin\AppData\Local\Temp\PowerToysUserSetup-0.78.0-x64.exe
"C:\Users\Admin\AppData\Local\Temp\PowerToysUserSetup-0.78.0-x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\Temp\{D2874EB5-45B6-4139-BF91-5532481536CE}\.cr\PowerToysUserSetup-0.78.0-x64.exe
  "C:\Windows\Temp\{D2874EB5-45B6-4139-BF91-5532481536CE}\.cr\PowerToysUserSetup-0.78.0-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\PowerToysUserSetup-0.78.0-x64.exe" -burn.filehandle.attached=528 -burn.filehandle.self=536
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Package Cache\CEEB2F4674AB44E9EBCE9175CE716612D979979C\terminate_powertoys.cmd"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM PowerToys.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2116
- - C:\Users\Admin\AppData\Local\Package Cache\F7119E3AB3D5CB3ADCD9A57F0EC227F783695819\MicrosoftEdgeWebview2Setup.exe
    "C:\Users\Admin\AppData\Local\Package Cache\F7119E3AB3D5CB3ADCD9A57F0EC227F783695819\MicrosoftEdgeWebview2Setup.exe" /silent /install
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Sets file execution options in registry
      Checks computer location settings
      Checks system information in the registry
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3456
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4448
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4520
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:2248
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:3636
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTUuNzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNTUuNzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzE2MzZBRDUtMkVEOC00OTc1LUJCQUQtQTZBMEVCMjZBMEUyfSIgdXNlcmlkPSJ7QUY2QzI2QzUtRTUyMS00Q0Y1LUIzMDktQjZCOTQ4NDVDOTRDfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxNzFFNDBEQy1DMURELTRGQkMtQkEyOS00OEI3N0Y2NTM0NDl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTg1LjE3IiBuZXh0dmVyc2lvbj0iMS4zLjE1NS43NyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIyNzM0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1444
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{C1636AD5-2ED8-4975-BBAD-A6A0EB26A0E2}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4496

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTUuNzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNTUuNzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzE2MzZBRDUtMkVEOC00OTc1LUJCQUQtQTZBMEVCMjZBMEUyfSIgdXNlcmlkPSJ7QUY2QzI2QzUtRTUyMS00Q0Y1LUIzMDktQjZCOTQ4NDVDOTRDfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyMDg3Q0U1Qy1DMjkyLTQ3QTQtQkQyMC1BMTRGNjg1OENBQjB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbmV4dHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZT0iLTQiIGluc3RhbGxkYXRldGltZT0iMTcwODk1Nzg0OCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1908
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8805691C-BC1B-47C0-B4C0-047C3FE4EFC6}\MicrosoftEdge_X64_122.0.2365.59.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8805691C-BC1B-47C0-B4C0-047C3FE4EFC6}\MicrosoftEdge_X64_122.0.2365.59.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8805691C-BC1B-47C0-B4C0-047C3FE4EFC6}\EDGEMITMP_56754.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8805691C-BC1B-47C0-B4C0-047C3FE4EFC6}\EDGEMITMP_56754.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8805691C-BC1B-47C0-B4C0-047C3FE4EFC6}\MicrosoftEdge_X64_122.0.2365.59.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8805691C-BC1B-47C0-B4C0-047C3FE4EFC6}\EDGEMITMP_56754.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8805691C-BC1B-47C0-B4C0-047C3FE4EFC6}\EDGEMITMP_56754.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8805691C-BC1B-47C0-B4C0-047C3FE4EFC6}\EDGEMITMP_56754.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff6823569a8,0x7ff6823569b4,0x7ff6823569c0
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:3428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.59\Installer\setup.exe

Filesize
6.8MB

MD5
8c341afeb407894f79b6fc7e7464e9b7

SHA1
36ad5b522b89b1d7b37799e6b2b047d15a4d9310

SHA256
f3e51e00cdf60e762d7764b1c0d8d9c2ea497d9897df1665e831cccd8945f25b

SHA512
35334f1a3d3a1ed95b8e96c76f65f24261db48e58db7d2650fc80c0d791ffdb2bdfac1519435c0a3e2d63d06ca813e33a636cae63bb1870b48c1ffbace556ef8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\122.0.2365.59\MicrosoftEdge_X64_122.0.2365.59.exe

Filesize
12.6MB

MD5
3e60bebd9e5ac247e74d51660ea7627a

SHA1
b12b48d0681d1dea1a5dc4fbb87f8ee64edf33e5

SHA256
14cfb975c03f50c8ac807823b3cc0543c77cd9847c91e979a584437b2e36e776

SHA512
d00340f4f5277a55fc3d7676e54e24bab67804d5511f1a8d48115cc11be6a5280219e1fa6bda54b270bf310c208570648d52e703f4e627222e2589da07c1e632

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
160KB

MD5
cf9a26b458293978a908536927ec327d

SHA1
e8b293e3799f352921c7f430648c21f79e47b052

SHA256
4faa7cd71e234433f684c3d70efbfb1ada8d4172fc55caf78c0705e5646b0ba9

SHA512
54447d830595fd5e4cb8ff60e78916b676f983033397932fc0ff402cc310771d9e448cebdb1bcae6e0dd3d90c8968df01171ac52a1e14a36eda950f67909e714

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\MicrosoftEdgeUpdate.exe

Filesize
209KB

MD5
0032498af2ebc50357cb31f1024c87fb

SHA1
9818522c47ec379ff7bddf92ea72cd831691d094

SHA256
c6bdf041b02561700c71c6275df4704a52d1fed4ba6a1bec98a602c6c325d6e7

SHA512
f83fc43ca54e87a67d949666ca8c30721f372312042be978b01dcdccd530ce5db4d3d9d6ddc934a92c079825b91fd988f362cd481dd87fa09ddf2cfac85c05c3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
204KB

MD5
cbb1acbff5a8ce79804e687be8e3e75e

SHA1
0bb50f813e08ff13d637a8f4ee66e4c0f1fb01ca

SHA256
6d483505a0c9fd508ef48323099e2c64fce025e4b018df1d80d60aa00d8fb004

SHA512
7f4a8df19f94c74b1898109804f4ec596abe32ff59d35279e58b139cf3210f6faa2697eca422435a193f4f2f90535187fcd233a018a54a0cfc426ced25de5ce8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
241KB

MD5
f70b0fc2f46f5e7082817a11c39e3c54

SHA1
9939591b236bdd16ea02e79eb11a2d6fefe2af44

SHA256
f6e636cfe7c53c120d834756f52ab407f1c5dc97c27a14e557f24c176e86d87f

SHA512
b8bde38507eb84725aad9b7ffa33eae462fe6c7779f7ba650453b10bc9b52128198c4e29a568b0ba865fe266c19af81efc3f62a7ffd68e38e9d403d71b1afd79

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdate.dll

Filesize
2.5MB

MD5
00670be258aacf4ca0c01ca980e96354

SHA1
4ed09d74b4eb0cb5b95ab37e341025fb7081287c

SHA256
0cb9d6c4fd45a3ba0f8e8c450e90beeee40e57b092906b841805fd3a24da4402

SHA512
79a8e1c944d7e38087668db4052f604b4aabd605f7628e2b2fab8526a8001152b2b9e2e6d15f41e701df24e2e44077b0561b88f64de01ac5366a4d9e696cede1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_af.dll

Filesize
27KB

MD5
0d8ca15cd08112472d8f725b9d26f400

SHA1
6082361001436a4d2c45babb755601a19bc58a10

SHA256
a36ec679129d8fa6e3f56b37c88e7d3406bb4d6d74e559e5a272ac8f34a812f4

SHA512
8ec03222c8a023fba580a309a487e4d9535cded212ce47aaf3d7f4cda250c99ce25417330e0508b0a306e0ba14f9451cda0a31c550fdf0ec92c192792af1e23b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_am.dll

Filesize
23KB

MD5
5b981b86b65935bae5fe5805660c7302

SHA1
1107f5a6b8bb4ed1e95f621fbb7b236d6a57e11c

SHA256
bd380d64f5b9dd6bd979a78e912f1a3d2a7c08eda3418abc85d67c43c8477264

SHA512
d00f6d92f0efa0c89ee042abcb8b583097cd173d80b8009fc9dcda98a25c73edab970d607b4993831577812335db49dd3d76dba64a4cd6adc7b57494f0f78766

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_ar.dll

Filesize
25KB

MD5
5e9ba26ad6068d5b12ee2ebd74d66c03

SHA1
2081cb86bbc6e20965b147f4178990f4c9ba52e7

SHA256
6fc47a7fefb2ea88371b5e1ea84b24faaff6d4ccb503e6d9903b8301d16715e6

SHA512
ab2eb6ae054cc107b83d877fc44dd62380c4098fbb805033c1d1f87d7172384c4cb7482d1f8931ad5f5b7dd181f6239748497e4b5866c2f406c310c6837028c4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_as.dll

Filesize
27KB

MD5
30a0dfc5374347d838199254ef2b27e1

SHA1
739c8197c111eededbdfb8e1940e63188bd8c5be

SHA256
92cc3b354e786d428ab3bb43c77119b81a2960b00bd9d99550639a8b5c0428b6

SHA512
b8611af4595eea99fb45653f6419235368075664721c467753cedd3b71507a28e0d6c5fb2c4b3e01db56d4842c043b14e20ac1ae7c225e7d678c77befdfccd1d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_az.dll

Filesize
28KB

MD5
da1dd46046721726b57bab405c7b7c49

SHA1
f42267672f7112d772feee601d2add8346a0a89d

SHA256
d699ca97e2bc94f0ecc95b2ccefed201786535e7ada3fd6ccb543f42cfc273b8

SHA512
b71909c7df499a702b199b87a96d7f25fcc82a0dcbe1138e900b3f386a6204d1b95e37941f32f61a0a558ce2b514f938b0029c55da0e4955229863d8b4b40061

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_bg.dll

Filesize
28KB

MD5
9fbe7d6ef07bd3af76a9fc97dfd90e95

SHA1
300ea110b9ec0ef6c754950ff4dd59dbfc9f2b23

SHA256
fef5f9a3ac4626f756b28f6304dc5e5e50bff553930ff35d6b8429ee494b4313

SHA512
0df3f0af13d5ed4291ba179846a741149807e073c767b90ab5fd50449879429de6dd2b43954b3a52d3cc77ef4c98dc9efcd594c17784b48c97bf5bdccc90cc97

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_bn-IN.dll

Filesize
28KB

MD5
583c93b26e5dcd4bab07f7d303ebf5c3

SHA1
439e6d4762c2a3593512ff103a8ff32110fd0da3

SHA256
c0bb2e9167995db0d8f1f69a202ba00529e2ead8daeb29fcb99d42b0613efb2f

SHA512
aafbc518e596969d20327a2b860b63013b1d5bb7c89faacff0ba95a9f6bb160dffd5a0058475ec1ba2c5d07cfd8cd4a0cffe4bb89bd4bb74b3e5981d6beec414

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_bn.dll

Filesize
28KB

MD5
fef17d66629715ae8ce4ab00464152ca

SHA1
f62db519180eaaec0d62f56bf1dabcf353583aa6

SHA256
2ee6f8216f4953f3101de9578b392e2de94d59a79d08cbdd327b3d433f2b70ee

SHA512
98b2647b3bbb2476371fbf9329fad70934bcc7e1f958e925bbfca17a7083e47a5561db986d260025c339b051f7f00bcaaff938ff351032b95075bcc589b7255c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_bs.dll

Filesize
27KB

MD5
c359759bc31042b62167a40c7c0203b0

SHA1
21140ceadd92ab23835c0e7a8f2e2fb95d0ccbdf

SHA256
43fe0258ad799cae8bb20f23c20d74fbbb4b650b97b1b5b737d1d1728556d897

SHA512
1d5837ef553223ac09e93df362da460002fb4f9eccc19120c4fb8c29cd453139a3cef54e9514217ac2d862a423d7a82f3e3d9b09f00c611cb16f19dfbe90979f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
28KB

MD5
5928df4290e3b6e8676a5aac6ddbbc31

SHA1
d83b71bc4b37c3b228b113239506f89761a55f7b

SHA256
ac5f350f4dc790f61135186c113bb2b8a78f26dab322ddb86b0e3403ab960721

SHA512
90113cfe50355d6df04382ee69db6ddad1651e771d0182e28d0d3de3d1d5a2f10d22d5de2b54e12bff1fa5d478513c881e9cfceb2b471746fa870516aa3d0e69

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_ca.dll

Filesize
28KB

MD5
c2cc0764c763cd30ab629173ad2c9fdd

SHA1
0e681669c04e102a4b031378b38c2645dd42bb3e

SHA256
f3b266910a5bc6f738c154cb6a754cb55df05ad7f01cd6d61cd6e0cc8927455e

SHA512
f54ac389ea62f4c4af5cfd727be094d43976c53a84a1df4313fa5c81bdd9f7038ec9b13832abda95d6f496956383708b3828f41e4b746ebf645dbc343f6568e6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_cs.dll

Filesize
27KB

MD5
ebe48b47180b491688ec519a8d9bef73

SHA1
bd98b11dbaef493968d999c22e2e35fdadcc51b2

SHA256
02aae7715ad305977f316b9c80989ec63371c4c3e813b64252fe5f92143201d3

SHA512
7b2b7204505d73ce66ad070bd31a7790dc56ef071bd233b7be3eb1ecf82a9cc30a605c0524c707d10a9828849de69a7169f8af5b7ea1c4da797deba89bcafc20

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_cy.dll

Filesize
27KB

MD5
909c5c6afa14ee9756a4291077f2359b

SHA1
819e5e4f3197a6f45b5ce461ebda5b8dcf5a9a8f

SHA256
7b0b45ab3f199a316d33be841867e0e5219db63174efb5e6d9866816a3faf770

SHA512
a7b75854111e769dbfc0fef86e6561aff12b883c34cd91d15a2f209c68d76412670e9ca732ca159bab42176a4c3f1d9707f8e9db5e21143c15d13eafa1381d54

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_da.dll

Filesize
27KB

MD5
764d47b36dc060e15414e850c974b983

SHA1
4cd0ef1c6a951c50844e441a3673de505aa38004

SHA256
3fa89372d50cee57a316e279bb092287fad67ec1f47cc8f75178a985f43b5cd8

SHA512
9017d3ddc85a919fd1ad5ae182c2e4f1194eeadea98f185a158b5c424b7730f30f10b18ca902cbbbc83d6567033d79327c7b1efa89d36b55b9066a8785530984

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_de.dll

Filesize
29KB

MD5
24068ddcee174136374b56b4148678af

SHA1
604ed94670081d22a50436076d813f3f09d71e10

SHA256
8480fd2d3c59530bcb1fa9a07de57f354d4222155d928d1784cad51dce9e30e2

SHA512
f8969cd5d3d34c2b1b1be9cc62d5e33cd7798ceced2ecb173c4c01fea3fdf72eac91bb533a7b2ccee6fcae5ae00c56c5f945de70c003ff30838c62a211a837fc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_el.dll

Filesize
29KB

MD5
62a99787a2c037f72588c10af0a4f97b

SHA1
376981b7ab0da3a63dd324fb679046c1e2fa2542

SHA256
b2b41c07abdc47d8670ae0f0c109450de99e95888cc2a1589bb526ab5c6204dd

SHA512
23c9eae2398adc8ebd15ae8067d528650612d2ed7afc3378bf7bf86453139ae1ec77283f15c1872f553e9461cfef4a5b0b4e7111b86124f628f19ab1e4cf6251

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_en-GB.dll

Filesize
26KB

MD5
8816264aa944a8f17e3080af13badfe5

SHA1
a200bdac7ddd6e52dff02530bdb6bcaa7c0ec271

SHA256
6d059098bdc372b4cf14b3bde4832ff2c68e4012fe5bf6bfdc08a39c5f746178

SHA512
89eb5ce3df70977d257f8524df8fa3f3f45432e7d9000db371f228f0d574b7dd844682eda7cd8a511d44bcfc4731dfad053db86ad5570abbb6d9a7db103e9bfa

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_en.dll

Filesize
26KB

MD5
c4e594d01bdcefcb1b71f06697e13c89

SHA1
26a90b0912332fde26451e2efbbed6bd8c4bd02c

SHA256
a1be434cb4d92a01fa3b43c1967f254be29dcaa25ceeb6cb13fed711f90b81ff

SHA512
1d0a1cfc7c8e10bc6b2cc9dcf6db0e204877439fa4cde26e6b1464cedb35676e67416956ca1b2873a10f0ab00a6049d000097c254ede77b06b1f329c34f17d0c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_es-419.dll

Filesize
27KB

MD5
a3a5c7c28cdbe9ff4df338f6f9718944

SHA1
4c73b46b2076a16f8b21257865ce8b3d9ca94263

SHA256
c2eda53aad3225b73496c9eec5f933d902dc9a3e7c90530f77b5bbfa269ae09a

SHA512
1db7979e99b207f7c31a5db1cdcb76f6738c622c9c9146ae07a232c40f3dd2232f031c295d802bd3472006cd384ae7739ad6afd47fc31984b2101c6a2a0ecf8e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_et.dll

Filesize
26KB

MD5
657c0184668515f256a8011c162f0bc1

SHA1
ef56129d4edaffd59342ac2e94be2c570f44d23b

SHA256
453597b38cb5e06b4596d8ad3763b08cbcd806fbcab0228179b40c065a7523fa

SHA512
9340c5eebab4376b7fafd32985ce625f808311ab58d028c246095804c8022bf6e7e7dbc366974e5b80bb4117558ec566c1d40839ae451277d97cf8626693b223

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_eu.dll

Filesize
27KB

MD5
b12325fe45848101245c164385c62205

SHA1
a3c8d6938978c30c23534515bcdf45bb27eba40b

SHA256
0fad2dc2ec7c313cace9afac3e645ed0b0d34df468a6f51450b15ab71793c3c4

SHA512
1f5e63aa4061f9b1ea9f7fd3e092d8d978df6c34416e4139f7a7eacf8976ef8a5dc1b89a69e276e6e02d7b15f4ab50a2b958c98585563cd51a582561f1f6ad93

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_fa.dll

Filesize
26KB

MD5
8ac4c8e4072943915105e358f3b53193

SHA1
0badce4b142c3ee14ac906bf6be7d19f4af46641

SHA256
abe601ab7930302cd675f3ad1582b9fea3837166e74f23f24765eabb7ae86d1f

SHA512
267795330e1b10e29d4a7e54af14f3f621a612eb9b2bbd336cb2eec3e4feee29baa9e87c08136cafda891a3729aec4669cf55684d27f950695195bc20ee752ef

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_fi.dll

Filesize
27KB

MD5
0b6513b1eeb7193ec6561ee4c82f0315

SHA1
fb5a8b42698aa4250179e5070422fd8adbfa9e6e

SHA256
46c2c90780924935d4213ece24151f07e63d6c1dca4d99ac0542967a56ee9f03

SHA512
37dbba2e969534dea488a64aed6b9a3e2ccb079b36865dd00f5e60f87699f60e7626ff85861aef2d52398fd95cda1637e39a47e037e26dd6feb26268fbc40ad6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_fil.dll

Filesize
28KB

MD5
c020597034e8e3f1a06744195ac08468

SHA1
67a9485915cfbac21d4ca172f685448e89bde928

SHA256
6ee5908725a1780779a72022a1e0d9bca32a2f027907e7ec1b12a964221dfb96

SHA512
d8ee3eb3f810b35dac344828cb920fe5fd0a1c8a17ee72b5a9b7e253b054b7bb43b65d2f1fc4232aac4364597c6fe8cce68e9f2867038661b1421343234a4824

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_fr-CA.dll

Filesize
29KB

MD5
4df8d16f45846075e652ca9b701faaff

SHA1
a605eaa6cf9fd4ff2e46aae331d48cbda1e50102

SHA256
03d31c89ff1512a0671390151d0f30015fa445ba45364cbc4dd6fcef07198d37

SHA512
3ef64490fce1702632557a7ddc24363620ca272e8b61e48c1f2b74374db83b52a59f156cdb019e0205d0d6096ec9fd73a15183eed2e3e0b8d8acc9b96e3e0690

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_fr.dll

Filesize
29KB

MD5
5b460959d67d7c7dee8966c7593e2d9e

SHA1
bd4e1eb217d319f9367a3134d488eb57ef7456f4

SHA256
7c8218e882f0b19291f8088fc1a0e9d8f793465b80b84c282558e19ee349efd1

SHA512
c15c161b1cf16e8549675523ab2ba5086e5e090cf7a837f2aef6bbcce201505f9ff2478c774261ddb9f8ff563f8fb41dec0c6d8eee43841ea1fa0455e9b11136

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_ga.dll

Filesize
27KB

MD5
807d3b85c91a3a78d857724f6d4df8f5

SHA1
64fccdca9e003186890c336dc5667455b8055c71

SHA256
2a00e20da2ce93516d077fb52db7149b162e5a6b9fbc4b8f7ad442d3e51d3c8c

SHA512
66ce1ce09d055676c919f36e31d944e7c4d5bcae0b6343d22b6fd8880602b326f9fa610e7e120daddc99fafa5c8a1818d428fdc6fd206f755e81a56f73b463d0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_gd.dll

Filesize
29KB

MD5
0cb26946b22b67acbd2348d25baf1f11

SHA1
9b74999efbe944089ef779d04d92579b82b4683f

SHA256
fe58df1b17fde8184475607bbb4367911c1ca9fdac79f256c001eaed0acb6b0a

SHA512
87e9cda95c6cad7f6efcf71068e9ac6c4e73858062079d4d264e7bd2f1e4126948e0d2ab57c9be7ff9f21fa59eeacab477bb455ab06f547aa3c5270fe1192b66

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_gl.dll

Filesize
27KB

MD5
0a3eea473ed114af963258dfeac97381

SHA1
55fd6a61fb35eea2a34a831448b4f3a9b7d1fde2

SHA256
7ce39b48849e3e33e78e9a39cc84665c33677ad248de27680c67305b4e6fa87d

SHA512
8849621aa87728b0fcca0aed5e598019630f91b609214c043d9e7eaec53a39bd95c8cd77e7eb5382ec8231df5f4742a7f59e031d8efb4643ebb4f27bccba0cab

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_gu.dll

Filesize
27KB

MD5
d75d2279ebc522f7b88d8e388b55a6bd

SHA1
ae532f5cf3630fd164458ee2b9178805c93064d9

SHA256
dc9e53b4d5b7cc6ea74effe897b6958b5991ddfbc60baf3ff5af74fc71fc138b

SHA512
741fb93967b31091905df55899c33303e80b1273187e296a10e4b85d7f93f53bca55e3f76ef5031d63716615e4c258b11efe19355874cda3624db39b0770039a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_hi.dll

Filesize
27KB

MD5
8088a0a302b58718eacc92fb787c74f4

SHA1
61dbe98e235723d82d7daacfbf3b0512976798e6

SHA256
bf81c79c7a6f20e7c5d28d4384129d9d5a61c1df5fcf1e249802e3c979c9d7c0

SHA512
41877350e92d46792f78984158557ef3cf78b7def79eb3b917e896e30c7865591406bd0245dc12220275bf4977aa25352e77eec037c46aa713e01a36d070ecfb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_hr.dll

Filesize
27KB

MD5
af2042a5338884a7b07ac78fb14091c8

SHA1
99c545e0ebbfb382918955519f88fc1a68aba125

SHA256
31143a690e4c51859e18b4f9221468042e705817d52170ada0dc1d508c455cb7

SHA512
5b00c5730c0233c196043b05ab4462c79b30d181ae7cdafe18713be881e09538b4f58cfa5c0a8c17f31a1b9459100dea3ae1adbee42d77f407b94fb25ed4575a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_hu.dll

Filesize
28KB

MD5
2f8083b85f9c4f588cb8843e21077198

SHA1
b21d1cdfaaa7b93064659614b3f27c8b4d5ce5ae

SHA256
9de51be04b9b01664132c174bc2567fb2fe15ee4b74a6e68c2c7e8c8808ab184

SHA512
296a6ce20a253c7e77ce94dbf46ec96b305df153915f96e338df21fc140bedcb9d4ba29b7faaf280a0dc607a870ee96254de9dc469c071c90fdd8c499ee8ef5b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_id.dll

Filesize
26KB

MD5
41ac4e817c88a1fc008a43e25c4d71a3

SHA1
ffce205ffb01a54f96b0191b7c15dc3cd769e337

SHA256
d4009d52a419b3870036dac6f40202f3670530d574829ad55616d7a00808d9d3

SHA512
4d867b4ef9f33d93b67497ab52b826a31c130bb385734a5fc6278aa3b93346cf148713b36fb2eaa0b8f1196109b7975c45cf40ae3a69c1f109a9da2e42d3e0d8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_is.dll

Filesize
26KB

MD5
74d1be37b419bc050be7107d5320b8fe

SHA1
98d9868042a4671b0a9f5abc17289ce42a685077

SHA256
5a379b8d3b188c8f321c4f58c9589a1e8e53dddfadd493fbea84bd14532d8c4e

SHA512
e26e0c72b14b835abdecc0185eb4a0c664ab749ab75b178fae687538bfa6607896674900403ce38e5aa594f6e78f1c4bc3c61db49a568fc89c0242c8605af62a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_it.dll

Filesize
29KB

MD5
cdd173c3f540c2fa198c84657804d969

SHA1
2278b71961c16c366760c972467d57e11354eb22

SHA256
c381989587679bd6e6b90632bfe57c20c987127fe5743dea3ef278745faaaff7

SHA512
01fc2e45183932c5b3029f3ee625d6c5fc4449f5f7cff11a963aeaa241fa2a510ba455dc4a408a9a0b0b0f127407983395545d0f8875d9a13ef1f368ddbd15f3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_iw.dll

Filesize
24KB

MD5
0ec86b4b2f37b6d19b7f884852730da0

SHA1
d39e6b0e1fda1e26b873ca635266b87bf41667fa

SHA256
637178fef36bcca7ac50b10091731d86d0b73892d60b98531d21614fed28dc30

SHA512
f49f9db37fbc1c47bf614ef391205a1a7da29045dec4f15ecfe38472c62264e5d107181d55b27f471b626fae7b6328ce05e8e60bc61ede271fc4c47804c0a4eb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_ja.dll

Filesize
23KB

MD5
02ef894b4b4b6d8c071fffff05f810ec

SHA1
4c36f9c8a4f5e22726f87402826b69cd29087a9f

SHA256
d0b824b90377e1912c349923d3cfc63018bf96f96ad6a46b0fabf5897fb248cc

SHA512
99dc3dbb5eded5cb369fa080bb03299e816a51d541069d93982b85f68bd1ff116483d51339d530cc475015510e9186d9794aae0caa389cbc97a63cea2e39dcac

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_ka.dll

Filesize
27KB

MD5
df96e9023cdb8cb827703e1fb9c592de

SHA1
eda83f777bc404c3bcc0c3eb7a12d5561238ac28

SHA256
415ab15b6a48176f3bcd09672de89ecd39684a482c9ee0d45bce366fb3450d43

SHA512
23698883a68259ffb36dd932f6b74a2257e8499336a66a41fe0b2a98d6e866a90f4e071f5d41a3942d3e4884a6dd7488b458879f8379fdeb4676edf593226e43

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_kk.dll

Filesize
27KB

MD5
9022a388f56e7f59270dbd0ec1e36583

SHA1
9a3103a02938bf873e0398c404b3b6efb27f60d5

SHA256
2e54385d95fcbfd998d5d83ac408c0a45af2329930678bc822544a46fd7390fa

SHA512
68455fd649d03927eb484b515838c2c5fb24eb8ae1adec80e60f83c5e150bf701b9adb43972e5a9050603af68cdbded152150c5dda5d90b04e2a942d053a7c62

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_km.dll

Filesize
26KB

MD5
a351a85e384b65bb7b5260eda1aac709

SHA1
9446d97d7d32deef18a9e1c62167747aa316fb35

SHA256
48423fa045bd50175e297cd0642335aafa57d16ce4eaba59734f12f88d2d526d

SHA512
0dab0dd012c53426feb07ba55dac3d8fbb718e1146b8cc495278b3a432277ecb454d181f48013cc86ee9e26d722c5e070d418a0dc86f9594e0c9a017126ccd94

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_kn.dll

Filesize
27KB

MD5
5ff19e69a260367c9f4e667d283da5d7

SHA1
e54c111fb7a02baadec488c358297a877aaeccd3

SHA256
c5fe72e4bf6ec76ba7f4d14374a2b15873de9a5815227ffb303a0b165dfe790e

SHA512
17a4f5a6e927146dfb3690d8e5cae29bb898299953734b1c1d8391c38106dfa96dca0246dff83b2bfabf9840661828fa7131df74a69b1ccd1470ce01f07fb99f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_ko.dll

Filesize
22KB

MD5
7a79d9fb7cb385c79c5cd7fee302d9d2

SHA1
0c2ec8d27c8faaed1a184929e92dccd1182b0e32

SHA256
9463457928689d87aa7a52cf5a205bb8bc67c0f94eeeed681715125582cbc2df

SHA512
224a3a960577afdbe47bfb42fa6059314ae16cf26686421603d1276bfa3bdcf58a9a26fc6dca298f9ff2f6e190a3008edf8a614d28cc354a8bc253b65b180d95

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_kok.dll

Filesize
26KB

MD5
ec003a7505d58aa0ec231415267c97ef

SHA1
43f4ce1a7c859b571042f2f23cc6a758ed806c95

SHA256
eb324b717e98ab6f47eaa65a7ba9e0e7ef9c7563fd05613ec149eab121edf86f

SHA512
20f61759938ed69df7b40628587915dea21e2ded3c9901ca9334b6add5f21995afd8d90ce7e290b6b51b9418395f526acca90f8071b6564f85a08d1253031bfc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_lb.dll

Filesize
29KB

MD5
7e830cc3d425a9d58f47b67f0c0284eb

SHA1
e7535444087b1c43f2414385bf77a59afd4ffb28

SHA256
3a99e182cfbae7e5909a7b35408db26ca16d987aeb5f068d0961933a5a4a7a5d

SHA512
90995fcb27bd58b9c0d6b08418eb66405ff5287ab9a4b27d08a5183efb54828fd3a9acbabb7aa146a6eb0cfb0c9aa5ce9f32451a35a9e0f5064850cc305f5dc3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_lo.dll

Filesize
26KB

MD5
20125fa0aa6057fe9483195d98b53b6a

SHA1
b90a5dcd8e65be58c4c8d6276aa1364f4d0d7e1d

SHA256
a909ffd028323697edc04d824a9de5e4e69f26fb6c8e9c11b0e311bf5b940d17

SHA512
460c0ebb18336391c25a60e99ea0927b36833ca2c91de6fc9cf3f32ac90e7e45527d95f668c03a859d91024ae7ae5372719ebba2e2c7745091b768407e2e4f9b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_lt.dll

Filesize
26KB

MD5
91c5d6031932f5d0cfb2778d08d6f63c

SHA1
9ae092d7b0b189eb24a2d4282f6598577a39eace

SHA256
afae45e481b705702da9b8c6b1cc32aef6e1c5df3a876dc8ad8b75fbca8a16ef

SHA512
aeb8675a78a48069224d0ce13ef69d2211b96d6e9c7fe75d0560bce03091ef9efdfb085cc616097072dd952e605e73e2493d6b38b03e01e7f8e85987b0e680b6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE985.tmp\msedgeupdateres_lv.dll

Filesize
27KB

MD5
47de5673add4c9043d0890e27afb273e

SHA1
efddeede2791e5ab1e57c3afd4399b0a439b7497

SHA256
6d3918c43a0eee94053e38c9b45dbf572af62ebd076c1317a5af8db10868ee34

SHA512
0a61f73b67aee5f980dedf14bad2df4cde19d0cbee83c76932a3936e5d2a9b66c131bb367d74e030ca453a4772d2beb5f72e79f6f3c0bfb9cc4856c3ba26de4a

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
4051d203bac2dff4768e22617db250da

SHA1
2d4d4e35f6f0cc8904d93a79d6bab5497452e67b

SHA256
bdd2ae7b99914d60db376132f8683eb5c5c850374faa5eb64b0be65abb33af6d

SHA512
37be219efc79e9f6f4817aa6fbefefd405c2daade5359b5c96c5d31cdb57f937d7f4f81bc9c5c6a3140f01c92db5ae55f864cc87ead39ba020b4e34e413b7a70

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
115KB

MD5
53dd7f1c24561e44792b4dc9969369d1

SHA1
c8a99b53670e457488ea25176103caed573f7969

SHA256
5d117974bbf6c7ce4307e537f462801bcdbf718d3a6f30b80091f6ddd17f9fd8

SHA512
ae57b779de9c5b94f212f3629abdbf4e0048c6a4870e1af8e41d61c47f283572a1a4d65c1c62063f5589c41aac908cbb3bc82692ce9a4d0227367039ce5c6e3e

Download Submit
C:\Users\Admin\AppData\Local\Package Cache\.unverified\PowerToysUserSetup_0.78.0_x64.msi

Filesize
15.0MB

MD5
fd51ba78cf3de1ddce254470223519ad

SHA1
78d3e00e2110a801d05254f65de8f9f97cfd4df9

SHA256
a03f466f3b13ba835af8a153d9b54dc5c384457d54b3384a6fc685f1c32eb393

SHA512
8a80540cc571bba723a8d202c9967edd27cf3343a7a3270a6617d30f77de9321e0c6720f6bd00e75516f2f007f771586ce2b1d879f8ad660ebdbee841c8d117f

Download Submit
C:\Users\Admin\AppData\Local\Package Cache\.unverified\TerminatePowerToys

Filesize
469B

MD5
e2f355a3e84e2589d9d69d3033ba5f80

SHA1
ceeb2f4674ab44e9ebce9175ce716612d979979c

SHA256
c5bded10d9ce53431e12f6806693a67122805f0a2235b373f868799374a353e3

SHA512
439a8989d4069c0616dbfe7f9488ece1d173feb234706c45f47e5aa9db98d155974adb6a5e67343f6fe184210f1f581cb3cae08f4ff1142ba9fbcfa03f997ea2

Download Submit
C:\Users\Admin\AppData\Local\Package Cache\.unverified\WebView2

Filesize
1.7MB

MD5
dbc06aa42fc27fd5fd0b87b2f9067637

SHA1
f7119e3ab3d5cb3adcd9a57f0ec227f783695819

SHA256
98370211f329f59b97308915790eeae4580a29a88c4285ee43a9f190a16e832e

SHA512
100cbfbfb0916e3658d5f8ff748c1c2368ea52f51e3c828425a9f9f2c366bdaf83612d650b93fc6cc4f4bc6d2d24efd841d761c13311cbb9293c4057907b9dd2

Download Submit
C:\Users\Admin\AppData\Local\Package Cache\F7119E3AB3D5CB3ADCD9A57F0EC227F783695819\MicrosoftEdgeWebview2Setup.exe

Filesize
805KB

MD5
2ca2509d3bf00c25bc78962529bb4d1f

SHA1
d2c42879004cae81d1faa5b537965a3d381c4096

SHA256
df47584ba3cb6b2e3dd21d846fe6000d43dbb4a84bf0ffd3c8b57f0db67a95ab

SHA512
5d62a16c2e5af3acb5241dfd97749de9b5685c37bd477875d2f750fb4eb34f757a00087b755a542549c59c39d5b70b85e68a97a3045d67ee9f1afda9c38b9e91

Download Submit
C:\Windows\Temp\{7AC537C5-3750-46C7-B253-D1AF98AB3E37}\.ba\logo.png

Filesize
1KB

MD5
807f899993da55765b3615a73a708862

SHA1
aaba81806befe73710116a477fd58634755d0f57

SHA256
d0f67d8dc4405840bbdef2ef78eed38db08739a773112f16d9edc2cec5f2daca

SHA512
394aa7e4d929fac4264a8d9e3fb2066e879a8d58d1709b838b8c00ac044265f8f6a1c2647f15e3e10e031b03af7581e89150527c95cf5376be1b193ad17a0525

Download Submit
C:\Windows\Temp\{7AC537C5-3750-46C7-B253-D1AF98AB3E37}\.ba\wixstdba.dll

Filesize
203KB

MD5
0ba387d66175c20452de372f8dbb79fe

SHA1
5411d41a7d88291b97fb9573eb6448c72e773b70

SHA256
7b3d4a22a56cd80f19c48a321f978f728d34b8227cdc7fcadeb76b7506b2bb33

SHA512
13ec6e6ddc602e8053aadd4dd84ed87c23b581f2a41d738e32a522128ca4985dcfcaedc7fab192085f0eb4facd1cd7ad91ccaf8505491e29288d2f66cbf705fd

Download Submit
C:\Windows\Temp\{D2874EB5-45B6-4139-BF91-5532481536CE}\.cr\PowerToysUserSetup-0.78.0-x64.exe

Filesize
646KB

MD5
d24fe4694e138b86d57ec179e2dfcd9c

SHA1
ce0572380ae3ab9332f238b00d2087e9c13ffa5c

SHA256
0c56f5d7fa7ef810567cfbe69b1368ffbad4dea15adff27244799264a0be3f6c

SHA512
402ff5e07cbeb4d6650a9c445991421cedb173f9049c79c3649de19f18dd6b7a80bf8bdce1182da895ac556381d9eaec149b77712f0fdc83f4a60a248afe7475

Download Submit